52602 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Food and Drug Administration
21 CFR Parts 808, 812, and 820
[Docket No. 90N–0172]
RIN 0910–AA09
Medical Devices; Current Good
Manufacturing Practice (CGMP) Final
Rule; Quality System Regulation
AGENCY: Food and Drug Administration,
HHS.
ACTION: Final rule.
SUMMARY: The Food and Drug
Administration (FDA) is revising the
current good manufacturing practice
(CGMP) requirements for medical
devices and incorporating them into a
quality system regulation. The quality
system regulation includes requirements
related to the methods used in, and the
facilities and controls used for,
designing, manufacturing, packaging,
labeling, storing, installing, and
servicing of medical devices intended
for human use. This action is necessary
to add preproduction design controls
and to achieve consistency with quality
system requirements worldwide. This
regulation sets forth the framework for
device manufacturers to follow and
gives them greater flexibility in
achieving quality requirements.
DATES: The regulation is effective June
1, 1997. For more information on
compliance with 21 CFR 820.30 see
section IV. of this document.
Written comments on the information
collection requirements should be
submitted by December 6, 1996.
ADDRESSES: Submit written comments
on the information collection
requirements to the Dockets
Management Branch (HFA–305), Food
and Drug Administration, 12420
Parklawn Dr., rm. 1–23, Rockville, MD
20857. All comments should be
identified with the docket number
found in brackets in the heading of this
document.
FOR FURTHER INFORMATION CONTACT:
Kimberly A. Trautman, Center for
Devices and Radiological Health (HFZ-
341), Food and Drug Administration,
2098 Gaither Rd., Rockville, MD 20850,
301–594–4648.
SUPPLEMENTARY INFORMATION:
I. Background
Manufacturers establish and follow
quality systems to help ensure that their
products consistently meet applicable
requirements and specifications. The
quality systems for FDA-regulated
products (food, drugs, biologics, and
devices) are known as CGMP’s. CGMP
requirements for devices in part 820 (21
CFR part 820) were first authorized by
section 520(f) of the Federal Food, Drug,
and Cosmetic Act (the act) (21 U.S.C.
360j(f)), which was among the
authorities added to the act by the
Medical Device Amendments of 1976
(Pub. L. 94–295).
Under section 520(f) of the act, FDA
issued a final rule in the Federal
Register of July 21, 1978 (43 FR 31 508),
prescribing CGMP requirements for the
methods used in, and the facilities and
controls used for the manufacture,
packing, storage, and installation of
medical devices. This regulation became
effective on December 18, 1978, and is
codified under part 820. Except for
editorial changes to update
organizational references in the
regulation and revisions to the list of
critical devices that was included in the
preamble to the final regulation, the
device CGMP requirements have not
been revised since 1978. This final rule
is the result of an extensive effort begun
in 1990 to revise this regulation.
The Safe Medical Devices Act of 1990
(the SMDA) (Pub. L. 101–629), enacted
on November 28, 1990, amended section
520(f) of the act, providing FDA with
the authority to add preproduction
design controls to the CGMP regulation.
This change in law was based on
findings that a significant proportion of
device recalls were attributed to faulty
design of product. Specifically, in
January 1990, FDA published the results
of an evaluation of device recalls that
occurred from October 1983 through
September 1989, in a report entitled
‘‘Device Recalls: A Study of Quality
Problems’’ (Ref. 1). (See 55 FR 21108,
May 22, 1990, where FDA announced
the availability of the report.) FDA
found that approximately 44 percent of
the quality problems that led to
voluntary recall actions during this 6-
year period were attributed to errors or
deficiencies that were designed into
particular devices and may have been
prevented by adequate design controls.
These design-related defects involved
both noncritical devices (e.g., patient
chair lifts, in vitro diagnostics, and
administration sets) and critical devices
(e.g., pacemakers and ventilators). Also
in 1990, the Department of Health and
Human Services’ Inspector General
conducted a study entitled ‘‘FDA
Medical Device Regulation From
Premarket Review to Recall’’ (Ref. 2),
which reached similar conclusions.
With respect to software used to operate
medical devices, the data were even
more striking. A subsequent study of
software-related recalls for the period of
fiscal year (FY) 1983 through FY 1991
indicated that over 90 percent of all
software-related device failures were
due to design-related errors, generally,
the failure to validate software prior to
routine production (Ref. 3).
The SMDA also added new section
803 to the act (21 U.S.C. 383) which,
among other things, encourages FDA to
work with foreign countries toward
mutual recognition of CGMP
requirements. FDA undertook the
revision of the CGMP regulation to add
the design controls authorized by the
SMDA to the CGMP regulation, as well
as because the agency believed that it
would be beneficial to the public and
the medical device industry for the
CGMP regulation to be consistent, to the
extent possible, with the requirements
for quality systems contained in
applicable international standards,
primarily, the International
Organization for Standards (ISO)
9001:1994 ‘‘Quality Systems—Model for
Quality Assurance in Design,
Development, Production, Installation,
and Servicing’’ (Ref. 4), and the ISO
committee draft (CD) revision of ISO/CD
13485 ‘‘Quality Systems—Medical
Devices—Supplementary Requirements
to ISO 9001’’ (Ref. 5).
This action is being taken under those
provisions of the SMDA and in response
to the following: (1) Notices that
appeared in the Federal Register of
April 25, 1990 (55 FR 17502), and in the
Federal Register of April 17, 1991 (56
FR 15626), that announced meetings of
the agency’s Device Good
Manufacturing Practice Advisory
Committee (GMP Advisory Committee),
at which the need for revisions to the
CGMP regulation was explored; (2) an
advance notice of proposed rulemaking
(ANPRM) that appeared in the Federal
Register of June 15, 1990 (55 FR 24544),
that announced the agency’s intent to
revise the CGMP regulation; (3) a notice
of availability of a document that
appeared in the Federal Register of
November 30, 1990 (55 FR 49644),
entitled ‘‘Medical Devices; Current
Good Manufacturing Practices (CGMP)
Regulations Document; Suggested
Changes; Availability’’ (Ref. 6) and
comments solicited from the public
about the document; (4) a proposed rule
in the Federal Register of November 23,
1993 (58 FR 61952), (Ref. 7) and
comments solicited from the public
about the proposal; (5) a notice of
availability that appeared in the Federal
Register of July 24, 1995 (60 FR 37856),
announcing the availability of the
‘‘Working Draft of the Current Good
Manufacturing Practice (CGMP) Final
Rule’’ (hereinafter referred to as the
Working Draft) (Ref. 8) and comments
52603Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
solicited from the public about the
Working Draft; (6) testimony at an
August 23, 1995, open public meeting
announced in the Federal Register (60
FR 37856); (7) and testimony and
advisory committee recommendations
from the September 13 and 14, 1995,
meeting of the GMP Advisory
Committee announced in the Federal
Register of August 24, 1995 (60 FR
44036). Thus, FDA’s decision to revise
the CGMP regulation is based on
changes in the law made by the SMDA,
the agency’s discussions with others
including its GMP Advisory Committee,
responses to the Federal Register
notices on this matter, FDA’s analysis of
recall data, its experience with the
regulatory application of the original
CGMP regulation, and its assessment of
international quality standards.
The agency’s final rule embraces the
same ‘‘umbrella’’ approach to the CGMP
regulation that is the underpinning of
the original CGMP regulation. Because
this regulation must apply to so many
different types of devices, the regulation
does not prescribe in detail how a
manufacturer must produce a specific
device. Rather, the regulation provides
the framework that all manufacturers
must follow by requiring that
manufacturers develop and follow
procedures and fill in the details that
are appropriate to a given device
according to the current state-of-the-art
manufacturing for that specific device.
FDA has made changes to the proposed
regulation and the Working Draft, as the
final rule evidences, to provide
manufacturers with even greater
flexibility in achieving the quality
requirements.
The Supreme Court recently
addressed the preemptive effect, under
section 521 of the act (21 U.S.C. 360k),
of the original CGMP regulation and
other FDA requirements for medical
devices on State tort actions. In
Medtronic, Inc. v. Lohr, 116 S. Ct. 2240
(1996), the Supreme Court gave
substantial deference to the agency’s
interpretation of section 521 of the act
found at § 808.1 (21 CFR 808.1). The
Court noted that CGMP requirements
are general rather than ‘‘specific
requirements applicable to a particular
device,’’ and that State common law
remedies are similarly general, and do
not establish a ‘‘substantive requirement
for a specific device.’’ (Lohr at 2257; see
also § 808.1(d) and (d)(6)(ii).) Moreover,
the Court drew a distinction between
remedies and requirements, noting that
while common law tort actions may
provide remedies different from those
available under the act, no preemption
occurs unless the substantive
requirements of the State law are
‘‘different from, or in addition to,’’ those
imposed by the act. (See Lohr at 2255.)
Under the Supreme Court’s analysis in
Lohr, the requirements imposed by the
original CGMP regulation would rarely
have preemptive effect.
FDA believes that the reasoning of
Medtronic v. Lohr applies equally to the
new quality system regulation, which,
as does the original CGMP regulation,
prescribes requirements that apply to
medical devices in general, rather than
to any particular medical device.
Therefore, FDA has concurrently
amended part 808 (21 CFR part 808) to
make clear the new quality system
regulation does not preempt State tort
and common law remedies.
II. Decision to Make a Working Draft
Available for Comment
In the Federal Register of November
23, 1993, the agency issued the
proposed revisions to the CGMP
regulation, entitled ‘‘Medical Devices;
Current Good Manufacturing Practice
(CGMP) Regulations; Proposed
Revisions; Request for Comments,’’ and
public comment was solicited. After the
proposal issued, FDA met with the
Global Harmonization Task Force (the
GHTF) Study Group in early March
1994, in Brussels, to compare the
provisions of the proposal with the
provisions of ISO 9001:1994 and
European National Standard (EN) 46001
‘‘Quality Systems—Medical Devices—
Particular Requirements for the
Application of EN 29001’’ (Ref. 9). ISO
9001:1994 and EN 46001:1994 are
written as voluntary standards, but
when used to fulfill the requirements of
the European Medical Device Directives,
or other national regulations, these
standards are mandatory requirements
similar to the CGMP requirements. The
GHTF includes: Representatives of the
Canadian Ministry of Health and
Welfare, the Japanese Ministry of Health
and Welfare, FDA, and industry
members from the European Union
(EU), Australia, Canada, Japan, and the
United States. The participants at the
GHTF meeting favorably regarded FDA’s
effort toward harmonization with
international standards. The GHTF
submitted comments, however, noting
where FDA could more closely
harmonize to achieve consistency with
quality system requirements worldwide.
Since the proposal published, FDA has
also attended numerous industry and
professional association seminars and
workshops, including ISO Technical
Committee (TC) 210 ‘‘Quality
Management and Corresponding
General Aspects for Medical Devices’’
meetings, where the proposed revisions
were discussed.
The original period for comment on
the proposal closed on February 22,
1994, and was extended until April 4,
1994. Because of the heavy volume of
comments and the desire to increase
public participation in the development
of the quality system regulation, FDA
decided to publish the notice of
availability in the Federal Register to
allow comment on the Working Draft
before issuing a final regulation.
The Working Draft represented the
agency’s views at the time on how it
would respond to the many comments
received, and on how the agency
believed a final rule should be framed.
FDA solicited public comment on the
Working Draft until October 23, 1995, to
determine if the agency had adequately
addressed the many comments received
and whether the agency had framed a
final rule that achieved the public
health goals to be gained from
implementation of quality systems in
the most efficient manner.
III. Open Public Meeting and GMP
Advisory Committee Meeting
FDA held an open public meeting on
the quality system regulation on August
23, 1995. The public meeting consisted
of prepared presentations followed by
an open discussion period. Both the
agency and the participants found the
meeting to be very productive in
focusing attention on the few main areas
of concern in the Working Draft. The
main issues were: The application of the
regulation to component manufacturers;
the application of the regulation to third
party servicers and refurbishers; and the
implementation timeframe of the final
rule. A transcript of the proceedings of
the public meeting, as well as data and
information submitted to FDA during
the public meeting, are available from
the Dockets Management Branch (HFA–
305), Food and Drug Administration,
12420 Parklawn Dr., rm. 1–23,
Rockville, MD 20857, between 9 a.m.
and 4 p.m., Monday through Friday.
There also was a meeting of the GMP
Advisory Committee on the Working
Draft on September 13 and 14, 1995. A
notice of the meeting was published in
the Federal Register of August 24, 1995.
FDA made a brief presentation to the
committee on the changes from the 1993
proposal to the 1995 Working Draft and
discussed some changes that FDA was
recommending as a result of the August
1995 meeting. Two consultants also
made presentations to the committee,
one a representative from ISO TC 176
(the TC that authored the ISO 9000
series) and the other a representative
from the European Committee for
Standardization (CEN). The remainder
of the meeting consisted of prepared
52604 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
presentations from the public and the
committee’s discussion on the main
issues.
The overwhelming majority of the
committee members believed that the
Working Draft met the public health
needs, gave manufacturers sufficient
flexibility to comply with the
regulation, and met the agency’s goal of
harmonizing the quality system
requirements with those of other
countries. The GMP Advisory
Committee strongly supported FDA’s
recommendation, in response to the
August 1995 public meeting, to not
include component manufacturers
under this final rule. However, the GMP
Advisory Committee was clearly
divided on several issues related to the
proposed regulation of third party
servicers and refurbishers. A transcript
of the proceedings of the GMP Advisory
Committee meeting, as well as data and
information submitted to FDA during
the meeting, are available from the
Dockets Management Branch (address
above).
After considering the written
comments and the views expressed at
meetings with the GHTF, at the August
1995 public meeting, and at the
September 1995 GMP Advisory
Committee meeting, FDA is publishing
this final rule. A summary of changes
from the July 1995 Working Draft to the
final rule is contained at the end of this
preamble.
IV. Implementation of the Final Rule
FDA has decided, in response to the
many comments and concerns
expressed about the need for more time
to implement design controls, to
implement the final rule in two stages.
Under stage one, on June 1, 1997,
approximately 1 year after this rule is
published in the Federal Register, all
elements of the final rule become
effective. However, with respect to the
design control requirements in § 820.30,
as long as manufacturers are taking
reasonable steps to come into
compliance, FDA will implement a
special 1-year transition program, with
a midcourse review, during which
official agency action will not be
initiated, including FDA Form 483
observations, warning letters, or
enforcement cases, based on failure to
comply with § 820.30. Under stage two,
beginning June 1, 1998, FDA will treat
noncompliance with design control
requirements in § 820.30 the same as
noncompliance with other provisions of
the CGMP regulation.
To prepare for stage one of this
implementation plan, FDA intends to
develop, by April of 1997, a strategy for
inspecting the design control
requirements. Both industry and FDA
field investigators will then be trained
on this inspectional strategy for design
controls during April and May 1997.
Starting June 1, 1997, manufacturers
will be inspected for compliance with
all the new quality system requirements,
including design controls, in the
manner described in the inspectional
strategy. However, as part of the
transition program, from June 1, 1997,
for a period of 1 year, although FDA will
inspect firms for compliance with the
design control requirements, the field
will issue any observations to the
manufacturer on a separate design
control inspectional strategy report, not
on FDA Form 483. The design control
inspectional strategy report will be
made a part of the manufacturer’s
establishment inspection report (EIR),
but the observations relating to § 820.30
will not be included in any warning
letters or regulatory actions during this
initial 1-year period. FDA notes that it
can, at any time, take action against
unsafe or adulterated medical devices
under different regulatory or statutory
authorities. FDA wants to emphasize
that manufacturers are required to take
reasonable steps to come into
compliance with the design control
requirements during the June 1, 1997, to
June 1, 1998, period.
FDA also emphasizes that this
transition period relates only to the
design control requirements of § 820.30,
and that beginning June 1, 1997, the
agency will issue observations on FDA
Form 483’s, issue warning letters, and
take any necessary regulatory action for
violations of all other provisions of the
CGMP final rule. The time period from
June 1, 1997, to June 1, 1998, is
intended to allow both the industry and
FDA field investigators time to become
familiar with the design control
requirements and the enforcement
aspects of this new area.
Finally, as described elsewhere in this
preamble, FDA intends to conduct a
midcourse review of the new design
control requirements during the
transition year (June 1997 to June 1998).
Specifically, the results of the first
several months of design control
inspections will be reviewed by early
1998. FDA will review all of the
completed design control inspectional
strategy reports that were given to
manufacturers from between June 1,
1997, through December 1, 1997. The
completed strategy reports will be
reviewed with particular attention paid
to clarity of information obtained, the
appropriateness of the information
collected with respect to the design
control requirements, the
appropriateness of the questions on the
inspectional strategy, the manner in
which the investigators are writing out
their observations, and any
requirements that seem to be giving
manufacturers a problem or where there
might be misunderstandings as to what
the regulation requires. FDA will then
hold an open public meeting in early
1998 to discuss with industry these
findings and to further explore any
concerns industry might be having in
implementing the new design control
requirements. As a result of the
midcourse review and open public
meeting, FDA might hold additional
workshops, meetings, and/or training
sessions.
Any midcourse adjustments to the
inspectional strategy will be instituted
and made public by the spring of 1998.
Also during this midcourse review, FDA
will evaluate the information gathered
at that point and determine if the design
control requirements as written in this
final rule are appropriate to obtain the
goals expressed in this preamble. FDA
will consider minor or even major
changes, based on experience to date.
Any necessary adjustments or proposed
revisions will be published in the
Federal Register and comments will be
solicited as necessary during the spring
of 1998. This implementation strategy is
responsive to requests by industry for
FDA to harmonize the quality system
regulation’s implementation with the
mandatory date for implementation of
the EU’s Medical Device Directive,
which is June 1998. However, if during
the midcourse review of stage one it is
determined that the industry and/or
FDA needs more time to fully
implement the design control
requirements, FDA will publish an
extension of the regulatory
implementation date for design control
requirements prior to June 1, 1998.
V. Response to Comments and
Rationale for Changes
Approximately 280 separate
individuals or groups commented on
the proposal published in the Federal
Register of November 23, 1993, and
approximately 175 separate individuals
or groups commented on the Working
Draft that was announced in a notice of
availability published in the Federal
Register on July 24, 1995. FDA made
many changes in response to the
comments. Most of the changes were
made in response to specific comments,
in response to comments for clarity,
understanding, and readability, or to
further harmonize FDA requirements
with international standards, as many
comments requested.
Numerous comments stated that
industry was very pleased with FDA’s
52605Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
Working Draft and the effort that was
made to harmonize with ISO, as well as
to engage industry in commenting on
the Working Draft through the open
public meeting and the GMP Advisory
Committee meeting that were held in
August and September 1995,
respectively.
FDA’s responses to the comments
received on the proposal and the
Working Draft, as well as explanations
for the changes made, follow.
A. General Provisions (Subpart A)
i. Scope (§ 820.1)
1. The title of the regulation, as
reflected in this section, has been
changed from the ‘‘Current Good
Manufacturing Practices (CGMP)’’
regulation to the ‘‘Quality System’’
regulation. This revision follows the
suggestion underlying many comments
on specific provisions that FDA
generally harmonize the CGMP
requirements and terminology with
international standards. ISO 9001:1994,
ISO/CD 13485, and EN 46001 employ
this terminology to describe the CGMP
requirements. In addition, this title
accurately describes the sum of the
requirements, which now include the
CGMP requirements for design,
purchasing, and servicing controls.
CGMP requirements now cover a full
quality system.
FDA notes that the principles
embodied in this quality system
regulation have been accepted
worldwide as a means of ensuring that
acceptable products are produced.
While the regulation has been
harmonized with the medical device
requirements in Europe, Australia, and
Japan, as well as the requirements
proposed by Canada, it is anticipated
that other countries will adopt similar
requirements in the near future.
FDA, however, did not adopt ISO
9001:1994 verbatim for two reasons.
First, there were complications in
dealing with the issue of copyrights and,
second, FDA along with health agencies
of other governments does not believe
that for medical devices ISO 9001:1994
alone is sufficient to adequately protect
the public health. Therefore, FDA has
worked closely with the GHTF and TC
210 to develop a regulation which is
consistent with both ISO 9001:1994 and
ISO/CD 13485. FDA made several
suggestions to TC 210 on the drafts of
the ISO/CD 13485 document in order to
minimize differences and move closer to
harmonization. In some cases, FDA has
explicitly stated requirements that many
experts believe are inherent in ISO
9001:1994. Through the many years of
experience enforcing and evaluating
compliance with the original CGMP
regulation, FDA has found that it is
necessary to clearly spell out its
expectations. This difference in
approach does not represent any
fundamentally different requirements
that would hinder global harmonization.
In fact, numerous comments expressed
their approval and satisfaction with
FDA’s effort to harmonize the quality
system requirements with those of ISO
9001:1994 and ISO/CD 13485.
2. One comment suggested that the
term ‘‘purchasing’’ in the scope be
deleted because it could be interpreted
to mean the purchase of finished
medical devices by health care
institutions and medical professionals,
instead of the purchase of components
and manufacturing materials as
intended.
FDA agrees and has deleted the term
‘‘purchasing’’ throughout the regulation
when used in this context.
3. Several comments suggested that
§ 820.1(a)(1) should not state that the
regulation establishes the ‘‘minimum’’
requirements because it implies that
compliance with the stated
requirements may be insufficient. They
asked that FDA delete the word
‘‘minimum,’’ to avoid having auditors
search for additional requirements.
FDA does not believe that the
provision would have required that
manufacturers meet additional
requirements not mandated by the
regulation but has modified the section
to clarify its intent by stating that the
regulation establishes the ‘‘basic’’
requirements for manufacturing devices.
The quality system regulation provides
a framework of basic requirements for
each manufacturer to use in establishing
a quality system appropriate to the
devices designed and manufactured and
the manufacturing processes employed.
Manufacturers must adopt current and
effective methods and procedures for
each device they design and
manufacture to comply with and
implement the basic requirements. The
regulation provides the flexibility
necessary to allow manufacturers to
adopt advances in technology, as well as
new manufacturing and quality system
procedures, as they become available.
During inspections, FDA will assess
whether a manufacturer has established
procedures and followed requirements
that are appropriate to a given device
under the current state-of-the-art
manufacturing for that specific device.
FDA investigators receive extensive
training to ensure uniform
interpretation and application of the
regulation to the medical device
industry. Thus, the agency does not
believe that FDA investigators will cite
deviations from requirements not
contained in this part. However, as
noted above, FDA has altered the
language of the scope to make clear that
additional, unstated requirements do
not exist.
4. A few comments suggested
eliminating the distinction between
critical and noncritical devices, thus
eliminating the need for distinct
requirements for critical devices. Other
comments disagreed, asserting that
eliminating the distinction would
increase the cost of production of low-
risk devices without improving their
safety and effectiveness.
FDA agrees in part with the comments
that suggest eliminating the distinction
between critical and noncritical devices
and has eliminated the term ‘‘critical
device’’ from the scope, definitions, and
regulation in §§ 820.65 Critical devices,
traceability and 820.165 Critical
devices, labeling. However, FDA has
retained the concept of distinguishing
between devices for the traceability
requirements in § 820.65. As addressed
in the discussion under that section,
FDA believes that it is imperative that
manufacturers be able to trace, by
control number, any device, or where
appropriate component of a device, that
is intended for surgical implant into the
body or to support or sustain life whose
failure to perform when properly used
in accordance with instructions for use
provided in the labeling can be
reasonably expected to result in a
significant injury to the user.
The deletion of the terminology will
bring the regulation in closer harmony
with ISO 9001:1994 and the quality
system standards or requirements of
other countries.
Finally, FDA notes that eliminating
the term ‘‘critical device’’ and the list of
critical devices does not result in the
imposition of new requirements. In fact
the new regulation is less prescriptive
and gives the manufacturer the
flexibility to determine the controls that
are necessary commensurate with risk.
The burden is on the manufacturer,
however, to describe the types and
degree of controls and how those
controls were decided upon. Such
determinations are made in accordance
with standard operating procedures
(SOP’s) established by the manufacturer.
5. In response to numerous
comments, FDA has added the sentence
‘‘If a person engages in only some
operations subject to the requirements
in this part, and not in others, that
person need only comply with those
requirements applicable to the
operations in which he or she is
engaged.’’ This sentence was added to
clarify the scope of the regulation and
52606 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
the responsibility of those who fall
under this regulation. The wording is
the same as that used in the drug CGMP.
6. Several comments recommended
that the short list of class I devices
subject to design control requirements
be deleted from the regulation and be
placed in the preamble, to allow
additions or deletions without requiring
a change to the entire regulation. Others
commented that the list of class I
devices should be entirely eliminated to
harmonize with Europe and Japan.
FDA disagrees that the list of devices
subject to design control requirements
should be deleted from the regulation.
FDA has experienced problems or has
concerns with the class I devices listed
and has determined that design controls
are needed for the listed devices.
Further, placing the list in the
regulation establishes the requirements
related to those devices, and is
convenient for use by persons who are
not familiar with, or who do not have
access to, the preamble. Further, FDA
notes that individual sections of a
regulation may be revised independent
of the remainder of the regulation.
7. Numerous written comments and
persons who testified at the August and
September 1995 meetings stated that
application of the regulation to
component manufacturers would
increase product cost, with questionable
value added to device safety and
effectiveness, and that many component
suppliers would refuse to supply
components or services to the medical
device industry. This would be
especially likely to occur, it was
suggested, where medical device
manufacturers account for a small
fraction of the supplier’s sales.
FDA believes that because of the
complexity of many components used
in medical devices, their adequacy
cannot always be assured through
inspection and testing at the finished
device manufacturer. This is especially
true of software and software-related
components, such as microprocessors
and microcircuits. Quality must be
designed and built into components
through the application of proper
quality systems.
However, FDA notes that the quality
system regulation now explicitly
requires that the finished device
manufacturer assess the capability of
suppliers, contractors, and consultants
to provide quality products pursuant to
§ 820.50 Purchasing controls. These
requirements supplement the
acceptance requirements under
§ 820.80. Manufacturers must comply
with both sections for any incoming
component or subassembly or service,
regardless of the finished device
manufacturer’s financial or business
affiliation with the person providing
such products or services. FDA believes
that these purchasing controls are
sufficient to provide the needed
assurance that suppliers, contractors,
and consultants have adequate controls
to produce acceptable components.
Therefore, balancing the many
concerns of the medical device industry
and the agency’s public health and
safety concerns, FDA has decided to
remove the provision making the CGMP
regulation applicable to component
manufacturers and return to the
language in the original CGMP
regulation. This approach was
unanimously endorsed by the members
of the GMP Advisory Committee at the
September 1995 meeting. FDA will
continue to focus its inspections on
finished device manufacturers and
expects that such manufacturers will
properly ensure that the components
they purchase are safe and effective.
Finished device manufacturers who fail
to comply with §§ 820.50 and 820.80
will be subject to enforcement action.
FDA notes that the legal authority exists
to cover component manufacturers
under the CGMP regulation should the
need arise.
8. One comment stated that proposed
§ 820.1(a)(2) should be revised to
include the District of Columbia and the
Commonwealth of Puerto Rico, as in the
original CGMP regulation.
FDA agrees with the comment. These
localities were inadvertently omitted
and have been added to the regulation.
9. FDA added § 820.1(a)(3) on how to
interpret the phrase ‘‘where
appropriate’’ in the regulation, as
recommended by the GMP Advisory
Committee. This section is consistent
with the statement in ISO/CD 13485.
10. Some comments on proposed
§ 820.1(c) recommended that the section
be deleted as it already appears in the
act. Others stated that the provision
implies that FDA will subject devices or
persons to legal action, regardless of the
level of noncompliance. Still others
suggested that only intentional
violations of the regulation should give
rise to regulatory action.
FDA disagrees with these comments.
The consequences of the failure to
comply, and the legal authority under
which regulatory action may be taken,
are included in the regulation so that
the public may be fully apprised of the
possible consequences of
noncompliance and understand the
importance of compliance. FDA notes
that the agency exercises discretion
when deciding whether to pursue a
regulatory action and does not take
enforcement action for every violation it
encounters. Further, FDA generally
provides manufacturers with warning
prior to initiating regulatory action and
encourages voluntary compliance. The
agency also notes, however, that
violations of this regulation need not be
intentional to place the public at serious
risk or for FDA to take regulatory action
for such violations.
In response to the concerns regarding
the tone of the section, however, the
title has been changed. FDA has also
deleted the specific provisions
referenced in the proposed section with
which the failure to comply would
render the devices adulterated. The term
‘‘part’’ includes all of the regulation’s
requirements.
11. A few comments on proposed
§ 820.1(c)(2), now § 820.1(d), requested
that the agency clarify what is meant by
requiring that foreign manufacturers
‘‘schedule’’ an inspection. A few
comments stated that FDA was adding
new requirements for foreign
manufacturers in this section. Others
stated that the proposed language would
prohibit global harmonization because it
would limit third party audits in place
of FDA inspections.
FDA has moved the provision related
to foreign manufacturers into a separate
section and has modified the language.
The language in the regulation reflects
the language in section 801(a) of the act
(21 U.S.C. 381(a)). FDA disagrees that it
is adding new requirements for foreign
manufacturers in § 820.1(d) because the
section recites the current requirement
and standard used, and is consistent
with current agency policy. The agency
believes that it is imperative that foreign
facilities be inspected for compliance
with this regulation and that they be
held to the same high standards to
which U.S. manufacturers are held.
Otherwise, the U.S. public will not be
sufficiently protected from potentially
dangerous devices, and the U.S. medical
device industry will be at a competitive
disadvantage.
FDA intends to continue scheduling
inspections of foreign manufacturers in
advance to assure their availability and
avoid conflicts with holidays and shut
down periods. However, the language
pertaining to the ‘‘scheduling’’ of such
inspections has been deleted to allow
flexibility in scheduling methods.
FDA disagrees that, as written, the
language would prohibit inspections by
third parties. FDA may use third party
inspections, as it uses other compliance
information, in setting its priorities and
utilizing its resources related to foreign
inspections. In this regard, FDA looks
forward to entering into agreements
with foreign countries related to CGMP
52607Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
inspections that would provide FDA
with reliable inspectional information.
12. Two comments stated that the
section on ‘‘Exemptions or variances,’’
now § 820.1(e), should require that FDA
provide a decision on petitions within
60 days of receipt and state that the
agency will take no enforcement action
with respect to the subject of the
petition until a decision is rendered.
The comments said that the petition
process is long, arduous, and not
practical.
FDA disagrees with the comments.
Currently, FDA is required by section
520(f)(2)(B) of the act to respond within
60 days of receipt of the petition, unless
the petition is referred to an advisory
committee. When the 1978 CGMP
regulation was published, there was a
prediction that FDA would be
overwhelmed with petitions for
exemption and variance from the
regulation. Over the past 18 years, since
the CGMP regulation first became
effective, FDA has only received
approximately 75 petitions. It is FDA’s
opinion that few petitions have been
received because of the flexible nature
of the CGMP regulation. FDA has
attempted to write the current
regulation with at least the same degree
of flexibility, if not more, to allow
manufacturers to design a quality
system that is appropriate for their
devices and operations and that is not
overly burdensome.
Guidelines for the submission of
petitions for exemption or variance are
available from the Division of Small
Manufacturers Assistance (the DSMA).
The petition guidelines state that FDA
will not process a petition for
exemption or variance while an FDA
inspection of a manufacturer is ongoing.
Until FDA has approved a petition for
an exemption or variance, a
manufacturer should not deviate from
the requirements of this regulation. FDA
must first have the opportunity to
ensure that the manufacturer has
established that an exemption or
variance is warranted, to carry out its
obligation of ensuring that devices are
safe and effective.
13. Several comments stated that the
proposed requirements are not
necessary for all manufacturers,
particularly small manufacturers with
few employees and low-risk devices.
Other comments stated that the
documentation requirements are
excessive.
FDA generally disagrees with these
comments. The regulation provides the
‘‘basic’’ requirements for the design and
manufacture of medical devices. And, as
noted in the previous response, the
requirements are written in general
terms to allow manufacturers to
establish procedures appropriate for
their devices and operations. Also, as
discussed above, a manufacturer need
only comply with those requirements
applicable to the operations in which he
or she is engaged. However, because the
regulation requirements are basic, they
will apply in total to most
manufacturers subject to the regulation.
The extent of the documentation
necessary to meet the regulation
requirements may vary with the
complexity of the design and
manufacturing operations, the size of
the firm, the importance of a process,
and the risk associated with the failure
of the device, among other factors.
Small manufacturers may design
acceptable quality systems that require
a minimum of documentation and,
where possible, may automate
documentation. In many situations,
documentation may be kept at a
minimum by combining many of the
recordkeeping requirements of the
regulation, for example, the production
SOP’s, handling, and storage
procedures. When manufacturers
believe that the requirements are not
necessary for their operations, they may
petition for an exemption or variance
from all or part of the regulation
pursuant to section 520(f)(2) of the act.
In addition, FDA has added a variance
provision in § 820.1(e)(2) under which
the agency can initiate a variance when
it is in the best interest of the public
health. Under this provision, for
instance, the agency may initiate and
grant a variance to manufacturers of
devices during times of product
shortages, where the devices are needed
by the public and may not otherwise be
made available, if such manufacturers
can adequately assure that the resulting
devices are safe and effective. The
agency envisions this provision as a
bridge, providing a manufacturer with
the time necessary to fulfill the
requirements in the regulation while
providing important and needed devices
to the public. Thus, the variance would
only be granted for a short period of
time, and only while the devices
remained necessary and in short supply.
Under this provision, FDA will require
a manufacturer to submit a plan
detailing the action it is taking to assure
the safety and effectiveness of the
devices it manufactures and to meet the
requirements of the regulation.
This agency initiated variance
provision is in accordance with section
520(f) of the act which permits, but does
not require, FDA to promulgate
regulations governing the good
manufacturing practices for devices and
section 701(a) of the act (21 U.S.C.
371(a)), which permits FDA to
promulgate regulations for the efficient
enforcement of the act. Because the
statute does not mandate that the agency
establish any requirements for device
CGMP’s, the agency has the authority to
determine that the manufacturers of
certain devices need not follow every
requirement of the regulation.
Further, the agency initiated variance
provision is in keeping with the intent
of Congress that FDA prevent hazardous
devices from reaching the marketplace,
H. Rept. 853, 94th Cong., 2d sess. 25–
26 (1976), and the general intent of the
act that the agency undertake to protect
the public health. The agency will only
initiate such a variance where the
devices are needed and may not
otherwise be made available, and the
manufacturer can assure the agency that
its procedures are likely to be adequate
and that it is actively pursuing full
compliance. The variances will only be
in effect for a limited time.
Section 820.1(e) has been modified to
include the above addition, to reflect the
title change of the regulation, and to
provide the most current address for the
DSMA.
ii. Definitions (§ 820.3)
14. Several comments were received
regarding the definition of ‘‘complaint.’’
Comments generally believed that the
definition was unclear and could be
interpreted to include routine service
requests, communications from
customers unrelated to the quality,
safety, or effectiveness of the device,
and internal communications.
FDA agrees with the comments in part
and has modified the definition to make
clear that a communication would be
considered a ‘‘complaint’’ only if the
communication alleged some deficiency
related to the identity, quality,
durability, reliability, safety,
effectiveness, or performance of the
device after it is released for
distribution. The definition is now very
similar to the definition used in ISO/CD
13485.
The regulation addresses service
requests and in-house indications of
dissatisfaction under § 820.100
Corrective and preventive action. This
section requires manufacturers to
establish procedures to identify quality
problems and process the information
received to detect and correct quality
problems. Information generated in-
house relating to quality problems
should be documented and processed as
part of this corrective and preventive
action program.
With respect to service requests,
§ 820.200 Servicing states that a service
report that represents an event which
52608 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
must be reported to the FDA under part
803 or 804 (21 CFR part 803 or 804)
shall automatically be considered a
complaint. All other service reports
must be analyzed for trends or systemic
problems and when found, these trends
or systemic problems must be
investigated according to the provisions
of § 820.100 Corrective and preventive
action.
15. One comment suggested that the
agency delete the phrase ‘‘used during
device manufacturing’’ in the definition
of ‘‘component’’ because it was
confusing and may cause problems with
certain aspects of distributor operations.
FDA agrees and has deleted the words
‘‘used during device manufacturing’’
from the definition because it was not
intended to differentiate between
distributors and manufacturers. Further,
FDA deleted the term ‘‘packaging’’ to
clarify that every piece of packaging is
not necessarily a component. Only the
materials that are part of the ‘‘finished,
packaged, and labeled device’’ are
considered to be components.
16. Several comments stated that the
term ‘‘complete history’’ in the
definition of ‘‘control number’’ should
be clarified or deleted because it is
unclear what a complete production
history is, and the term could be
construed to require full traceability for
all component lots of any product
containing a control number.
FDA agrees in part with the
comments. The control number is the
means by which the history of the
device, from purchase of components
and materials through distribution, may
be traced, where traceability is required.
The definition does not require that a
manufacturer be able to trace the device
whenever control numbers are used. In
fact, the definition itself does not
establish any requirements. The agency
notes, however, that the manufacturer’s
traceability procedures should ensure
that a complete history of the device,
including environmental conditions
which could cause the device to fail to
conform to its specified requirements,
can be traced and should facilitate
investigation of quality problems and
corrective action. FDA notes, however,
that the level of detail required for this
history is dependent on the nature of
the device, its intended use, and its
complexity. Therefore, FDA has
removed the term ‘‘complete’’ in the
definition for clarity and flexibility.
FDA has also amended the definition
for added flexibility, to state that
symbols may be used and has included
the term ‘‘unit’’ for any device that is
not manufactured as a lot or batch.
17. The definition of ‘‘critical device’’
has been deleted for the reasons
discussed above.
18. Several comments stated that the
term ‘‘design history record’’ should be
changed because the acronym for the
term is the same as that for device
history record (the DHR). Other
comments said the ‘‘design history
record’’ should not need to contain
documentation of a ‘‘complete’’ design
history. One comment stated that the
definition should allow reference to
records containing the design history of
the device. A few comments stated that
the term should be deleted altogether
because it is redundant with the
definition of device master record (the
DMR).
FDA agrees in part with these
comments and has changed the term
‘‘design history record’’ to ‘‘design
history file.’’ In addition, FDA has
amended the provisions to require that
the file describe the design history, as it
may not be necessary to maintain a
record of every step in the design phase,
although the ‘‘entire history’’ should be
apparent from the document. Section
820.30(j) further delineates what should
be in the design history file (the DHF),
specifically records sufficient to verify
that the design was developed in
accordance with the design and
development plan and other applicable
design requirements of the regulation.
FDA does not agree that the
definitions of the DHF and the DMR are
redundant. The DHF for each type of
device should include, for example, the
design and development plan, design
review results, design verification
results, and design validation results, as
well as any other data necessary to
establish compliance with the design
requirements. The DMR should contain
all of the procedures related to each
type of device as required by this part
and the most current manufacturing
specifications of the device, once the
design specifications have been
transferred into production.
19. One comment on ‘‘design input’’
stated it was confused by the term
‘‘requirements’’ and wanted to know
whose requirements are encompassed in
this definition.
The term ‘‘requirement’’ is meant in
the broadest sense, to encompass any
internally or externally imposed
requirements such as safety, customer-
related, and regulatory requirements.
All of these requirements must be
considered as design inputs. How these
requirements are handled and dealt
with is up to the manufacturer.
20. Two comments stated that the
definition of ‘‘design output’’ should be
revised because it is not necessary, and
would be burdensome, to keep records
of and review the ‘‘results of a design
effort at each design phase and at the
end.’’ Other comments suggested that
the design output definition should be
restricted to physical characteristics of
the device.
FDA agrees in part, but has not
deleted the phrase ‘‘results of a design
effort at each design phase and at the
end’’ from the definition. The intent was
not to dictate when design phases
would occur. Such phases will be
defined in the design and development
plan. For example, a manufacturer may
only have a few design phases for a new
type of syringe. Thus, design output
would be the results of those few efforts.
The results of each design phase
constitute the total design output. The
definition has been amended, however,
to clarify that the finished design output
is the basis for the DMR.
FDA disagrees with the comments
that suggest that the design output
should be restricted to physical
characteristics of the device. Design
output is more than just the device
specifications. Design output includes,
among other things, the specifications
for the manufacturing process, the
quality assurance testing, and the device
labeling and packaging. It is important
to note that the design effort should not
only control the design aspects of the
device during the original development
phase, but also all subsequent design
and development activities including
any redesign or design changes after the
original design is transferred to
production.
21. A few comments on the definition
of ‘‘design review’’ stated that proposing
solutions to problems is not part of the
design review activity. Two other
comments expressed concern that the
definition would require that each
design review be ‘‘comprehensive.’’
In response to the comments on the
proper role of design review, FDA
agrees that the design review
participants are typically not
responsible for establishing solutions,
although they may do so in many small
operations. The definition has been
amended, but FDA wants to make clear
that although the design review
participants need not propose solutions,
they should ensure that solutions to any
identified problems are adequate and
implemented appropriately.
Regarding the scope of design review,
each design review need not be
‘‘comprehensive’’ for the entire design
process but must be ‘‘comprehensive’’
for the design phase being reviewed.
However, at the end of the design
process when the design is transferred
52609Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
to production, all aspects of the design
process should have been reviewed.
A few other changes were made to
harmonize with the definition in ISO
8402:1994 ‘‘Quality—Vocabulary.’’
22. Comments on the definition of
‘‘device master record’’ pointed out that
the definition is not consistent with the
requirements of § 820.181 Device master
record. Other comments stated that the
definition should allow reference to
records. One comment stated that ‘‘all’’
procedures related to a specific finished
device need not be included in the
DMR, such as the procedures for the
design and development, since they
may be in the DHF.
FDA agrees in part with the comments
that found the DMR definition and
requirements to be inconsistent and has
amended the definition to be consistent
with the requirements set forth in
§ 820.181. FDA does not believe,
however, that it is necessary to modify
the definition to include the referencing
of records because the DMR
requirements in § 820.181 state that the
DMR ‘‘shall include or refer to the
location of’’ the required information.
FDA agrees that the term ‘‘all’’ is not
necessary and has deleted it in order to
give manufacturers the necessary
flexibility.
23. The definition for the term ‘‘end-
of-life’’ was added to the Working Draft
because this term was used in the
definitions for ‘‘refurbisher’’ and
‘‘servicing’’ to help distinguish the
activities of refurbishing from those of
servicing. FDA determined that such a
distinction was necessary, due to
comments and ongoing confusion
regarding the difference between the
two functions, and the different
requirements applicable to the
functions.
Many written comments and persons
who testified at the August and
September 1995 meetings stated that the
term was confusing, unnecessary, and
introduced many new legal and liability
issues. FDA agrees with these comments
and has deleted the term throughout the
regulation. FDA has also deleted
definitions for ‘‘refurbisher’’ and
‘‘servicing’’ for the reasons discussed
below.
24. The few comments received on
the definition of ‘‘establish’’ indicated a
concern that the regulation requires too
much documentation and is more
onerous than ISO 9001 requirements.
FDA disagrees with the comments.
The term ‘‘establish’’ is only used where
documentation is necessary. FDA also
notes that the quality system regulation
is premised on the theory that adequate
written procedures, which are
implemented appropriately, will likely
ensure the safety and effectiveness of
the device. ISO 9001:1994 relies on the
same premise. The 1994 version of ISO
9001 broadly requires the manufacturer
to ‘‘establish, document, and maintain a
quality system,’’ which includes
documenting procedures to meet the
requirements.
The definition has been amended,
however, in response to general
comments received, to clarify that a
‘‘document’’ may be in writing or on
electronic media, to allow flexibility for
any type of recorded media.
25. FDA received comments
questioning the inclusion of a device
that is intended to be sterile, but that is
not yet sterile, in the definition of
‘‘finished device.’’ A few comments
stated that ‘‘capable of functioning’’ is
ambiguous, and ‘‘suitable for use’’ is not
necessary. Another comment requested
that the term ‘‘accessory’’ be defined.
FDA disagrees with the comments,
but has amended the definition for
clarification. Since the 1978 CGMP
regulation was promulgated, FDA has
been repeatedly asked whether devices
intended to be sold as sterile are
considered subject to the CGMP
requirements, even though they have
not yet been sterilized. The agency had
intended the new definition to make
explicit the application of the regulation
to the manufacture of sterile devices
that have yet to be sterilized. Although
FDA believes it should be obvious that
such devices are subject to CGMP
requirements, some manufacturers have
taken the position that the regulation
does not apply because the device is not
‘‘finished’’ or ‘‘suitable for use’’ until it
has been sterilized.
To better clarify its intent, FDA has
amended the definition to add that all
devices that are capable of functioning,
including those devices that could be
used even though they are not yet in
their final form, are ‘‘finished devices.’’
For example, devices that have been
manufactured or assembled, and need
only to be sterilized, polished, inspected
and tested, or packaged or labeled by a
purchaser/manufacturer are clearly not
components, but are now in a condition
in which they could be used, therefore
meeting the definition of ‘‘finished
device.’’
The distinction between
‘‘components’’ and ‘‘finished devices’’
was not intended to permit
manufacturers to manufacture devices
without complying with CGMP
requirements by claiming that other
functions, such as sterilization,
incoming inspection (where sold for
subsequent minor polishing,
sterilization, or packaging), or insertion
of software, will take place. The public
would not be adequately protected in
such cases if a manufacturer could
claim that a device was not a ‘‘finished’’
device subject to the CGMP regulation
because it was not in its ‘‘final’’ form.
The phrase ‘‘for commercial
distribution’’ was deleted from the
proposed definition of ‘‘finished
device’’ because it is not necessary for
a device to be in commercial
distribution to be considered a finished
device. Further, FDA notes that the term
‘‘accessory’’ is described in
§ 807.20(a)(5) (21 CFR 807.20(a)(5)).
26. Two comments on the definition
of ‘‘lot or batch’’ requested that the
definition be clarified: One to reflect
that single units may be produced for
distribution, the other to indicate that
what constitutes a lot or a batch may
vary depending on the context.
In response to the comments, FDA has
modified the definition to make clear
that a lot or batch may, depending on
circumstances, be comprised of one
finished device. Whether for inspection
or for distribution, a lot or batch is
determined by the factors set forth in
the definition; of course, a manufacturer
may determine the size of the lot or
batch, as appropriate.
27. Several comments received on the
definition of ‘‘executive management’’
objected that the definition is
inconsistent with ISO 9001. Others
thought that FDA should better define
the level of management the term was
intended to describe.
FDA agrees with both concerns and
has modified the definition by deleting
the second half, which appeared to
bring executive authority and
responsibility too far down the
organization chart. The term was
intended to apply only to management
that has the authority to bring about
change in the quality system and the
management of the quality system.
Although such management would
clearly have authority over, for example,
distribution, those who may have
delegated management authority over
distribution would not necessarily have
authority over the quality system and
quality policy. Accordingly, the
definition has been modified to include
only those who have the authority and
responsibility to establish and make
changes to the quality policy and
quality system. It is the responsibility of
top management to establish and
communicate the quality policy. In
addition, the term ‘‘executive
management’’ has been changed to
‘‘management with executive
responsibility,’’ to harmonize with ISO
9001:1994.
28. Several comments in response to
the proposed definition of
52610 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
‘‘manufacturer’’ stated that refurbishers
and servicers should be added to the
definition of a ‘‘manufacturer.’’ Other
comments recommended adding the
term ‘‘remanufacturer.’’ Other
comments requested deletion of contract
sterilizers, installers, specification
developers, repackagers, relabelers, and
initial distributors from the definition.
One comment stated that the phrase
‘‘processes a finished device’’ should be
explained in the definition of
manufacturer.
FDA’s Compliance Policy Guide
(CPG) 7124.28 contains the agency’s
policy regarding the provisions of the
act and regulations with which persons
who recondition or rebuild used devices
are expected to comply. This CPG is in
the process of being revised in light of
FDA’s experience in this area. FDA is
not including the terms ‘‘servicer’’ or
‘‘refurbisher,’’ as they relate to entities
outside the control of the original
equipment manufacturer, in this final
regulation, even though it believes that
persons who perform such functions
meet the definition of manufacturer.
Because of a number of competitive and
other issues, including sharply divided
views by members of the GMP Advisory
Committee at the September 1995
meeting, FDA has elected to address
application of the CGMP requirements
to persons who perform servicing and
refurbishing functions outside the
control of the original manufacturer in
a separate rulemaking later this year,
with another opportunity for public
comment.
FDA agrees that the term
‘‘remanufacturing’’ should be added to
the definition of ‘‘manufacturer’’ and
has separately defined the term. A
remanufacturer is defined as ‘‘any
person who processes, conditions,
renovates, repackages, restores, or does
any other act to a finished device that
significantly changes the finished
device’s performance or safety
specifications, or intended use.’’
However, FDA disagrees that contract
sterilizers, installers, specification
developers, repackagers, relabelers, and
initial distributors should be deleted
from the definition, primarily because
all such persons may have a significant
effect on the safety and effectiveness of
a device and on the public health. All
persons who perform these functions
meet the definition of manufacturer, and
therefore should be inspected to ensure
that they are complying with the
applicable provisions. For example, a
specification developer initiates the
design requirements for a device that is
manufactured by a second party for
subsequent commercial distribution.
Such a developer is subject to design
controls. Further, those that perform the
functions of contract sterilization,
installation, relabeling,
remanufacturing, and repacking have
routinely been considered to be
manufacturers under the original CGMP
definition, and the agency has treated
them as such by inspecting them to
ensure that they comply with the
appropriate portions of the original
CGMP. By explicitly including them in
the definition of ‘‘manufacturer’’ the
agency has simply codified its
longstanding policy and interpretation
of the original regulation.
The phrase ‘‘processes a finished
device’’ applies to a finished device
after distribution. Again, this phrase has
been part of the CGMP regulation
definition of ‘‘manufacturer’’ for 18
years.
29. A number of comments on the
definition of ‘‘manufacturing material,’’
and on other parts of the proposal
containing requirements for
‘‘manufacturing material,’’ stated that
while the control of manufacturing
material is important, it need not be as
extensive as required throughout the
regulation. Other comments stated that
the meaning of the phrase ‘‘or other
byproducts of the manufacturing
process’’ is unclear, and should be
deleted. One comment suggested that
the definition be modified to separate
the definition from the examples.
FDA agrees that, depending on the
manufacturing material and the device,
the degree of control that is needed will
vary. FDA believes that manufacturing
materials must be assessed, found
acceptable for use, and controlled.
Therefore, the regulation requires
manufacturers to assess, assure
acceptability of, and control
manufacturing materials to the degree
necessary to meet the specified
requirements. The agency notes that
international standards such as ISO
8402:1994 include manufacturing
material in their definition of
‘‘product,’’ to which all requirements
apply, and notes that FDA has added
the same definition in § 820.3(r) in its
effort toward harmonization.
FDA amended the definition of
manufacturing material to read ‘‘a
concomitant constituent, or a byproduct
constituent produced during the
manufacturing process’’ to help clarify
this definition. These terms refer to
those materials or substances that
naturally occur as a part of the material
or during the manufacturing process
which are intended to be removed or
reduced in the finished device. For
example, some components, such as
natural rubber latex, contain allergenic
proteins that must be reduced or
removed from the finished devices. The
definition has been modified to include
‘‘concomitant constituents’’ to clarify
the meaning.
In addition to clarifying the
definition, FDA has deleted the specific
examples. Therefore, FDA notes that
cleaning agents, mold release agents,
lubricating oils, latex proteins, and
sterilant residues are just some
examples of manufacturing materials.
30. The comments received on the
definition for ‘‘nonconforming’’
conveyed a general sense that the
definition was confusing, with various
comments suggesting that different parts
of the definition should be deleted and
one suggesting that the definition be
deleted altogether.
In response to these comments, the
definition of ‘‘nonconforming’’ has been
deleted. However, the definition from
ISO 8402:1994 for ‘‘nonconformity’’ was
added to ensure that the requirements in
the regulation, especially those in
§§ 820.90 Nonconforming product and
820.100 Corrective and preventive
action are understood. FDA emphasizes
that a ‘‘nonconformity’’ may not always
rise to the level of a product defect or
failure, but a product defect or failure
will typically constitute a
nonconformity.
31. Several comments requested
various revisions to the definition of
‘‘production’’ to make it more clear, and
one thought that it was a common term
and should be deleted.
In response, FDA has deleted the
definition for ‘‘production’’ because it
should be commonly understood.
As noted in response to comments on
the definition of manufacturing
material, FDA has added a definition of
‘‘product’’ to conform to the definition
in ISO 8402:1994 and to avoid the
necessity of repeating the individual
terms throughout the regulation.
Whenever a requirement is not
applicable to all types of product, the
regulation specifically states the
product(s) to which the requirement is
applicable.
It should be noted that the regulation
has acceptance requirements for
incoming ‘‘product’’ and other
requirements for ‘‘product,’’ which by
definition includes manufacturing
materials. Manufacturing materials
should be controlled in a manner that is
commensurate with their risk as
discussed above. However, for
manufacturing materials that are
‘‘concomitant constituents,’’ FDA
realizes that incoming acceptance,
identification, etc., may not be feasible.
The important control measure for
‘‘concomitant constituents’’ is the
52611Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
reduction or removal requirement found
in § 820.70(h).
32. A few comments stated that the
definition of ‘‘quality’’ should be
changed to be identical to ISO 8402.
Others stated that the terminology
adopted from ISO 8402, ‘‘that bear on,’’
is too broad and could cover every
potential and imaginable factor. Still
others wanted to add the phrase, ‘‘as
defined by the manufacturer’’ to the end
of the sentence.
FDA disagrees with the comments
and believes that the definition is
closely harmonized to that in ISO
8402:1994. FDA believes that the
definition appropriately defines quality
in the context of a medical device and
believes that the phrase from ISO
8402:1994, ‘‘stated and implied needs,’’
has the same meaning as the phrase
‘‘fitness-for-use, including safety and
performance’’ in the context of the
Quality System regulation. Further,
‘‘quality’’ is not just ‘‘defined by the
manufacturer’’ but is also defined by
customer need and expectation.
33. Many comments received on the
‘‘quality audit’’ definition suggested that
the definition should not state that it is
an examination of the ‘‘entire’’ quality
system because that would require that
every audit include the ‘‘entire’’ quality
system. Other comments on ‘‘quality
audit’’ stated that it is unclear what is
meant by the last sentence of the
proposed definition, namely, that
‘‘ ‘[q]uality audit’ is different from * * *
other quality system activities required
by or under this part.’’
FDA agrees that while the quality
audit is an audit of the ‘‘entire’’ quality
system, audits may be conducted in
phases, with some areas requiring more
frequent audits than other areas, and
that each audit need not review the
whole system. The frequency of internal
quality audits should be commensurate
with, among other things, the
importance of the activity, the difficulty
of the activity to perform, and the
problems found. To avoid any
misunderstanding, the word ‘‘entire’’
before quality system has been deleted.
FDA emphasizes that if conducted
properly, internal quality audits can
prevent major problems from
developing and provide a foundation for
the management review required by
§ 820.20(c), ‘‘Management review.’’
In response to the confusion about the
last sentence of the proposed definition,
FDA has deleted the last sentence. The
purpose of the sentence was to clarify
that the internal audit requirement is
different from, and in addition to, the
requirements for establishing quality
assurance procedures and recording
results. On occasion, manufacturers
have attempted to prevent FDA
investigators from reviewing such
quality assurance procedures and
results (for example, trend analysis
results) by stating that they are part of
the internal quality audit report and not
subject to review during a CGMP
inspection. FDA disagrees with this
position. To clarify which records are
exempt from routine FDA inspection,
FDA has added § 820.180(c).
34. One comment said that the word
‘‘executive’’ should be deleted from the
definition of ‘‘quality policy’’ because
quality policy should be supported by
all personnel, not just those in executive
management. A few comments stated
that ‘‘formally expressed’’ should be
deleted because it is incompatible with
the requirements in § 820.20(a) and (c)
which require that the quality policy be
‘‘established.’’ Other comments stated
that the ‘‘quality’’ before ‘‘intentions’’
was tautological.
FDA agrees that all company
personnel must follow the quality
policy. However, the definition is
intended to make clear that the quality
policy must be established by top
management. Therefore it has been
retained. The term ‘‘executive
management’’ has been modified to
‘‘management with executive
responsibility’’ to be consistent with the
revised ISO 9001:1994. FDA agrees with
the remaining comments and has
changed ‘‘formally expressed’’ to
‘‘established’’ for consistency and has
deleted the ‘‘quality’’ before
‘‘intentions.’’
35. A few comments suggested using
the definition of ‘‘quality systems’’ from
ISO 8402 and 9001. Other comments on
the definition of ‘‘quality system’’ said
that the term ‘‘quality management’’
should be defined.
FDA agrees in part with the
comments. The term ‘‘specifications’’
has been deleted to harmonize the
definition with ISO 8402:1994. FDA
does not agree that the term ‘‘quality
management’’ must be defined. A
definition can be found in ISO
8402:1994 that is consistent with FDA’s
use of the term.
36. Many comments on the definition
of ‘‘record’’ were received. Some
thought the term was too broad, giving
FDA access to all documents and
exceeding FDA’s inspection authority.
Others thought that the definition of
‘‘record’’ would tremendously increase
the recordkeeping burden. Several
comments recommended that FDA
adopt the ISO definition.
The definition of ‘‘record’’ was
deleted because it seemed to add more
confusion than clarity. The definition
was intended to clarify that ‘‘records’’
may include more than the traditional
hardcopy procedures and SOP’s, for
example, plans, notes, forms, data, etc.
FDA was trying to clarify that ‘‘records’’
could be written, electronic, optical,
etc., as long as they could be stored and
controlled. FDA could not adopt the ISO
8402:1994 definition because of how the
term ‘‘record’’ is used in the act, which
is broader than the ISO definition.
Therefore, FDA will allow the act and
case law to continue to define the term.
37. The definition in the Working
Draft of ‘‘refurbisher’’ was deleted and
will be addressed in the separate
rulemaking described above.
38. FDA added the definition of
‘‘remanufacturer’’ to codify FDA’s
longstanding policy and interpretation
of the original CGMP. The language is
consistent with the 510(k) provisions
and the premarket approval
amendment/supplement requirements,
because FDA has always considered
remanufacturers in fact to be
manufacturers of a new device.
39. Several comments on the
definition of ‘‘reprocessing’’ requested
clarification of the difference between
that term and ‘‘refurbishing.’’ Several
other comments on the definition of
‘‘reprocessing’’ stated that FDA should
clarify that ‘‘reprocessing’’ is an activity
performed before a device is distributed.
Others commented that the term
‘‘rework’’ should be used instead of the
term ‘‘reprocessing,’’ to be consistent
with ISO terminology.
FDA agrees with the comments and
has changed the term to ‘‘rework,’’
adopted the ISO 8402:1994 definition,
and added that ‘‘rework’’ is performed
according to specified DMR
requirements before the device is
released for distribution.
40. A few comments stated that
including the term ‘‘maintenance’’ in
the proposed definition of ‘‘servicing’’
implies that preventative maintenance
would be subject to the regulation.
Other comments said that it may not be
desirable to return old devices or
devices that have received field
modifications to the original
specifications. Therefore, the comments
suggested deleting the last part of the
definition that states that ‘‘servicing’’ is
returning a device to its specifications.
FDA has deleted the definition of
‘‘servicing’’ and has not added a
definition of ‘‘servicer’’ because this
will be covered in the separate
rulemaking discussed above. FDA notes,
however, that servicing performed by
manufacturers and remanufacturers is
subject to the requirements in § 820.200
Servicing. These requirements are a
codification of longstanding
interpretations of the original CGMP,
52612 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
§ 820.20(a)(3), and current agency
policy.
41. Several comments were received
on the proposed definition of ‘‘special
process.’’ Many asked for clarification or
adoption of the ISO definition. Some
stated that it is impossible to completely
verify processes in every instance.
FDA has deleted the definition
because the term ‘‘special process’’ is no
longer used in ISO 9001:1994, except in
a note. FDA has, however, modified the
requirements of the regulation to reflect
that, in many cases, testing and
inspecting alone may be insufficient to
prove the adequacy of a process. One of
the principles on which the quality
systems regulation is based is that all
processes require some degree of
qualification, verification, or validation,
and manufacturers should not rely
solely on inspection and testing to
ensure processes are adequate for their
intended uses.
42. Several comments on the
definition of ‘‘specification’’ suggested
that the term should not apply to quality
system requirements. One comment
suggested that the phrase ‘‘other
activity’’ be deleted because it is too
broad. Another comment noted that the
definition in ISO 9001 pertains to
requirements, not only documents.
In response, FDA has amended the
definition to make clear that it applies
to the requirements for a product,
process, service, or other activity. The
reference to the quality system has been
deleted. FDA disagrees that the
definition is too broad and has not
deleted the term ‘‘other activity’’
because a specification can be
developed for anything the
manufacturer chooses. FDA notes,
however, that ISO 9001:1994 does not
contain a definition for ‘‘specification’’
but uses the definition found in ISO
8402:1994.
43. Numerous comments were
received on the definitions of
‘‘validation’’ and ‘‘verification.’’ Almost
all stated that the two definitions
overlapped and that there was a need to
rewrite the definitions to prevent
confusion. Many suggested that the ISO
definitions be adopted. Others stated
that there was a need to distinguish
between design validation and process
validation.
FDA agrees with the comments and
has rewritten the two definitions to
better reflect the agency’s intent. FDA
has adopted the ISO 8402:1994
definition of validation. ‘‘Validation’’ is
a step beyond verification to ensure the
user needs and intended uses can be
fulfilled on a consistent basis. FDA has
further distinguished ‘‘process
validation’’ from ‘‘design validation’’ to
help clarify these two types of
‘‘validation.’’ The ‘‘process validation’’
definition follows from FDA’s
‘‘Guidelines on General Principles of
Process Validation’’ (Ref. 10). The
definition for ‘‘design validation’’ is
consistent with the requirements
contained in § 820.30 Design controls.
The ISO 8402:1994 definition of
‘‘verification’’ has been adopted.
‘‘Verification’’ is confirmation by
examination and provision of objective
evidence that specified requirements for
a particular device or activity at hand
have been met.
iii. Quality System (§ 820.5)
44. Several comments suggested that
the requirement should be more general,
in that the requirement that devices be
safe and effective is covered elsewhere
in the regulation. The comments
recommended that the quality system
requirements be harmonized with
international standards and focus on
requiring that a system be established
that is appropriate to the specific device
and that meets the requirements of the
regulation.
FDA agrees in part with the comments
and has modified the language as
generally suggested by several
comments to require that the quality
system be ‘‘appropriate for the specific
medical device(s) designed or
manufactured, and [] meet[] the
requirements of this part.’’ This is
essentially the requirement of the
original CGMP regulation with the
added reference to design control.
The requirements that effective
quality system instructions and
procedures be established and
effectively maintained are retained;
however, they were moved to
§ 820.20(b)(3)(i). As previously noted,
the quality system regulation is
premised on the theory that the
development, implementation, and
maintenance of procedures designed to
carry out the requirements will assure
the safety and effectiveness of devices.
Thus, the broad requirements in § 820.5
are in a sense the foundation on which
the remaining quality system
requirements are built.
B. Quality System Requirements
(Subpart B)
i. Management Responsibility (§ 820.20)
45. Several comments on § 820.20(a),
‘‘Quality policy,’’ related to the use of
the term ‘‘executive management.’’ A
few comments stated that quality system
development and implementation are
the responsibility of the chief executive
officer, but how he or she chooses to
discharge the responsibility should be
left to the discretion of the
manufacturer. Other comments stated
that the requirement that executive
management ensure that the quality
policy is understood is impossible and
should be deleted or rewritten.
FDA agrees in part with the
comments. In response to the
comments, FDA has deleted the term
‘‘executive management’’ and replaced
it with ‘‘management with executive
responsibility,’’ which is consistent
with ISO 9001:1994. Management with
executive responsibility is that level of
management that has the authority to
establish and make changes to the
company quality policy. The
establishment of quality objectives, the
translation of such objectives into actual
methods and procedures, and the
implementation of the quality system
may be delegated. The regulation does
not prohibit the delegation. However, it
is the responsibility of the highest level
of management to establish the quality
policy and to ensure that it is followed.
(See United States v. Dotterweich, 320
U.S. 277 (1943), and United States v.
Park, 421 U.S. 658 (1975).)
For this reason, FDA disagrees that
the requirement that management
ensure that the quality policy is
understood should be deleted. It is
without question management’s
responsibility to undertake appropriate
actions to ensure that employees
understand management’s policies and
objectives. Understanding is a learning
process achieved through training and
reinforcement. Management reinforces
understanding of policies and objectives
by demonstrating a commitment to the
quality system visibly and actively on a
continuous basis. Such commitment can
be demonstrated by providing adequate
resources and training to support
quality system development and
implementation. In the interest of
harmonization, the regulation has been
amended to be very similar to ISO
9001:1994.
46. A few comments stated that the
words ‘‘adequate’’ and ‘‘sufficient’’
should be deleted from § 820.20(b)
‘‘Organization,’’ as they are subjective
and too difficult to define. One
comment thought that the general
requirements in the paragraphs are
addressed by § 820.25 Personnel.
Another comment stated that
‘‘designed’’ should be added prior to
‘‘produced’’ for consistency with the
scope.
FDA agrees that the requirement for
‘‘sufficient personnel’’ is covered in
§§ 820.20(b)(2), ‘‘Resources,’’ and 820.25
Personnel, both of which require
manufacturers to employ sufficient
personnel with the training and
52613Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
experience necessary to carry out their
assigned activities properly. The phrase
is, therefore, deleted. However, FDA has
retained the requirement for
establishing an ‘‘adequate organizational
structure’’ to ensure compliance with
the regulation, because such an
organizational structure is fundamental
to a manufacturer’s ability to produce
safe and effective devices. The
organizational structure should ensure
that the technical, administrative, and
human factors functions affecting the
quality of the device will be controlled,
whether these functions involve
hardware, software, processed materials,
or services. All such control should be
oriented towards the reduction,
elimination, or ideally, prevention of
quality nonconformities. Further, the
agency does not believe that the term is
ambiguous. The organizational structure
established will be determined in part
by the type of device produced, the
manufacturer’s organizational goals, and
the expectations and needs of
customers. What may be an ‘‘adequate’’
organizational structure for
manufacturing a relatively simple
device may not be ‘‘adequate’’ for the
production of a more complex device,
such as a defibrillator. FDA has also
added ‘‘designed’’ prior to ‘‘produced’’
to be consistent with the scope of the
regulation.
47. A number of comments on
proposed § 820.20 (b)(1)(i) through
(b)(1)(v), ‘‘Responsibility and
authority,’’ objected to the section,
stating that it was too detailed and
confusing and that the wording was
redundant with other sections of the
proposal.
FDA agrees generally with the
comments in that the proposed
paragraphs set forth examples of
situations in which independence and
authority are important. Therefore, the
examples provided in § 820.20 (b)(1)(i)
through (b)(1)(v) are deleted. However,
FDA has retained the broad requirement
that the necessary independence and
authority be provided as appropriate to
every function affecting quality. FDA
emphasizes that it is crucial to the
success of the quality system for the
manufacturer to ensure that
responsibility, authority, and
organizational freedom (or
independence) is provided to those who
initiate action to prevent
nonconformities, identify and document
quality problems, initiate, recommend,
provide, and verify solutions to quality
problems, and direct or control further
processing, delivery, or installation of
nonconforming product. Organizational
freedom or independence does not
necessarily require a stand-alone group,
but responsibility, authority, and
independence should be sufficient to
attain the assigned quality objectives
with the desired efficiency.
48. Several comments on proposed
§ 820.20(b)(2), ‘‘Verification resources
and personnel,’’ stated that requiring
‘‘adequately’’ trained personnel was
subjective and that the section was not
consistent with ISO 9001.
FDA agrees that the section is not
consistent with ISO 9001, and has
adopted the language used in ISO
9001:1994, section 4.1.2.2, ‘‘Resources,’’
and has renamed the section
‘‘Resources.’’ The provision is now a
broad requirement that the
manufacturer provide adequate
resources for the quality system and is
not restricted to the verification
function. FDA acknowledges that
§ 820.25(a), ‘‘General,’’ requires that
sufficiently trained personnel be
employed. However, § 820.20(b)(2),
‘‘Resources,’’ emphasizes that all
resource needs must be provided for,
including monetary, supplies, etc., as
well as personnel resources. In contrast,
§ 820.25(a) specifically addresses
education, background, training, and
experience requirements for personnel.
49. Comments on § 820.20(b)(3),
‘‘Management representative,’’ stated
that the management representative
should not be limited to ‘‘executive’’
management. A few comments stated
that the appointment should be
documented. In addition, a few
comments from proposed § 820.5 stated
that the terms ‘‘effective’’ and
‘‘effectively’’ should be defined.
The agency agrees that the
responsibility need not be assigned to
‘‘executive’’ management and has
modified the requirement to allow
management with executive
responsibility to appoint a member of
management. When a member of
management is appointed to this
function, potential conflicts of interest
should be examined to ensure that the
effectiveness of the quality system is not
compromised. In addition, in response
to many comments, the requirement was
amended to make clear that the
appointment of this person must be
documented, moving the requirement
up from § 820.20(b)(3)(ii). The amended
language is consistent with ISO
9001:1994. Further, FDA has amended
this section to change ‘‘executive
management’’ to ‘‘management with
executive responsibility’’ for
consistency with the definition.
The terms ‘‘effective’’ and
‘‘effectively’’ are no longer used in
§ 820.5 but ‘‘effectively’’ is found in
§ 820.20(b)(3)(i). FDA does not believe
that these terms require a definition.
Instructions and procedures must be
defined, documented, implemented,
and maintained in such a way that the
requirements of this part are met. If they
are, they will be ‘‘effective.’’
50. A few comments stated that the
improvement of the quality system is
not a requirement under the act and the
reference to such improvement in
§ 820.20(b)(3)(ii) should, therefore, be
deleted.
FDA agrees in part with the comments
and has deleted the requirement that the
person appointed under this section
provide information for improving the
quality system. The provision implied
that the manufacturer must go beyond
the requirements of the regulation. FDA
notes, however, that information
collected in complying with
§§ 820.20(b)(3)(ii) and 820.100
Corrective and preventive action, should
be used not only for detecting
deficiencies and for subsequent
correction of the deficiencies but also to
improve the device and quality system.
51. Many comments stated that the
report required by § 820.20(c),
‘‘Management review,’’ should not be
subject to FDA review, due to the same
liability and self-incrimination concerns
related to the internal audit.
FDA agrees in part with the
comments. The proposed regulation did
not state FDA’s intentions with respect
to inspectional review of the results of
the required management review. After
careful consideration of the comments,
FDA agrees that it will not request to
inspect and copy the reports of reviews
required by § 820.20(c) when
conducting routine inspections to
determine compliance with this part.
FDA believes that refraining from
routinely reviewing these reports may
help ensure that the audits are complete
and candid and of maximum use to the
manufacturer. However, FDA believes
that it is important that the dates and
results of quality system reviews be
documented, and FDA may require that
management with executive
responsibility certify in writing that the
manufacturer has complied with the
requirements of § 820.20(c). FDA will
also review the written procedures
required by § 820.20(c), as well as all
other records required under § 820.20.
52. A few comments stated that the
management review should not be
dictated by established review
procedures because management level
employees should be fully capable of
reviewing documents without a written
procedure.
As noted above, FDA has retained the
requirement for establishing procedures
to conduct the required management
review in § 820.20(c). FDA believes that
52614 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
a manufacturer can establish procedures
flexible enough for management to vary
the way in which a review is conducted,
as appropriate. Procedures should
require that the review be conducted at
appropriate intervals and should be
designed to ensure that all parts of the
quality system are adequately reviewed.
A manufacturer may, of course, develop
procedures that permit review of
different areas at different times, so long
as such reviews are sufficient to carry
out the objectives of this section. If there
are known problems, for example, a
‘‘sufficient frequency’’ may be fairly
frequent. Further, because FDA will not
be reviewing the results of such reviews,
FDA must be assured that this function
will occur in a consistent manner.
53. A few comments stated that
§ 820.20(c) should be deleted because it
duplicates the quality audit required by
§ 820.22.
FDA disagrees that § 820.20(c)
duplicates the requirements in § 820.22.
The purpose of the management reviews
required by § 820.20(c) is to determine
if the manufacturer’s quality policy and
quality objectives are being met, and to
ensure the continued suitability and
effectiveness of the quality system. An
evaluation of the findings of internal
and supplier audits should be included
in the § 820.20(c) evaluation. The
management review may include a
review of the following: (1) The
organizational structure, including the
adequacy of staffing and resources; (2)
the quality of the finished device in
relation to the quality objectives; (3)
combined information based on
purchaser feedback, internal feedback
(such as results of internal audits),
process performance, product
(including servicing) performance,
among other things; and (4) internal
audit results and corrective and
preventive actions taken. Management
reviews should include considerations
for updating the quality system in
relation to changes brought about by
new technologies, quality concepts,
market strategies, and other social or
environmental conditions. Management
should also review periodically the
appropriateness of the review
frequency, based on the findings of
previous reviews. The quality system
review process in § 820.20(c), and the
reasons for the review, should be
understood by the organization.
The requirements under § 820.22
Quality audit are for an internal audit
and review of the quality system to
verify compliance with the quality
system regulation. The review and
evaluations under § 820.22 are very
focused. During the internal quality
audit, the manufacturer should review
all procedures to ensure adequacy and
compliance with the regulation, and
determine whether the procedures are
being effectively implemented at all
times. In contrast, as noted above, the
management review under § 820.20(c) is
a broader review of the organization as
a whole to ensure that the quality policy
is implemented and the quality
objectives are met. The reviews of the
quality policy and objectives
(§ 820.20(c)) should be carried out by
top management, and the review of
supporting activities (§ 820.22) should
be carried out by management with
executive responsibility for quality and
other appropriate members of
management, utilizing competent
personnel as decided on by the
management.
54. Some comments suggested that
the requirements in § 820.186(a) and (d)
be moved to § 820.20 for clarity and to
better align with the structure of ISO
9001:1994 and ISO/CD 13485.
FDA agrees and has moved the
specific requirements from § 820.186
and rewritten them into new § 820.20
(d) and (e) for clarity, better
organization, and closer harmonization.
Therefore, § 820.20(d) is consistent with
ISO 9001:1994, section 4.2.3, ‘‘Quality
planning,’’ and § 820.20(e) is consistent
with ISO 9001:1994, sections 4.2.1,
‘‘General,’’ and 4.2.2, ‘‘Quality-system
procedures.’’ Section 820.20(e)
discusses ‘‘[a]n outline of the structure
of the documentation used in the
quality system.’’ FDA believes that
outlining the structure of the
documentation is beneficial and, at
times, may be critical to the effective
operation of the quality system. FDA
recognizes, however, that it may not be
necessary to create an outline in all
cases. For example, it may not be
necessary for smaller manufacturers and
manufacturers of less complicated
devices. Thus, the outline is only
required where appropriate.
ii. Quality Audit (§ 820.22)
55. A few comments suggested that
FDA delete the requirement that persons
conducting the audit be ‘‘appropriately
trained’’ from the second sentence of
proposed § 820.22(a), because it is
subjective and not consistent with ISO
9001.
FDA has deleted the requirement from
§ 820.22(a) because § 820.25 Personnel
requires that such individuals be
appropriately trained. Further, FDA has
attempted to better harmonize with ISO
9001:1994, which does not explicitly
state personnel qualifications in each
provision. Similarly, in response to
general comments suggesting better
harmonization, FDA has added the
requirement that the audit ‘‘determine
the effectiveness of the quality system’’
as required by ISO 9001:1994. This
requirement underscores that the
quality audit must not only determine
whether the manufacturer’s
requirements are being carried out, but
whether the requirements themselves
are adequate.
56. Some comments stated that
requiring ‘‘individuals who do not have
direct responsibility for the matters
being audited’’ to conduct the audits is
impractical and burdensome,
particularly for small manufacturers.
FDA disagrees with the comments.
Both small and large manufacturers
have been subject to the identical
requirement since 1978 and FDA knows
of no hardship, on small or large
manufacturers, as a result. Small
manufacturers must generally establish
independence, even if it means hiring
outside auditors, because the failure to
have an independent auditor could
result in an ineffective audit.
Manufacturers must realize that
conducting effective quality audits is
crucial. Without the feedback provided
by the quality audit and other
information sources, such as complaints
and service records, manufacturers
operate in an open loop system with no
assurance that the process used to
design and produce devices is operating
in a state of control. ISO 9001:1994 has
the same requirement for independence
from the activity being audited.
57. Several comments claimed that
the last sentence in proposed
§ 820.22(a), which required that
followup corrective action be
documented in the audit report, made
no sense. The comments said that
corrective action would be the subject of
a followup report.
It was the agency’s intent that the
provision require that where corrective
action was necessary, it would be taken
and documented in a reaudit report. The
provision has been rewritten to make
that clear. New § 824.22 also clarifies
that a reaudit is not always required, but
where it is indicated, it must be
conducted. The report should verify that
corrective action was implemented and
effective. Because FDA does not review
these reports, the date on which the
audit and reaudit were performed must
be documented and will be subject to
FDA review. The revised reaudit
provision is consistent with ISO
9001:1994.
58. Many comments were received on
proposed § 820.22(b) regarding the
reports exempt from FDA review. Most
of the comments objected to FDA
reviewing evaluations of suppliers. FDA
has decided not to review such
52615Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
evaluations at this time and will revisit
this decision after the agency gains
sufficient experience with the new
requirement to determine its
effectiveness. A thorough response to
the comments is found with the
agency’s response to other comments
received on § 820.50 Purchasing
controls. FDA has moved the section
regarding which reports the agency will
refrain from reviewing from § 820.22(b)
to new § 820.180(c), ‘‘Exemptions,’’
under the related records requirements.
FDA believes this organization is easier
to follow.
iii. Personnel (§ 820.25)
59. A few comments stated that the
requirement in § 820.25 Personnel for
the manufacturer to employ ‘‘sufficient’’
personnel should be deleted, because
whether there are ‘‘sufficient’’ personnel
is a subjective determination, and it is
unnecessary to require it since the
manufacturer will know how best to
staff the organization. A few other
comments stated that the provision
should not base the personnel
requirements on ensuring that the
requirements of the regulation are
‘‘correctly’’ performed, because no
manufacturer can ensure that all
activities are performed correctly.
Another comment stated that the term
‘‘employ’’ should be changed because
personnel may include qualified
temporaries, contractors, and others
who may not typically be considered
‘‘employees.’’
FDA disagrees with the suggestions
that the terms ‘‘sufficient’’ and
‘‘correctly’’ be deleted. Whether
‘‘sufficient’’ personnel are employed
will be determined by the requirements
of the quality system, which must be
designed to ensure that the
requirements of the regulation are
properly implemented. In making
staffing decisions, a manufacturer must
ensure that persons assigned to
particular functions are properly
equipped and possess the necessary
education, background, training, and
experience to perform their functions
correctly. However, FDA changed
‘‘ensure’’ to ‘‘assure’’ to address the
concerns that people do make mistakes
and management cannot guarantee that
work is correctly performed all of the
time. Further, FDA agrees that the
manufacturer must determine for itself
what constitutes ‘‘sufficient’’ personnel
with proper qualification in the first
instance. However, if the manufacturer
does not employ sufficient personnel, or
personnel with the necessary
qualifications to carry out their
functions, the manufacturer will be in
violation of the regulation. FDA has
often found that the failure to comply
with this requirement leads to other
significant regulatory violations. FDA
agrees with the comment that the term
‘‘employ’’ should be deleted so that the
requirement covers all personnel who
work at a firm.
60. In § 820.25(b), ‘‘Training,’’ FDA
deleted the requirement that employees
be trained ‘‘by qualified individuals,’’
because § 820.25(a) requires this.
Several comments stated that FDA
should add the requirement that the
training procedure include the
identification of training needs, to be
consistent with the requirements in ISO
9001:1994 and ISO/CD 13485. Other
comments stated that personnel need
not be trained to the extent that they can
quote chapter and verse of the
regulation as long as they can
adequately perform their assigned
responsibilities. Several comments
suggested deleting the requirements in
the last two sentences in favor of a
broad, general requirement that
personnel be trained. A few comments
stated that the last two sentences should
be retained because they are crucial and
sound requirements but that validation
activities should be included with
verification activities.
FDA amended the requirement so that
the training procedure includes the
identification of training needs. FDA
deleted the requirement on
understanding the CGMP requirements
applicable to job functions to avoid the
perception that personnel would need
to know ‘‘chapter and verse of the
regulation.’’ FDA notes, however, that a
training program to ensure personnel
adequately perform their assigned
responsibilities should include
information about the CGMP
requirements and how particular job
functions relate to the overall quality
system. FDA further believes that it is
imperative that training cover the
consequences of improper performance
so that personnel will be apprised of
defects that they should look for, as well
as be aware of the effect their actions
can have on the safety and effectiveness
of the device. In addition, FDA
disagrees with comments that suggested
that only ‘‘personnel affecting quality’’
should be required to be adequately
trained. In order for the full quality
system to function as intended, all
personnel should be properly trained.
Each function in the manufacture of a
medical device must be viewed as
integral to all other functions. FDA has
reorganized the last two sentences,
however, to place the requirements
under § 820.25(b), ‘‘Training,’’ and has
added validation activities as suggested
by the comments.
61. Many comments objected to the
proposed requirements of § 820.25(c),
‘‘Consultants,’’ stating that requiring a
manufacturer to chose consultants that
have sufficient qualifications and to
keep records subject to FDA review of
all consultants used, along with copies
of their resumes and lists of previous
jobs, would unreasonably interfere with
the manufacturer’s business activities
and restrict the right of a manufacturer
to hire consultants on any basis it
chooses. Other comments said that a
manufacturer’s employment of a
consultant has the same potential
impact on the safety and effectiveness of
medical devices as employment of any
other contractor for services, and that
consultants should, therefore, be
covered by § 820.50 Purchasing
controls.
FDA agrees in part with these
comments. Although employing a
consultant is a business decision, when
a manufacturer hires consultants who
do not have appropriate credentials, and
manufacturing decisions are made based
on erroneous or ill-conceived advice,
the public suffers. Of course, the
manufacturer is still ultimately
responsible for following the CGMP
requirements and will bear the
consequences of a failure to comply.
FDA notes that the use of unqualified
consultants has led to regulatory action
for the failure to comply with the CGMP
regulation in the past. Thus, because of
the significant impact a consultant can
have on the safety and effectiveness of
a device, FDA believes that some degree
of control is required in the regulation.
The requirements are revised
somewhat in response to comments,
however, to reflect that it is not FDA’s
goal to dictate whom a manufacturer
may use as a consultant, but instead to
require that a manufacturer determine
what it needs to adequately carry out
the requirements of the regulation and
to assess whether the consultant can
adequately meet those needs. The
requirements related to consultants have
been added in § 820.50 Purchasing
controls because a consultant is a
supplier of a service.
C. Design Controls (Subpart C)
Since early 1984, FDA has identified
lack of design controls as one of the
major causes of device recalls. The
intrinsic quality of devices, including
their safety and effectiveness, is
established during the design phase.
Thus, FDA believes that unless
appropriate design controls are observed
during preproduction stages of
development, a finished device may be
neither safe nor effective for its intended
use. The SMDA provided FDA with the
52616 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
authority to add preproduction design
controls to the device CGMP regulation.
Based on its experience with
administering the original CGMP
regulation, which did not include
preproduction design controls, the
agency was concerned that the original
regulation provided less than an
adequate level of assurance that devices
would be safe and effective. Therefore,
FDA has added general requirements for
design controls to the device CGMP
regulation for all class III and II devices
and certain class I devices. FDA is not
subjecting the majority of class I devices
to design controls because FDA does not
believe that such controls are necessary
to ensure that such devices are safe and
effective and otherwise in compliance
with the act. However, all devices,
including class I devices exempt from
design controls, must be properly
transferred to production in order to
comply with § 820.181, as well as other
applicable requirements. For most class
I devices, FDA believes that the
production and other controls in the
new quality system regulation and other
general controls of the act will be
sufficient, as they have been in the past,
to ensure safety and effectiveness.
62. Many comments were submitted
in response to the addition of design
control requirements in general, many
questioning how these new
requirements would be implemented
and enforced. For instance, several
comments stated that the design control
requirements do not reflect how medical
devices are actually developed, because
the concept of a design rarely originates
with the manufacturer, who may not
become involved until relatively late in
the design evolution. Others expressed
concern that FDA investigators will
second-guess design issues in which
they are not educated or trained, and
stated that investigators should not
debate whether medical device designs
are ‘‘safe and effective.’’
FDA agrees in part with the
comments. The design control
requirements are not intended to apply
to the development of concepts and
feasibility studies. However, once it is
decided that a design will be developed,
a plan must be established to determine
the adequacy of the design requirements
and to ensure that the design that will
eventually be released to production
meets the approved requirements.
Those who design medical devices
must be aware of the design control
requirements in the regulation and
comply with them. Unsafe and
ineffective devices are often the result of
informal development that does not
ensure the proper establishment and
assessment of design requirements
which are necessary to develop a
medical device that is safe and effective
for the intended use of the device and
that meets the needs of the user.
However, FDA investigators will not
inspect a device under the design
control requirements to determine
whether the design is appropriate or
‘‘safe and effective.’’ Section 520(f)(1)(a)
of the act precludes FDA from
evaluating the ‘‘safety or effectiveness of
a device’’ through preproduction design
control procedures. FDA investigators
will evaluate the process, the methods,
and the procedures that a manufacturer
has established to implement the
requirements for design controls. If,
based on any information gained during
an inspection, an investigator believes
that distributed devices are unsafe or
ineffective, the investigator has an
obligation to report the observations to
the Center for Devices and Radiological
Health (CDRH).
63. Several comments expressed
concern that the application of design
controls would severely restrict the
creativity and innovation of the design
process and suggested that design
controls should not apply too early in
the design development process.
FDA disagrees with the comments. It
is not the intent of FDA to interfere with
creativity and innovation, and it is not
the intent of FDA to apply the design
control requirements to the research
phase. Instead, the regulation requires
the establishment of procedures to
ensure that whatever design is
ultimately transferred to production is,
in fact, a design that will translate into
a device that properly performs
according to its intended use and user
needs.
To assist FDA in applying the
regulation, manufacturers should
document the flow of the design process
so that it is clear to the FDA investigator
where research is ending and
development of the design is beginning.
64. A few comments stated that
design controls should not be
retroactive and that ongoing design
development should be exempted.
FDA agrees in part with the
comments. FDA did not intend the
design requirements to be retroactive,
and § 820.30 Design controls will not
require the manufacturer to apply such
requirements to already distributed
devices. When the regulation becomes
effective on June 1, 1997, it will apply
to designs that are in the design and
development phase, and manufacturers
will be expected to have the design and
development plan established. The
manufacturer should identify what stage
a design is in for each device and will
be expected to comply with the
established design and development
plan and the applicable paragraphs of
§ 820.30 from that point forward to
completion. If a manufacturer had a
design in the development stage before
June 1, 1997, and cannot comply with
any particular paragraph of § 820.30, the
manufacturer must provide a detailed
justification as to why such compliance
is not possible. However, designs will
not have to be recycled through
previous phases that have been
completed. Manufacturers will be
expected to comply in full by June 1,
1998. As stated earlier, FDA wants to
emphasize that it expects manufacturers
to be in a reasonable state of
compliance with the design control
requirements from June 1, 1997, to June
1, 1998, because extra time was given to
the industry for implementing design
controls before the final regulation
became effective.
When changes are made to new or
existing designs, the design controls of
§ 820.30 must be followed to ensure that
the changes are appropriate and that the
device will continue to perform as
intended. FDA notes that the original
CGMP regulation contained
requirements for specification controls
and controls for specification or design
changes under § 820.100(a).
65. One comment asked how the
proposed design controls would apply
to investigational device exemption
(IDE) devices, since devices under
approved IDE’s have been exempt from
the CGMP regulation. Some comments
suggested that any changes to the IDE
regulation should be done in a separate
rulemaking. Other comments stated that
any change to the IDE regulation should
be worded so that all of § 820.30 applies
since the IDE process is supplying
information in support of the design
validation requirements but that all
design requirements need not be
completed prior to the start of the IDE
because the clinical evaluation process
often brings valuable information to the
design project which may need to be
incorporated into the design before
design transfer.
The IDE regulation was published in
1976 and last updated in 1978, and has
been in effect since that time. Devices
being evaluated under IDE’s were
exempted from the original CGMP
regulation because it was believed that
it was not reasonable to expect sponsors
of clinical investigations to ensure
compliance with CGMP’s for devices
that may never be approved for
commercial distribution. However,
sponsors of IDE studies were required to
ensure that investigational devices were
manufactured under a state of control.
52617Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
With respect to the new regulation,
FDA believes that it is reasonable to
expect manufacturers who design
medical devices to develop the designs
in conformance with design control
requirements and that adhering to such
requirements is necessary to adequately
protect the public from potentially
harmful devices. The design control
requirements are basic controls needed
to ensure that the device being designed
will perform as intended when
produced for commercial distribution.
Clinical evaluation is an important
aspect of the design verification and
validation process during the design
and development of the device. Because
some of the device design occurs during
the IDE stage, it is logical that
manufacturers who intend to
commercially produce the device follow
design control procedures. Were a
manufacturer to wait until all the IDE
studies were complete, it would be too
late to take advantage of the design
control process, and the manufacturer
would not be able to fulfill the
requirements of the quality system
regulation for that device.
Therefore, FDA has concurrently
amended the IDE regulation,
812.1 Scope to state:
(a) * * * An IDE approved under § 812.30
or considered approved under § 812.2(b)
exempts a device from the requirements of
the following sections of the Federal Food,
Drug, and Cosmetic Act (the act) and
regulations issued thereunder: * * * good
manufacturing practice requirements under
section 520(f) except for the requirements
found in § 820.30, if applicable (unless the
sponsor states an intention to comply with
these requirements under § 812.20(b)(3) or
§ 812.140(b)(4)(v)) and color additive
requirements under section 721. (Emphasis
added.)
FDA does not expect any new
information in IDE applications as a
result of this amendment, nor will FDA
inspect design controls during
bioresearch monitoring inspections.
FDA is simply making a conforming
amendment to the IDE regulation to
make clear that design controls must be
followed when design functions are
undertaken by manufacturers, including
design activity which occurs under an
approved IDE. FDA will evaluate the
adequacy of manufacturers’ compliance
with design control requirements in
routine CGMP inspections, including
preapproval inspections for premarket
approval applications (PMA’s).
66. Many written comments and oral
comments at the August and September
1995 meetings recommended that,
because design controls are a major
addition to the regulation, the effective
date for design controls should be
delayed until 18 months after
publication of the final rule.
FDA has addressed these comments
by extending the effective date of the
regulation until June 1, 1997, and by the
inspectional strategy described earlier.
67. A couple of comments suggested
that FDA lacked the authority to
establish the design control
requirements.
FDA disagrees with the comments.
The act and its legislative history make
clear that FDA has the authority to
impose those controls necessary to
ensure that devices are safe and
effective. The SMDA gave FDA explicit
authority to promulgate design controls,
including a process to assess the
performance of a device (see section
520(f)(1)(A) of the act). The legislative
history of the SMDA supports a
‘‘comprehensive device design
validation regulation.’’ H. Rept. 808,
101st Cong., 2d sess. 23 (emphasis
added). Congress stated that the
amendment to the statute was necessary
because almost half of all device recalls
over a 5-year period were ‘‘related to a
problem with product design.’’ Id. There
is a thorough discussion on the
evolution of and need for the design
controls in the preamble to the
November 23, 1993 (58 FR 61952),
proposal.
68. A few comments objected to FDA
requiring design controls for any class I
devices in § 820.30(a).
FDA believes that, for the class I
devices listed, design controls are
necessary and has retained the
requirements. Those relatively few
devices, while class I, require close
control of the design process to ensure
that the devices perform as intended,
given the serious consequences that
could occur if their designs were flawed
and the devices were to fail to meet
their intended uses. In fact, some of the
devices included on the list have
experienced failures due to design
related problems that have resulted in
health hazards, injuries, or death.
Further, verification, or even validation,
cannot provide the assurance of proper
design for some devices, especially
those containing extensive software.
Thus, all automated devices must be
developed under the design control
requirements.
69. Several comments stated that FDA
has underestimated the complexity of a
design project in requiring that the
plans identify ‘‘persons responsible for
each activity’’ in proposed § 820.30(b).
One comment stated that ‘‘define
responsibility for implementation’’ and
‘‘activities shall be assigned’’ were
basically redundant requirements. A
few other comments stated that ISO
9001:1994 does not call for the design
plans to be ‘‘approved’’ and that this
requirement should be deleted because
it would be burdensome.
FDA agrees in part with the comments
and has revised § 820.30(b) to require
the plan to describe or reference design
activities and define responsibility for
implementing the activities, rather than
requiring that the plan identify each
person responsible for carrying out each
activity. In making this change, FDA
notes that § 820.20(b)(1) requires
manufacturers to establish the
appropriate responsibility for activities
affecting quality, and emphasizes that
the assignment of specific responsibility
is important to the success of the design
control program and to achieving
compliance with the regulation. Also,
the design and development activities
should be assigned to qualified
personnel equipped with adequate
resources as required under
§ 820.20(b)(2). The requirements under
§ 820.30(b) were rewritten to be very
similar to the requirements in ISO
9001:1994, sections 4.4.2 and 4.4.3. FDA
does not agree that the design plan
should not be ‘‘approved.’’ ISO
9001:1994, section 4.4.2 requires that
the plan be ‘‘updated,’’ and section 4.4.3
requires that the plan be ‘‘regularly
reviewed.’’ Therefore, the approval is
consistent with ISO 9001:1994 and
would not be unduly burdensome since
the FDA does not dictate how or by
whom the plan must be approved. The
regulation gives the manufacturer the
necessary flexibility to have the same
person(s) who is responsible for the
review also be responsible for the
approval of the plan if appropriate.
70. A few comments stated that the
proposed requirement to describe ‘‘any
interaction between or among different
organizational and technical groups’’ in
§ 820.30(b) for the design and
development plan should be deleted
because it is overly broad, unnecessary,
and burdensome. One comment said
that the communication expected
between these groups should be
clarified.
In response, FDA has amended the
requirement as suggested by one
comment so that the plan shall identify
and describe the interfaces with
different groups or activities that
provide, or result in, input to the design
process. Many organization functions,
both inside and outside the design
group, may contribute to the design
process. For example, interfaces with
marketing, purchasing, regulatory
affairs, manufacturing, service groups,
or information systems may be
necessary during the design
52618 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
development phase. To function
effectively, the design plan must
establish the roles of these groups in the
design process and describe the
information that should be received and
transmitted.
71. One comment stated that the
requirement in § 820.30(b) that
manufacturers establish a design plan
completely ignores the creative and
dynamic process of designing by
requiring a plan to have complete
design and testing criteria established,
with specifications, before the design
process is started.
FDA disagrees with the comment.
Section 820.30(b) does not require
manufacturers to complete design and
testing criteria before the design process
begins. This section has been revised to
state that ‘‘plans shall be reviewed,
updated, and approved as design and
development evolves,’’ indicating that
changes to the design plan are expected.
A design plan typically includes at least
proposed quality practices, assessment
methodology, recordkeeping and
documentation requirements, and
resources, as well as a sequence of
events related to a particular design or
design category. These may be modified
and refined as the design evolves.
However, the design process can
become a lengthy and costly process if
the design activity is not properly
defined and planned. The more
specifically the activities are defined up
front, the less need there will be for
changes as the design evolves.
72. One comment stated that the
language contained in proposed
§ 820.30(c) should more closely match
that of ISO 9001. Many other comments
stated that the provision should not
require the input requirements to
‘‘completely’’ address the intended use
of the device because inputs could
never ‘‘completely’’ address the
intended use. Several comments stated
that the requirement of ISO 9001 that
‘‘incomplete, ambiguous or conflicting
requirements shall be resolved with
those responsible for imposing these
requirements’’ should be added to
§ 820.30(c), ‘‘Design input,’’ because it is
important that the regulation identify
the method of resolving conflicting
information.
FDA agrees with the harmonization
comment and has revised the language
to incorporate the requirement of
section 4.4.4, ‘‘Design input,’’ of ISO
9001:1994. FDA does not believe that it
is necessary to have identical language
to harmonize quality system
requirements. ISO 9001:1994, section
4.4.1, ‘‘General,’’ requires that the
manufacturer ‘‘establish and maintain
documented procedures to control and
verify the design of the product in order
to ensure that the specified
requirements are met.’’ FDA’s
regulation, under § 820.30(a), imposes
the same requirements.
Regarding the comments that input
requirements cannot completely address
the intended use of the device, FDA
recognizes that the provision could be
interpreted to impose a burden that may
not always be possible to meet and has
deleted the word ‘‘completely.’’ FDA
did not intend the provision to suggest
that a manufacturer must foresee every
possible event.
FDA emphasizes, however, that the
section requires the manufacturer to
ensure that the design input
requirements are appropriate so the
device will perform to meet its intended
use and the needs of the user. In doing
this, the manufacturer must define the
performance characteristics, safety and
reliability requirements, environmental
requirements and limitations, physical
characteristics, applicable standards and
regulatory requirements, and labeling
and packaging requirements, among
other things, and refine the design
requirements as verification and
validation results are established. For
example, when designing a device, the
manufacturer should conduct
appropriate human factors studies,
analyses, and tests from the early stages
of the design process until that point in
development at which the interfaces
with the medical professional and the
patient are fixed. The human interface
includes both the hardware and
software characteristics that affect
device use, and good design is crucial
to logical, straightforward, and safe
device operation. The human factors
methods used (for instance, task/
function analyses, user studies,
prototype tests, mock-up reviews, etc.)
should ensure that the characteristics of
the user population and operating
environment are considered. In
addition, the compatibility of system
components should be assessed. Finally,
labeling (e.g., instructions for use)
should be tested for usability.
FDA agrees with the comments, in
that it is important that incomplete,
ambiguous, or conflicting requirements
be resolved with those responsible for
imposing these requirements. Therefore,
FDA has added the requirement that the
procedures shall include a mechanism
for addressing incomplete, ambiguous,
or conflicting requirements. FDA notes
that this must be done to ‘‘ensure that
the design requirements are appropriate
and address the intended use of the
device,’’ as required under § 820.30(c).
73. A few other comments stated that
ISO 9001:1994 does not call for the
design input to be ‘‘approved’’ and
therefore, this requirement should be
deleted because it would be
burdensome.
FDA does not agree that the
‘‘approval’’ of design input
requirements should be deleted, nor that
the requirement is inconsistent with
ISO. ISO 9001:1994, section 4.4.4,
‘‘Design Input,’’ requires that the design
input requirements be ‘‘reviewed by the
supplier for adequacy.’’ Therefore, the
approval would not add any additional
burden because FDA does not dictate
how or by whom the design input
requirements must be approved, thus
giving the manufacturer the necessary
flexibility to have the same person(s)
who is responsible for the ‘‘review for
adequacy’’ also be responsible for the
approval, if appropriate. Further, it is
important that the design input be
assessed as early as possible in the
development process, making this an
ideal time in the device’s design
development to have a design review to
‘‘approve’’ the design input.
74. A few comments stated that the
proposed requirement under § 820.30(c)
that ‘‘design input shall be reviewed
and approved by a designated qualified
individual’’ should be deleted as it
implies that one person must be
designated to review and approve a
design, and that there may not be one
person who is qualified to assess all of
the design input requirements.
Addressing the same point, several
comments suggested that the provision
be revised to allow for more than one
person to review and approve the
design. One comment said that the
FDA’s requirement appears to be at odds
with the team approach.
FDA agrees with the concern
expressed by the comments and has
modified the requirement to allow more
than one individual to review and
approve the design input. FDA endorses
the team approach and believes that
designs should be reviewed and
evaluated by all disciplines necessary to
ensure the design input requirements
are appropriate.
75. Two comments stated that
proposed § 820.30(c) should be
reworded to focus on systems for
assuring adequate design input, not on
the input itself. One additional
comment on this section said that the
design input requirements should
include not only the device’s intended
use and needs of the user, but the
environmental limits of where it will be
used.
FDA agrees that procedures for
ensuring appropriate design controls are
of the utmost importance and has
modified the section to clarify that the
52619Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
manufacturer must establish and
maintain procedures to ensure that the
design requirements are properly
addressed. FDA made this change to the
other paragraphs as well, but notes that
§ 820.30(a), ‘‘General,’’ requires the
manufacturer to establish and maintain
procedures to control the design of the
device in order to ensure that specified
design requirements are met. The
sections that follow set forth some of the
requirements for which procedures
must be established. It should be
emphasized that the input itself must
also be appropriate; the requirement is
for the procedures to be defined,
documented, and implemented. Thus, if
the input requirements related to a
device fail to address the intended use
of the device, for example, the
manufacturer has failed to comply with
the provision.
FDA also agrees with the additional
comment but believes that identifying
and establishing the environmental
limits for safe and effective device
operation is inherent in the
requirements for ensuring that a device
is appropriate for its intended use. Some
factors that must be considered when
establishing inputs include, where
applicable, a determination of energy
(e.g., electrical, heat, and
electromagnetic fields), biological
effects (e.g., toxicity and
biocompatibility) and environmental
effects (e.g., electromagnetic
interference and electrostatic discharge).
76. Several comments stated that
proposed § 820.30(f), ‘‘Design output,’’
should be rewritten or deleted because
many of the requirements were already
stated in proposed §§ 820.30(d), ‘‘Design
verification,’’ and 820.30(e), ‘‘Design
review,’’ and, if retained, should be
reordered similar to ISO 9001.
FDA agrees in part with the comments
and has rewritten the requirements of
design output to be consistent with ISO
9001:1994, section 4.4.5, ‘‘Design
output,’’ and reordered the sections to
be consistent with ISO 9001:1994. FDA
retained the provision, however,
because it does not agree that the
section is redundant with the sections
on design verification, design
validation, or design review. Design
output are the design specifications
which should meet design input
requirements, as confirmed during
design verification and validation and
ensured during design review. The
output includes the device, its labeling
and packaging, associated specifications
and drawings, and production and
quality assurance specifications and
procedures. These documents are the
basis for the DMR. The total finished
design output consists of the device, its
labeling and packaging, and the DMR.
77. One comment stated that the
sentence ‘‘Design output procedures
shall ensure that design output meets
the design input requirements’’ is
redundant with the requirement under
design verification. Another comment
asked what is meant by ‘‘release.’’
FDA agrees with the first comment
and has deleted that sentence in
§ 820.30(d) but notes that the design
output must be documented and
expressed in terms that can be verified
against the design input requirements.
Design output can be ‘‘released’’ or
transferred to the next design phase at
various stages in the design process, as
defined in the design and development
plan. The design output is reviewed and
approved before release or transfer to
the next design phase or production.
The design output requirements are
intended to apply to all such stages of
the design process.
78. One small manufacturer
commented that the problems that
§ 820.30(e), ‘‘Design review,’’ is meant
to reveal involve coordination,
cooperation, or communication
difficulties among the members of an
organization and that these difficulties
do not exist in a small company.
Therefore, the comment stated that the
design review requirements should not
apply to small manufacturers.
The purpose of conducting design
reviews during the design phase is to
ensure that the design satisfies the
design input requirements for the
intended use of the device and the
needs of the user. Design review
includes the review of design
verification data to determine whether
the design outputs meet functional and
operational requirements, the design is
compatible with components and other
accessories, the safety requirements are
achieved, the reliability and
maintenance requirements are met, the
labeling and other regulatory
requirements are met, and the
manufacturing, installation, and
servicing requirements are compatible
with the design specifications. Design
reviews should be conducted at major
decision points during the design phase.
For a large manufacturer, design
review provides an opportunity for all
those who may have an impact on the
quality of the device to provide input,
including manufacturing, quality
assurance, purchasing, sales, and
servicing divisions. While small
manufacturers may not have the broad
range of disciplines found in a large
company, and the need to coordinate
and control technical interfaces may be
lessened, the principles of design
review still apply. The requirements
under § 820.30(e) allow small
manufacturers to tailor a design review
that is appropriate to their individual
needs.
79. One comment stated that the
wording of proposed § 820.30(e) implies
that only one design review is expected,
and that design review should be
conducted at several stages of product
development. Several comments stated
that to demand that every design review
be conducted by individuals who do not
have direct responsibility for design
development is impractical, especially
for small companies.
FDA agrees with the first comment
and has rewritten the requirement to
make clear that design reviews must be
conducted at appropriate stages of
design development, which must be
defined in the established design and
development plan. The number of
design reviews will depend on the plan
and the complexity of the device. FDA
also amended the requirements so that
the results of a design review include
identification of the design, the date,
and the individual(s) performing the
review. Thus, multiple reviews can
occur and the manufacturer must
document what is being reviewed,
when, and by whom.
FDA never intended to mandate that
an individual without design
responsibility conduct the design
reviews and, to clarify its position, has
rewritten the requirement. The
requirement now states that the
procedures shall ensure that each design
review includes an individual(s) who
does not have direct responsibility for
the design stage being reviewed. This
requirement will provide an ‘‘objective
view’’ from someone not working
directly on that particular part of the
design project, to ensure that the
requirements are met. In making this
change, FDA also notes that it was not
FDA’s intention to prohibit those
directly responsible for the design from
participating in the design review.
80. One comment stated that as part
of the systematic review of the adequacy
of the device design, it is occasionally
necessary to produce a prototype device
and have it evaluated by a physician
who is an expert in the area of the
device’s intended use. Thus, the
comment stated that the regulation
should be revised to allow a means for
a manufacturer to ship a prototype
device to a physician for evaluation.
One comment questioned whether
design verification and validation can
be conducted using prototypes or
machine shop models.
FDA regulations do not prohibit the
shipment of prototypes for clinical or
52620 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
other studies. Prototypes used in
clinical studies involving humans may
be shipped in accordance with the IDE
provisions in part 812 (21 CFR part
812).
FDA understands that it is not always
practical to conduct clinical studies on
finished production units and,
therefore, the use of prototypes in
clinical studies is acceptable. When
prototype devices are used on humans
they must be verified as safe to the
maximum extent feasible. Final design
validation, however, cannot be done on
prototypes because the actual devices
produced and distributed are seldom
the same as the research and
development prototypes. The final
verification and validation, therefore,
must include the testing of actual
production devices under actual or
simulated use conditions.
81. A few comments stated that
§ 820.30(d), ‘‘Design verification,’’
should be rewritten and reordered
similar to ISO 9001.
FDA agrees with the comments and
has rewritten and reordered this section
to be consistent with ISO 9001:1994.
The language in revised § 820.30(f) and
(g) incorporates the requirement of ISO
9001:1994, sections 4.4.7, ‘‘Design
verification,’’ and 4.4.8, ‘‘Design
validation,’’ respectively.
Under the revised provisions, the
design must be verified and validated. It
is important to note that design
validation follows successful design
verification. Certain aspects of design
validation can be accomplished during
the design verification, but design
verification is not a substitute for design
validation. Design validation should be
performed under defined operating
conditions and on the initial production
units, lots, or batches, or their
equivalents to ensure proper overall
design control and proper design
transfer. When equivalent devices are
used in the final design validation, the
manufacturer must document in detail
how the device was manufactured and
how the manufacturing is similar to and
possibly different from initial
production. Where there are differences,
the manufacturer must justify why
design validation results are valid for
the production units, lots, or batches.
Manufacturers should not use
prototypes developed in the laboratory
or machine shop as test units to meet
these requirements. Prototypes may
differ from the finished production
devices. During research and
development, conditions for building
prototypes are typically better
controlled and personnel more
knowledgeable about what needs to be
done and how to do it than are regular
production personnel. When going from
laboratory to scale-up production,
standards, methods, and procedures
may not be properly transferred, or
additional manufacturing processes may
be added. Often, changes not reflected
in the prototype are made in the device
to facilitate the manufacturing process,
and these may adversely affect device
functioning and user interface
characteristics. Proper testing of devices
that are produced using the same
methods and procedures as those to be
used in routine production will prevent
the distribution and subsequent recall of
many unacceptable medical devices.
In addition, finished devices must be
tested for performance under actual
conditions of use or simulated use
conditions in the actual or simulated
environment in which the device is
expected to be used. The simulated use
testing provision no longer requires that
the testing be performed on the first
three production runs. However,
samples must be taken from units, lots,
or batches that were produced using the
same specifications, production and
quality system methods, procedures,
and equipment that will be used for
routine production. FDA considers this
a critical element of the design
validation. The requirement to conduct
simulated use testing of finished devices
is found in the original CGMP in
§ 820.160, as part of finished device
inspection. This requirement has been
moved to § 820.30(g) because FDA
believes that simulated use testing at
this point is more effective in ensuring
that only safe and effective devices are
produced. Manufacturers must also
conduct such tests when they make
changes in the device design or the
manufacturing process that could affect
safety or effectiveness as required in the
original CGMP in § 820.100(a)(2). The
extent of testing conducted should be
governed by the risk(s) the device will
present if it fails. FDA considers these
activities essential for ensuring that the
manufacturing process does not
adversely affect the device.
Design validation may also be
necessary in earlier stages, prior to
product completion, and multiple
validations may need to be performed if
there are different intended uses. Proper
design validation cannot occur without
following all the requirements set forth
in the design control section of the
regulation.
82. Several comments stated that
adequate controls for verification of
design output are contained in proposed
§ 820.30(d), ‘‘Design verification,’’ and
repeated in proposed § 820.30(f),
‘‘Design output.’’ One comment stated
that this section will place undue
burden on designers and require
additional documentation which will
add little value to a device’s safety and
effectiveness.
FDA disagrees with the comments.
Revised § 820.30(f), ‘‘Design
verification,’’ and § 820.30(g), ‘‘Design
validation,’’ require verification and
validation of the design output. Section
820.30(d), ‘‘Design output,’’ requires
that the output be documented in a
fashion that will allow for verification
and validation. These sections thus
contain different requirements that are
basic to establishing that the design
output meets the approved design
requirements or inputs, including user
needs and intended uses. All the
requirements are essential to assuring
the safety and effectiveness of devices.
FDA does not believe that these
requirements place undue burden on
designers or require additional
documentation with no value added.
These basic requirements are necessary
to assure the proper device
performance, and, therefore, the
production of safe and effective devices,
and are acknowledged and accepted as
such throughout the world.
83. Several comments stated that the
term ‘‘hazard analysis’’ should be
defined in reference to design
verification. A couple of comments
stated that the proposed requirement for
design verification, to include software
validation and hazard analysis, where
applicable, was ambiguous, and may
lead an FDA investigator to require
software validation and hazard analysis
for devices in cases where it is not
needed. One comment stated that FDA
should provide additional guidance
regarding software validation and
hazard analysis and what investigators
will expect to see. Another comment
stated that by explicitly mentioning
only software validation and hazard
analysis, FDA was missing the
opportunity to introduce manufacturers
to some powerful and beneficial tools
for better device designs and problem
avoidance.
FDA has deleted the term ‘‘hazard
analysis’’ and replaced it with the term
‘‘risk analysis.’’ FDA’s involvement with
the ISO TC 210 made it clear that ‘‘risk
analysis’’ is the comprehensive and
appropriate term. When conducting a
risk analysis, manufacturers are
expected to identify possible hazards
associated with the design in both
normal and fault conditions. The risks
associated with the hazards, including
those resulting from user error, should
then be calculated in both normal and
fault conditions. If any risk is judged
unacceptable, it should be reduced to
acceptable levels by the appropriate
52621Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
means, for example, by redesign or
warnings. An important part of risk
analysis is ensuring that changes made
to eliminate or minimize hazards do not
introduce new hazards. Tools for
conducting such analyses include
Failure Mode Effect Analysis and Fault
Tree Analysis, among others.
FDA disagrees with the comments
that state the requirement is ambiguous.
Software must be validated when it is a
part of the finished device. FDA
believes that this control is always
needed, given the unique nature of
software, to assure that software will
perform as intended and will not
impede safe operation by the user. Risk
analysis must be conducted for the
majority of devices subject to design
controls and is considered to be an
essential requirement for medical
devices under this regulation, as well as
under ISO/CD 13485 and EN 46001.
FDA has replaced the phrase ‘‘where
applicable’’ with ‘‘where appropriate’’
for consistency with the rest of the
regulation.
FDA believes that sufficient domestic
and international guidelines are
available to provide assistance to
manufacturers for the validation of
software and risk analysis. For example,
‘‘Reviewer Guidance for Computer
Controlled Medical Devices Undergoing
510(k) Review,’’ August 1991; ‘‘A
Technical Report, Software
Development Activities,’’ July 1987; and
ISO–9000–3 contain computer
validation guidance. Further, FDA is
preparing a new ‘‘CDRH Guidance for
the Scientific Review of Pre-Market
Medical Device Software Submissions.’’
Regarding guidance on ‘‘risk analysis,’’
manufacturers can reference the draft
EN (prEN) 1441, ‘‘Medical Devices—
Risk Analysis’’ standard and the work
resulting from ISO TC 210 working
group No. 4 to include ISO/CD 14971,
‘‘Medical Devices—Risk Management—
Application of Risk Analysis to Medical
Devices.’’
FDA disagrees that it is missing the
opportunity to introduce manufacturers
to some powerful and beneficial tools
for better device designs and problem
avoidance because the manufacturer
must apply current methods and
procedures that are appropriate for the
device, to verify and validate the device
design under the regulation. Therefore,
FDA need not list all known methods
for meeting the requirements. A tool
that may be required to adequately
verify and validate one design may be
unnecessary to verify and validate
another design.
84. One comment stated that for some
design elements it may be more
appropriate to reference data from
another prior experimentation rather
than conduct new testing, and that the
requirement to list verification methods
should be modified.
FDA agrees in part with the comment.
The revised language of § 820.30(f) will
permit the use of data from prior
experimentation when applicable.
When using data from previous
experimentation, manufacturers must
ensure that it is adequate for the current
application.
85. ‘‘Design transfer,’’ now
§ 820.30(h), has been revised in
response to the many comments
objecting to the requirements in the
proposed section on ‘‘Design transfer.’’
Specifically, the proposed requirement
for testing production units under actual
or simulated use conditions was
rewritten and moved to current
§ 820.30(g), ‘‘Design validation.’’
FDA again emphasizes that testing
production units under actual or
simulated use conditions prior to
distribution is crucial for ensuring that
only safe and effective devices are
distributed and FDA has therefore
retained the requirement. ISO 9001:1994
discusses this concept in notes 12 and
13. As noted above, it is not always
possible to determine the adequacy of
the design by successfully building and
testing prototypes or models produced
in a laboratory setting.
The requirement for testing from the
first three production lots or batches has
been deleted. While FDA believes that
three production runs during process
validation (process validation may be
initiated before or during design
transfer) is the accepted standard, FDA
recognizes that all processes may not be
defined in terms of lots or batches. The
number three is, however, currently
considered to be the acceptable
standard. Therefore, although the
number requirement is deleted, FDA
expects validation to be carried out
properly in accordance with accepted
standards, and will inspect for
compliance accordingly.
Revised § 820.30(h) now contains a
general requirement for the
establishment of procedures to ensure
that the design basis for the device is
correctly translated into production
methods and procedures. This is the
same requirement that is contained in
§ 820.100(a) of the original CGMP
regulation.
86. A few comments stated that the
proposed requirements for ‘‘Design
release’’ would prohibit the release of
components, partial designs, and
production methods before the design
was final because the requirements
mandate a review of all drawings,
analysis, and production methods
before allowing the product to go into
production. Several comments stated
that the proposed section on ‘‘Design
release’’ was a duplication of
requirements in other paragraphs of
§ 820.30 and should be deleted.
FDA did not intend the requirements
for ‘‘Design release’’ to prohibit
manufacturers from beginning the
production process until all design
activities were completed. The intent of
the requirement was to ensure that all
design specifications released to
production have been approved,
verified, and validated before they are
implemented as part of the production
process. This requirement is now
explicitly contained in § 820.30(d).
FDA agrees in part with the second
set of comments and has moved the
requirement that design output be
reviewed and approved to current
§ 820.30(d), ‘‘Design output.’’ The
remainder of the requirements have
been deleted.
87. Several comments on § 820.30(i),
‘‘Design changes,’’ stated that it is
unnecessary to control all design
changes and to do so would inhibit
change and innovation.
FDA disagrees with the comments.
Manufacturers are not expected to
maintain records of all changes
proposed during the very early stages of
the design process. However, all design
changes made after the design review
that approves the initial design inputs
for incorporation into the design, and
those changes made to correct design
deficiencies once the design has been
released to production, must be
documented. The records of these
changes create a history of the evolution
of the design, which can be invaluable
for failure investigation and for
facilitating the design of future similar
products. Such records can prevent the
repetition of errors and the development
of unsafe or ineffective designs. The
evaluation and documentation should
be in direct proportion to the
significance of the change. Procedures
must ensure that after the design
requirements are established and
approved, changes to the design, both
pre- production and post-production are
also reviewed, validated (or verified
where appropriate), and approved.
Otherwise, a device may be rendered
unable to properly perform, and unsafe
and ineffective. ISO 9001:1994, section
4.4.9, similarly provides that ‘‘all design
changes and modifications shall be
identified, documented, reviewed, and
approved by authorized personnel
before their implementation.’’
Note that when a change is made to
a specification, method, or procedure,
each manufacturer should evaluate the
52622 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
change in accordance with an
established procedure to determine if
the submission of a premarket
notification (510(k)) under § 807.81(a)(3)
(21 CFR 807.81(a)(3)), or the submission
of a supplement to a PMA under
§ 814.39(a) (21 CFR 814.39) is required.
Records of this evaluation and its results
should be maintained.
88. Several comments recommended
that only changes after design validation
and design transfer to full-scale
production need to be documented.
FDA disagrees with the comments.
The safety and effectiveness of devices
cannot be proven by final inspection or
testing. Product development is
inherently an evolutionary process.
While change is a healthy and necessary
part of product development, quality
can be ensured only if change is
controlled and documented in the
development process, as well as the
production process. Again,
manufacturers are not expected to
maintain records of changes made
during the very early stages of product
development; only those design changes
made after the approval of the design
inputs need be documented. Each
manufacturer must establish criteria for
evaluating changes to ensure that the
changes are appropriate for its designs.
89. One comment on proposed
§ 820.30(i), ‘‘Design changes,’’ stated
that validation of design changes is not
always necessary and the regulation
should provide for other methods to be
used. FDA agrees with the comments
and has amended the requirement to
permit verification where appropriate.
For example, a change in the
sterilization process of a catheter will
require validation of the new process,
but the addition of more chromium to
a stainless steel surgical instrument may
only require verification through
chemical analysis. Where a design
change cannot be verified by subsequent
inspection and test, it must be validated.
90. Many comments noted that the
acronym for proposed design history
record (DHR) was the same as that of
‘‘device history record’’ (DHR), and
suggested that the name of the ‘‘design
history record’’ be changed. Several
comments stated that the requirements
of the ‘‘design history record’’ should be
deleted because they were redundant
with the requirements of the ‘‘device
master record.’’
FDA agrees with the first set of
comments and has changed the name to
‘‘design history file.’’
FDA disagrees with the second set of
comments. The DMR contains the
documentation necessary to produce a
device. The final design output from the
design phase, which is maintained or
referenced in the DHF, will form the
basis or starting point for the DMR.
Thus, those outputs must be referred to
or placed in the DMR. The total finished
design output includes the final device,
its labeling and packaging, and the DMR
that includes device specifications and
drawings, as well as all instructions and
procedures for production, installation,
maintenance, and servicing. The DHF,
in contrast, contains or references all the
records necessary to establish
compliance with the design plan and
the regulation, including the design
control procedures. The DHF illustrates
the history of the design, and is
necessary so that manufacturers can
exercise control over and be accountable
for the design process, thereby
maximizing the probability that the
finished design conforms to the design
specifications.
91. A few comments stated that the
proposed requirements in § 820.30(j) for
the design history record should allow
a single design history record for each
device family or group having common
design characteristics.
FDA agrees with the comments. The
intent of the DHF is to document, or
reference the documentation of, the
activities carried out to meet the design
plan and requirements of § 820.30. A
DHF is, therefore, necessary for each
type of device developed. The DHF
must provide documentation showing
the actions taken with regard to each
type of device designed, not generically
link devices together with different
design characteristics and give a general
overview of how the output was
reached.
92. Some comments stated that the
requirement that the DHF contain ‘‘all’’
records necessary to demonstrate that
the requirements are met should be
deleted because not ‘‘all’’ efforts need
documentation.
FDA received similar comments on
almost every section of the regulation
that had the word ‘‘all.’’ The proposed
requirement does not state that all
records must be contained in the DHF,
but that all records necessary to
demonstrate that the requirements were
met must be contained in the file. FDA
has deleted the word ‘‘all’’ but cautions
manufacturers that the complete history
of the design process should be
documented in the DHF. Such records
are necessary to ensure that the final
design conforms to the design
specifications. Depending on the design,
that may be relatively few records.
Manufacturers who do not document all
their efforts may lose the information
and experience of those efforts, thereby
possibly requiring activities to be
duplicated.
D. Document Controls (Subpart D)
93. One comment stated that subpart
D of part 820 should be titled
‘‘Document Controls,’’ instead of the
proposed ‘‘Document and Record
Controls’’ because the ‘‘record’’
requirements are addressed in subpart
M. One comment stated that removal of
obsolete or unneeded documents should
be performed to maintain the integrity
of the product configuration and the
quality system. The comment suggested
adding a requirement for a verification
step for document distribution and
removal to ensure this important
element of a quality system is performed
correctly. A few comments stated that
proposed § 820.40 should be rewritten
to be similar to ISO 9001 and to delete
the requirement that documents be
‘‘accurate’’ because the comments feared
that typographical errors would be
considered violations.
FDA agrees with the first comment
and has changed the title accordingly.
FDA agrees in part with the second
comment. The verification of document
distribution and removal is very
important and can directly affect the
quality of a product. Section 820.40,
which requires that the manufacturer
establish and maintain procedures to
control all documents, including those
that are obsolete and/or to be removed,
requires that the removal (or prevention
of use) of obsolete documents be
verified. FDA agrees in part with the last
set of comments and has rewritten the
section, following ISO 9001:1994, to be
a general requirement for procedures to
control documents that are required
under the regulation. The procedures
established must, among other things,
ensure control of the accuracy and usage
of current versions of the documents
and the removal or prevention from use
of obsolete documents, as well as ensure
that the documentation developed is
adequate to fulfill its intended purpose
or requirement. FDA retained the
requirement that the procedures ensure
that documents meet the requirements
of the regulation because that is the
purpose of controlling the documents.
FDA deleted the term ‘‘accurate’’ but
notes that a typographical error can
change the meaning of a document and
have undesirable consequences.
94. Several comments on proposed
§ 820.40(a), ‘‘Document approval and
issue,’’ as well as other sections
throughout the regulation, suggested
that the term ‘‘signature’’ be replaced by
the term ‘‘identification.’’ Such a change
would allow for electronic or
computerized identification in lieu of
formal written signatures. Other
comments stated that ‘‘or stamps’’
52623Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
should be added after ‘‘signature’’ since
they are legally recognized in some
foreign countries.
FDA is aware that many
documentation systems are now
maintained electronically, and is in the
process of developing an agency-wide
policy that will be implemented through
rulemaking on the use of electronic
signatures. The agency identified
several important issues related to the
use of such signatures, including how to
ensure that the identification is in fact
the user’s ‘‘signature.’’ These issues are
discussed in FDA’s ANPRM on the use
of electronic signatures, published in
the Federal Register on July 21, 1992
(57 FR 32185), and the proposed
regulation published in the Federal
Register on August 31, 1994 (59 FR
45160). Therefore, FDA has not revised
the regulation to use the term
‘‘identification,’’ but notes that the
quality system regulation’s use of the
term ‘‘signature’’ will permit the use of
whatever electronic means the agency
determines is the equivalent of a
handwritten signature. FDA
recommends that manufacturers use the
two Federal Register documents as
guidance until the regulation is
finalized. FDA has not added the term
‘‘or stamps’’ to the regulation; however,
stamps could be acceptable if the
manufacturer has a formal procedure on
how stamps are used in place of
handwritten signatures. The procedure
would have to address many of the same
issues addressed in the electronic
signature Federal Register documents,
most importantly how the stamps would
be controlled and how the manufacturer
would ensure that the stamp was in fact
the user’s ‘‘signature.’’
95. Several comments stated that
proposed § 820.40(b), ‘‘Document
distribution,’’ should be rewritten to be
consistent with ISO 9001.
In response, FDA has deleted the
section. The requirements for making
documents available at all appropriate
locations (ISO 9001:1994, section
4.5.2(a)) and the requirements for
promptly removing obsolete documents
(ISO 9001:1994, section 4.5.2(b)) have
been moved, in revised form, to
§ 820.40(a). In response to comments,
FDA has added that obsolete
documents, in lieu of being promptly
removed from points of use, may be
‘‘otherwise prevented from unintended
use.’’
96. Several comments suggested major
changes to proposed § 820.40(c),
‘‘Documentation changes.’’ Some stated
that the requirements should be revised
to be consistent with ISO 9001. Others
stated that the requirements related to
validation should be rewritten and
moved to another section under this
part, because § 820.40(c) should only
address document changes, not device
changes. Several comments stated that
the reference to determining whether a
510(k) or PMA supplement is required
after making changes to a device should
be deleted because it is covered under
different parts of the act and regulations.
One comment stated that the
requirement in § 820.40(c) for changes
to be ‘‘approved by individuals in the
same functions/organizations that
performed the original review and
approval, unless specifically designated
otherwise’’ is unrealistic and does not
reflect the way things are done in real
life.
FDA agrees with many of the
comments and has substantially
rewritten § 820.40(c), now designated as
§ 820.40(b), to relate specifically to
changes to a document. The
requirements are now very similar to the
ISO 9001:1994 requirements in section
4.5.3. FDA has retained the requirement
that the approved changes must be
communicated in a timely manner to
appropriate personnel. FDA has had
many experiences where manufacturers
made corrections to documents, but the
changes were not communicated in a
timely manner to the personnel utilizing
the documents. The result of these
untimely communications was the
production of defective devices.
In addition, FDA has moved the
requirement for validating production
and process changes to § 820.70(b),
‘‘Production and process changes,’’ and
notes that changes to the design
specifications, at any time during the
lifetime of the design of the device,
must conform to the requirements in
§ 820.30(i), ‘‘Design changes.’’
FDA has also deleted the sentence
referencing 510(k)’s and PMA
supplements because FDA believes this
is covered elsewhere, but notes that this
sentence is in the preamble above for
§ 820.30(i).
FDA disagrees that the requirement
for changes to be ‘‘approved by an
individual(s) in the same function or
organization that performed the original
review and approval, unless specifically
designated otherwise’’ should be
deleted and notes that this is a
requirement of ISO 9001:1994 as well.
The intent of the requirement is to
ensure that those who originally
approved the document have an
opportunity to review any changes
because these individuals typically have
the best insight on the impact of the
changes. The requirement is flexible,
however, because it permits the
manufacturer to specifically designate
individuals who did not perform the
original review and approval to review
and approve the changes. To designate
such individuals, the manufacturer will
need to determine who would be best
suited to perform the function, thus
ensuring adequate control over the
changes. In this way, review and
approval will not be haphazard.
97. One comment on proposed
§ 820.40(d), ‘‘Documentation change
record,’’ stated that this section should
be deleted because the other paragraphs
of § 820.40 adequately cover the
proposed requirements. Two comments
suggested replacing the section with the
requirements of section 4.5.2 of ISO
9001.
FDA has deleted § 820.40(d) and
placed the revised requirements in
paragraphs (a) and (b) of this section.
The general requirement of § 820.40
now requires the manufacturer to
establish adequate procedures to control
all documents required by part 820. The
procedures must cover the requirements
listed in § 820.40 (a) and (b). Thus, the
manufacturer must establish a
procedure for ensuring that only the
current and approved version of a
document is used, achieving the
objective of the ‘‘Master list or
equivalent document control
procedure,’’ required in ISO 9001:1994,
section 4.5.2.
The other requirement in § 820.40(d),
‘‘Document change record,’’ was to
maintain a record of changes, to include
a description of the changes, among
other things. FDA has retained this
requirement and has moved it into
§ 820.40(b), ‘‘Document changes,’’
because the agency believes this
information to be important and useful
when investigating and performing
corrective or preventive actions.
FDA believes § 820.40 on Document
controls now adequately harmonizes
with ISO 9001:1994, sections 4.5.1,
4.5.2, and 4.5.3.
E. Purchasing Controls (Subpart E)
98. One comment stated that the
proposed CGMP regulation omits any
discussion of contract reviews, such as
that contained in ISO 9001, section 4.3.
Rather than leaving these procedures to
the interpretations of individual
manufacturers and investigators, the
comment stated that FDA should
explicitly state its general policy
regarding contract reviews in the
regulation.
FDA agrees with the concepts
underlying the contract review
requirements of ISO 9001:1994, but
believes these principles are already
reflected in requirements in the
regulation, such as §§ 820.50 Purchasing
controls and 820.160 Distribution.
52624 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
Therefore, the agency has not added a
separate section on contract review.
99. One comment stated that the
requirements in § 820.50 amount to
overregulation. The comment stated that
components are purchased by providing
a specification sheet. They are then
inspected upon receipt, and defective
components are returned. According to
the comment, under § 820.50, the
manufacturer would be required to
spend more time on paperwork, and
product would still have to be inspected
upon receipt. Another comment stated
that the cost of the quality assurance
documentation program is going to be
significantly higher for a company that
runs a Just In Time (JIT) program than
what FDA estimated.
FDA disagrees with the comments.
The failure to implement adequate
purchasing controls has resulted in a
significant number of recalls due to
component failures. Most of these were
due to unacceptable components
provided by suppliers. Since FDA is not
regulating component suppliers, FDA
believes that the explicit addition to
CGMP requirements of the purchasing
controls of ISO 9001:1994 is necessary
to provide the additional assurance that
only acceptable components are used.
To ensure purchased or otherwise
received product or services conform to
specifications, purchasing must be
carried out under adequate controls,
including the assessment and selection
of suppliers, contractors, and
consultants, the clear and unambiguous
specification of requirements, and the
performance of suitable acceptance
activities. Each manufacturer must
establish an appropriate mix of
assessment and receiving acceptance to
ensure products and services are
acceptable for their intended uses. The
specifications for the finished device
cannot be met unless the individual
parts of the finished device meet
specifications. The most efficient and
least costly approach is to ensure that
only acceptable products and services
are received. This means that only
suppliers, contractors, and consultants
that meet specifications should be used.
The regulation has been written to
allow more flexibility in the way
manufacturers may ensure the
acceptability of products and services.
Under the requirements, manufacturers
must clearly define in the procedures
the type and extent of control they
intend to apply to products and
services. Thus, a finished device
manufacturer may choose to provide
greater in-house controls to ensure that
products and services meet
requirements, or may require the
supplier to adopt measures necessary to
ensure acceptability, as appropriate.
FDA generally believes that an
appropriate mix of supplier and
manufacturer quality controls are
necessary. However, finished device
manufacturers who conduct product
quality control solely in-house must
also assess the capability of suppliers to
provide acceptable product. Where
audits are not practical, this may be
done through, among other means,
reviewing historical data, monitoring
and trending, and inspection and
testing.
After evaluation of all of the
comments on § 820.50, FDA has decided
to change the wording of § 820.50(a) and
adopt the wording of ISO 9001:1994 to
make clear that manufacturers have
flexibility in determining the degree of
assessment and evaluation necessary for
suppliers, contractors, and consultants.
Thus the degree of supplier control
necessary to establish compliance may
vary with the type and significance of
the product or service purchased and
the impact of that product or service on
the quality of the finished device. In
addition, the requirement for
manufacturers to establish assessment
criteria has been deleted but the
evaluation still must include a
description how the assessment was
made (according to what criteria or
objective procedure) and the results
must be documented. Each
manufacturer must now define the type
and extent of control it will exercise
over suppliers, contractors, and
consultants. This is consistent with the
1994 version of ISO 9001.
Thus, FDA believes that the flexibility
of the regulation will allow
manufacturers to implement JIT
procedures without additional cost. In
fact, the new regulation is more
conducive to JIT practices by permitting
the assessment or evaluation of product
or services up front, thereby lessening
the degree of in-house control that may
be necessary.
100. Several comments said that it
was unclear what FDA meant by the
phrase ‘‘or held by other persons under
contract conform to specifications’’ and
that this phrase should be deleted.
FDA agrees with the comments and
has deleted the phrase. The phrase was
intended to mean product and services
which were purchased or processed in
some manner by other organizations.
Section 820.50 now applies to
‘‘purchased or otherwise received
product and services’’ to convey this
meaning. FDA emphasizes that the
requirements apply to all product and
service received from outside of the
finished device manufacturer, whether
payment occurs or not. Thus, a
manufacturer must comply with these
provisions when it receives product or
services from its ‘‘sister facility’’ or
some other corporate or financial
affiliate. ‘‘Otherwise received product’’
would include ‘‘customer supplied
product’’ as in ISO 9001:1994, section
4.7, but would not apply to ‘‘returned
product’’ from the customer.
101. One comment stated that
‘‘manufacturing materials’’ should be
deleted from the first sentence of the
introductory text of the proposed
§ 820.50, as the assessment of the
manufacturers of manufacturing
materials would be a monumental task.
FDA disagrees with the comment. The
first sentence of the introductory text of
§ 820.50 is rewritten to be a general
requirement that each manufacturer
must establish procedures to ensure that
received product and services
(purchased or otherwise received)
conform to specified requirements. All
manufacturers are expected to apply
controls to manufacturing materials
appropriate to the manufacturing
material, the intended use, and the
effect of the manufacturing materials on
safety and effectiveness. For example,
the procedures necessary to ensure that
a mold release agent conforms to
specified requirements may be less
involved than the procedures for
controlling latex proteins. The provision
allows the manufacturer the flexibility
of establishing the procedures to meet
its needs and to ensure that the product
conforms to specified requirements.
102. One comment said that FDA
should delete the last sentence of the
introductory text of proposed § 820.50
because it is unnecessary for
manufacturers to develop specifications
for services that are unrelated to product
or process quality, and because the
terms ‘‘service’’ and ‘‘other persons’’
lack definition. Other comments stated
that ‘‘all’’ should be deleted in the
general requirement.
FDA disagrees with the comments.
First, as used in the regulation,
‘‘service’’ means parts of the
manufacturing or quality system that are
contracted to others, for example,
plating of metals, testing, and
sterilizing, among others. Second, FDA
believes that all suppliers of such
services must be assessed and
evaluated, just like a supplier of a
product. As always, the degree of
control necessary is related to the
product or service purchased. FDA has,
however, deleted the term ‘‘provided by
other persons’’ because it was
unnecessary. FDA did not delete the
word ‘‘all’’ because, as discussed above,
component manufacturers are not
subject to this regulation, so it is the
52625Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
finished device manufacturer who is
responsible for ‘‘all’’ product and
services.
103. One comment stated that many
suppliers of components to the medical
device industry have their quality
systems certified to an ISO 9000
standard by an independent third party
auditor, and that such registration of
component manufacturers should be
considered in vendor assessment plans.
FDA agrees in part with the comment
in that certification may play a role in
evaluating suppliers, but cautions
manufacturers against relying solely on
certification by third parties as evidence
that suppliers have the capability to
provide quality products or services.
FDA has found during inspections that
some manufacturers who have been
certified to the ISO standards have not
had acceptable problem identification
and corrective action programs.
Therefore, the initial assessment or
evaluation, depending on the type and
potential effect on device quality of the
product or service, should be a
combination of assessment methods, to
possibly include third party or product
certification. However, third party
certification should not be relied on
exclusively in initially evaluating a
supplier. If a device manufacturer has
established confidence in the supplier’s
ability to provide acceptable products or
services, certification with test data may
be acceptable.
104. Some comments stated that
consultants should not be included in
the regulation at all. Others stated that
it was not consistent with ISO 9001.
FDA added ‘‘consultants’’ to
§ 820.50(a) in response to the comments
from § 820.25(c). FDA disagrees that
‘‘consultants’’ should be deleted
because over the years FDA has
observed that a surprising number of
firms hire consultants who have no
particular expertise in the area in which
the firm is seeking assistance. Section
820.50 addresses this problem by
ensuring that a consultant’s capability
for the specific tasks for which he or she
is retained be assessed and documented.
Further, FDA does not believe this
requirement is inconsistent with ISO
9001:1994 because ISO uses the term
‘‘subcontractor.’’ The term
‘‘subcontractor’’ includes consultants.
105. One comment said that requiring
evaluation of potential suppliers,
contractors, and consultants ‘‘on the
basis of their ability to meet
requirements’’ is vague and should be
clearly defined.
FDA disagrees that the phrase is
vague. Suppliers, contractors, and
consultants selected by manufacturers
of medical devices should have a
demonstrated capability of providing
products and services that meet the
requirements established by the finished
device manufacturer. The capability of
the product or service suppliers should
be reviewed at intervals consistent with
the significance of the product or
service provided and the review should
demonstrate conformance to specified
requirements.
106. One comment questioned the
usefulness of § 820.50, given that the
requirements under § 820.80 Receiving,
in-process, and finished device
acceptance, require manufacturers to
establish and maintain procedures for
acceptance of incoming components.
The intent of § 820.50 is to ensure that
device manufacturers select only those
suppliers, contractors, and consultants
who have the capability to provide
quality product and services. As with
finished devices, quality cannot be
inspected or tested into products or
services. Rather, the quality of a product
or service is established during the
design of that product or service, and
achieved through proper control of the
manufacture of that product or the
performance of that service. Section
820.50 thus mandates that products be
manufactured and services be
performed under appropriate quality
assurance procedures. Finished device
manufacturers are required under
§ 820.50 to establish the requirements
for, and document the capability of,
suppliers, contractors, and consultants
to provide quality products and
services.
Section 820.80 is specific to a device
manufacturer’s acceptance program.
While finished device manufacturers are
required to assess the capability of
suppliers, contractors, and consultants
to provide quality products and
services, inspections and tests, and
other verification tools, are also an
important part of ensuring that
components and finished devices
conform to approved specifications. The
extent of incoming acceptance activities
can be based, in part, on the degree to
which the supplier has demonstrated a
capability to provide quality products or
services. An appropriate product and
services quality assurance program
includes a combination of assessment
techniques, including inspection and
test.
107. Several comments stated that it
was not clear how a manufacturer could
evaluate an off-the-shelf component that
is purchased from a distributor rather
than directly from its manufacturer, and
stated that it would not be helpful to
audit the distributor.
FDA agrees that auditing a distributor
would not meet the intent of § 820.50.
Manufacturers should remember that
the purpose of assessing the capability
of suppliers is to provide quality
products and to provide a greater degree
of assurance, beyond that provided by
receiving inspection and test, that the
products received meet the finished
device manufacturer’s requirements.
The agency recognizes that finished
device manufacturers may not always be
able to audit the supplier of a product.
In such cases, the manufacturer must
apply other effective means to assure
that products are acceptable for use.
108. Many comments from both
domestic and foreign firms in response
to proposed § 820.22(b) said that making
supplier audit reports subject to FDA
review would have a major adverse
impact on the relationships between the
finished device manufacturers and their
suppliers and service providers. Some
stated that the requirement would cause
suppliers to refuse to sell components to
medical device manufacturers,
especially suppliers who provide only a
small part of their production to device
manufacturers. Others said that this
policy is not consistent with FDA’s
policy for internal audits.
FDA recognizes that quality audits of
suppliers have a significant and
demonstrated value as a management
tool for corrective action, quality
improvement, and overall assurance of
component and service quality, and
does not seek to undermine their value.
Therefore, based on the concerns raised
by the comments, FDA will not review
supplier audit reports during a routine
FDA inspection for compliance with
part 820, as noted in § 820.180(c),
‘‘Exceptions.’’ The audit procedures, the
evaluation procedures, and documents
other than the supplier audit reports
themselves that demonstrate
conformance with § 820.50 will be
subject to review by an FDA
investigator.
109. One comment stated that it was
unclear what is meant by the
requirement to specify ‘‘quality
requirements’’ that must be met by
suppliers, contractors, and consultants,
as stated in § 820.50(a).
The term ‘‘quality requirements’’
means the quality control and quality
assurance procedures, standards, and
other requirements necessary to assure
that the product or service is adequate
for its intended use. FDA does not
believe the term is unclear.
110. Several comments on proposed
§ 820.50(b), ‘‘Purchasing forms,’’
suggested that the term ‘‘forms’’ be
replaced by ‘‘data.’’ Other comments
stated that use of the term would not
allow electronic data exchange. One
comment stated that the use of an
52626 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
exclusive form for purchasing is
unnecessary and redundant, and that it
is unduly burdensome to require
detailed documentation on those
commonly available items such as
fasteners. The comment stated that it is
common practice to use prints or
drawings to fulfill the purpose of the
form.
FDA agrees in part with the
comments, but does not believe that
§ 820.50(b) prohibits the use of drawings
or prints, assuming that the documents
contain data clearly describing the
product or service ordered, and that the
specified requirements are met.
However, § 820.50(b) has been rewritten
and now requires manufacturers to
establish purchasing ‘‘data.’’ This
provides manufacturers with the
flexibility to use both written and
electronic means to establish purchasing
information.
111. One comment stated that the
inclusion of an additional provision
mandating that suppliers notify
manufacturers of any change in their
product or service places an undue
burden on suppliers and inhibits their
ability to make minor adjustments
within the parameters of agreed upon
specifications and quality requirements.
Many other comments stated that the
requirement in § 820.50(b) is feasible
only for components that are custom
made for the manufacturer, and is
meaningless for off-the-shelf
components purchased from
distributors. Other comments stated that
the requirement is part of the original
CGMP regulation and experience has
shown that suppliers are not willing to
supply device manufacturers with such
information. A few other comments
stated that ‘‘any’’ should be deleted
because the term is too broad and could
result in burdensome reporting of
variables which are irrelevant to the
continued performance or specifications
of the product or service.
FDA agrees in part with the comments
and has amended the requirement to
state that such agreement should be
obtained ‘‘where possible.’’ FDA still
believes that this change information is
very important to the manufacturer, and
that the manufacturer should obtain
information on changes to the product
or service. Where a supplier refuses to
agree to provide such notification,
depending on the product or service
being purchased, it may render him an
unacceptable supplier. However, where
the product is in short supply and must
be purchased, the manufacturer will
need to heighten control in other ways.
FDA has also deleted the term ‘‘any’’
to give manufacturers the flexibility to
define in the agreement the types of
changes that would require notification.
112. One comment stated that
§ 820.50(b) should incorporate a
provision that would allow
manufacturers to cite published
standards in purchasing forms as one
suitable method for specifying
purchased item quality requirements.
FDA believes the addition is
unnecessary, because the regulation
permits manufacturers to clearly
describe or reference requirements. A
reference could be to a standard.
113. One comment stated that it is
unclear whether the requirement for a
signature to approve purchasing
documents pertains to approval of the
form used for purchasing or approval of
the individual purchasing transaction.
The comment also stated that a
signature approval by transaction is not
practical for firms using electronic
document transmittals.
FDA has rewritten the requirement to
be more clear. The requirement is for
approval of purchasing data or
information on the purchasing
document used to purchase a product or
service. Thus, each manufacturer must
review and approve the purchasing data
before release of the data. Approval of
each purchasing transaction is not
required. FDA addressed the use of
electronic signatures in response to
another comment, and notes that FDA is
in the process of developing an agency-
wide policy on the use of electronic
signatures.
114. One comment stated that
purchasing is carried out verbally in
many small firms, without the use of
component-specific purchasing forms,
and that the regulation should be
revised to allow such verbal purchasing
to continue.
FDA disagrees with the comment.
About 15 percent of the recalls each
year are due to unacceptable purchased
products. Many of these products are
unacceptable because the finished
device manufacturer did not properly
describe the product. The requirements
for purchased products and services
must be documented to ensure that the
supplier, contractor, and consultant
provide a product or service which
conforms to specified requirements.
This requirement, and the goal it seeks
to achieve, are applicable to both small
and large companies.
115. One comment stated that the
requirement that purchasing forms spell
out the specifications for manufacturing
materials in all cases is excessive, and
that the need for specifications should
be based on the criticality of and risk
associated with the use of the specific
manufacturing material.
FDA agrees that the specifications for
many manufacturing materials may be
so well established that the trade name
of the product may be sufficient to
describe the material needed. For other
materials, specific written specifications
may be necessary to ensure that the
desired materials are received. The
extent of the specification detail
necessary to ensure that the product or
service purchased meets requirements
will be related to the nature of the
product or service purchased, taking
into account the effect the product or
service may have on the safety or
effectiveness of the finished device,
among other factors. The term
‘‘specification’’ has been replaced with
the term ‘‘specified requirements’’ to
better reflect the intent of the
requirement.
116. FDA has deleted the last two
sentences of § 820.50(b) in the Working
Draft and has replaced them with a
reference to § 820.40, the general
document control provision. This does
not change the requirement but simply
eliminates any confusion about the
reviews and approvals being
duplicative.
F. Identification and Traceability
(Subpart F)
i. Identification (§ 820.60)
117. A few comments on proposed
§§ 820.60 Identification and traceability
and 820.65 Critical device, traceability
stated that the two sections should be
rewritten to delete the distinction
between critical and noncritical devices.
Some stated they should be consistent
with ISO.
FDA agrees in part with the comments
and has rewritten § 820.60 to be
consistent with ISO 9001:1994 and
broad enough to allow the manufacturer
the flexibility needed to identify
product by whatever means described
by the required procedure. The term
‘‘critical device’’ has also been deleted,
and traceability is addressed solely in
§ 820.65.
118. One comment stated that
manufacturing materials should be
deleted from § 820.60, as the
requirements are excessive and not
economically justifiable with regard to
such materials.
FDA disagrees with the comment. The
purpose of § 820.60 is to ensure that all
products, including manufacturing
materials used in the manufacture of a
finished device, are properly identified.
This requirement is intended to help
prevent inadvertent use or release of
unacceptable product into
manufacturing. It is as important that
the proper manufacturing materials be
52627Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
used as it is that the proper component
be used.
119. A few comments thought that
§ 820.60 Identification in the Working
Draft was redundant with § 820.86
Acceptance status.
FDA disagrees with the comments.
Section 820.60 only requires that
product be identified but says nothing
about the acceptance status of that
product. Section 820.86 requires that
the acceptance status be identified so
that inadvertent use of product does not
occur. The manufacturer may choose to
set up a system by which the
identification required by § 820.60 can
also show the acceptance status
required by § 820.86, but this is up to
the manufacturer.
ii. Traceability (§ 820.65)
120. A few comments stated that
proposed § 820.65 Critical devices,
traceability implies that traceability
requirements exist for all devices.
Several other written comments and
oral testimony at the August and
September 1995 meetings stated that the
wording of the Working Draft was too
broad, vague, and ambiguous, and in
effect would require that all devices be
traced.
As noted above, FDA has deleted the
critical device terminology. Section
820.65 is now entitled Traceability and
uses the definition from the original
CGMP of a critical device to provide the
necessary clarity and delineation for
this requirement. Thus, traceability is
required for the critical devices listed in
the Federal Register notice of March 17,
1988 (53 FR 8854). However, FDA is
using the definition of critical device in
the requirement of § 820.65, rather than
a reference to the 1988 list of critical
devices, because that list has not been
updated since 1988 and there are no
plans to revise that list. Therefore, it is
imperative that manufacturers use the
definition within the requirement of
§ 820.65 to determine if a particular
device needs to be traced; it may not be
sufficient to rely solely on the 1988 list.
Manufacturers may find it advantageous
to provide unit, lot, or batch traceability
for devices for which traceability is not
a requirement to facilitate control and
limit the number of devices that may
need to be recalled due to defects or
violations of the act.
It is important that the traceability
requirements in part 820 are not
confused with the Medical Device
Tracking regulation in part 821 (21 CFR
part 821). The tracking regulation is
intended to ensure that tracked devices
can be traced from the device
manufacturing facility to the person for
whom the device is indicated, that is,
the patient. Effective tracking of devices
from the manufacturing facility, through
the distribution network (including
distributors, retailers, rental firms and
other commercial enterprises, device
user facilities, and licensed
practitioners) and, ultimately, to any
person for whom the device is intended
is necessary for the effectiveness of
remedies prescribed by the act, such as
patient notification (section 518(a) of
the act (21 U.S.C. 360h(a)) or device
recall (section 518(e).) In contrast, the
traceability provision requires that a
device that meets the definition of a
‘‘critical device’’ can be traced from the
manufacturing facility only to the
‘‘initial consignee’’ as discussed in
§ 820.160 Distribution.
121. Another comment on proposed
§ 820.65 stated that critical device
component traceability could be
interpreted to be required for almost all
electronic components and other
components in a critical device. The
comment stated that the extent of
component traceability should be left to
the manufacturer’s discretion, since it is
an economic risk decision. Several
comments stated that component
traceability should only be required
‘‘where appropriate,’’ that all ‘‘critical
device’’ components do not require
traceability to comply with the act.
FDA disagrees that the traceability
determination should be based solely on
economic risk. As noted in the preamble
to the November 23, 1993, proposal (58
FR 61964), where traceability is
important to prevent the distribution of
devices that could seriously injure the
user, traceability of components must be
maintained so that potential and actual
problem components can be traced back
to the supplier. The revised requirement
mandates traceability of components
‘‘where appropriate’’ as recommended
by the GMP Advisory Committee and
limited by the discussion in the scope,
§ 820.1(a)(3). The critical component
definition in the original CGMP
regulation may be used as guidance.
However, to carry out the requirement
of the revised provision, the
manufacturer should perform risk
analysis first on the finished device, and
subsequently on the components of
such device, to determine the need for
traceability. FDA believes that the
extent of traceability for both active and
inactive implantable devices should
include all components and materials
used when such products could cause
the medical device not to satisfy its
specified requirements. ISO/CD 13485
also requires that the manufacturer’s
agents or distributors maintain records
of distribution of medical devices with
regard to traceability and that such
records be available for inspection. This
requirement is found in § 820.160
Distribution of this regulation and is
consistent with the requirements in
§ 820.151 of the original CGMP.
While FDA understands that
traceability entails additional cost, the
agency notes that, if a product recall is
necessary, more devices would be
subject to recall if units, lots, or batches
of specific devices are not traceable,
with associated higher recall costs to the
manufacturer.
G. Production and Process Controls
(Subpart G)
i. Production and Process Controls
(§ 820.70)
122. A few comments stated that the
requirements in proposed § 820.70(a)
General are similar to those in ISO 9001,
but that ISO 9001 makes clear that the
requirements apply only ‘‘where
applicable’’ and where deviations from
device specifications would ‘‘directly
affect quality.’’ The comments suggested
that FDA similarly employ such
language to avoid being too restrictive
and overly burdensome.
The requirements in § 820.70(a) are
intended to ensure that each
manufacturer produces devices that
conform to their specifications. Thus,
where any deviations from
specifications could occur during
manufacturing, the process control
procedures must describe those controls
necessary to ensure conformance. Those
controls listed in the regulation may not
always be relevant; similarly others may
be necessary. For example, where
deviations from device specifications
could occur as a result of the absence of
written production methods,
procedures, and workmanship criteria,
such production controls are required.
Thus, FDA has retained the provision,
but revised it slightly to conform with
the original CGMP requirements in
§ 820.100(b)(1).
As noted, the process control
requirements apply when any deviation
from specifications could occur. FDA
believes that such deviations must be
controlled, and that linking the
requirements to deviations that directly
affect quality is inappropriate and
subjective, and that it could lead to the
manufacture of potentially dangerous
devices through the lack of control of
processes known to directly affect a
device’s specifications. Therefore, the
provision has not been restricted in this
manner. FDA has, however, revised the
requirements to state ‘‘Where process
controls are needed they shall include:’’
to make it clear that a manufacturer only
has to comply with the requirements
52628 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
stated in § 820.70 (a)(1) through (a)(5) if
the general criteria described in
§ 820.70(a) have been met.
123. One comment stated that the
second sentence of proposed § 820.70(a)
was too restrictive, in that some
processes can be accomplished by
adequately trained personnel without
the use of procedures.
FDA disagrees with the comment
because the establishment of procedures
is necessary to ensure consistency in
manufacture. The procedures may be
tailored under the requirement to cover
only those controls necessary to ensure
that a device meets its specifications.
FDA notes that the deletion of the word
‘‘all’’ does not alter the requirements.
The first sentence in the general
requirement also serves to tie the
production and process controls to the
design and development phase where
many of these controls are originally
established in order for the device to
conform to its design specifications.
In addition to these changes, FDA has
added the requirement that production
processes be ‘‘monitored’’ because a
manufacturer must monitor a controlled
process to ensure that the process
remains in control.
124. FDA deleted the requirement for
process controls related to ‘‘installation
and servicing’’ from proposed § 820.70
(a)(1) and (a)(2) in response to
comments. Such control is adequately
assured by the requirements in
§§ 820.170 Installation and 820.200
Servicing. FDA amended § 820.70(a)(3)
in response to some comments that were
confused about compliance with
‘‘applied reference standards.’’ The term
‘‘applied’’ was replaced with
‘‘specified’’ to make it clear that the
manufacturer must comply with
reference standards or codes which he
or she has specified in the DMR. FDA
has also deleted ‘‘and process control
procedures’’ because that requirement is
inherent in § 820.70(a), ‘‘General.’’ FDA
amended § 820.70(a)(5) by adding
‘‘identified and approved’’ in response
to comments and to clarify that the
‘‘representative samples’’ have to be
identified and deemed appropriate
before they are used as reference
standards.
125. One comment believed that there
is no longer a requirement that process
changes be validated. Other comments
on the Working Draft § 820.70(b) stated
the requirement was still confusing with
respect to ‘‘unless inspection and test
fully verifies,’’ and when the ‘‘approval’’
was to occur.
Revised § 820.70(b), ‘‘Production and
process changes,’’ addresses the
requirement for production and process
changes to be ‘‘verified or where
appropriate validated according to
§ 820.75.’’ This requirement for
validation was moved from § 820.40(c),
in revised form, to § 820.70. Verification
was added to give the manufacturer the
flexibility to verify changes that can be
tested and inspected because FDA
believes that validation is not always
necessary. FDA has provided guidance
on when changes should be validated in
its ‘‘Guideline on General Principles of
Process Validation.’’ The agency notes
that wherever changes may influence a
validated process, the process must be
revalidated as described in § 820.75. A
few examples of processes that must be
validated include sterilization, molding,
and welding.
FDA has deleted the last part in
§ 820.70(b) of the Working Draft about
approving changes and has replaced it
with ‘‘Changes shall be approved in
accordance with § 820.40.’’ This does
not change the requirement but simply
refers back to § 820.40 because this
requires the same review and approval.
This was done to eliminate any
confusion about the reviews and
approvals being duplicative.
126. The EU Commission and others
stated that environmental conditions
only affect the quality of certain devices
and that the requirements should,
therefore, be limited in their
application. Other comments stated that
the requirements in proposed
§ 820.70(b), ‘‘Environmental control,’’
were not consistent with the
requirements in the original CGMP,
§ 820.46. Another comment requested
that FDA delete the reference to
‘‘facilities’’ inspection and limit the
requirement to review of the control
system, as contained in the original
CGMP regulation.
FDA has amended the requirements
now in § 820.70(c) to apply only where
environmental conditions could
‘‘reasonably be expected to have an
adverse effect on product quality.’’ The
requirements for procedures to ensure
control of conditions, periodic
inspection of control systems, and
documentation and review of results are
similar to the original CGMP
requirements. However, the specific list
of conditions to be considered for
control, which was carried over from
the original CGMP regulation to the
proposal, was deleted in response to a
comment from the GHTF that the list
would be better suited for a guidance
document. FDA agrees that it is not
necessary to give examples of
conditions that may need controlling in
a regulation, and notes that lighting,
ventilation, temperature, humidity, air
pressure, filtration, airborne
contamination, and static electricity are
among many conditions that should be
considered for control.
FDA reworded the requirement to
make it clear that the inspection must be
of the control system. FDA also added
that the inspection of the control
system(s) shall include ‘‘any necessary
equipment,’’ e.g., pumps, filters,
measurement equipment, etc. The
sufficiency of facilities is covered in a
new § 820.70(f), ‘‘Buildings,’’ that
requires that buildings be of suitable
design and contain sufficient space to
allow for the proper manufacture of
devices. Section 820.70(f) is worded
similarly to the original CGMP
regulation § 820.40, and is intended to
achieve the same objectives as that
section.
127. One comment stated that the last
sentence of proposed § 820.70(b),
‘‘Environmental control,’’ should be
deleted because it is redundant with the
audits required in § 820.22(a). Another
comment said that environmental
conditions are currently reviewed via
internal audit, which an FDA
investigator cannot review.
FDA disagrees with the comments.
The inspection and review of
environmental control systems are
routine quality assurance functions that
are part of the production quality
assurance program. The audits required
by § 820.22(a) are audits of the quality
system, conducted to ensure the
adequacy of and conformance with the
quality system requirements. The
requirement to conduct a quality audit
is in addition to other provisions in the
regulation which require that a
manufacturer review its specific
controls to ensure the requirements are
met. FDA may review the activities and
results of environmental control system
inspections.
128. The GHTF commented that the
requirements of proposed § 820.70(c),
‘‘Cleaning and sanitation,’’ should be
placed in guidance.
After careful consideration, FDA
agrees that a separate section on
cleaning and sanitation is unnecessary.
The objective of proposed § 820.70(c) is
adequately met through the requirement
of § 820.70(e), ‘‘Contamination control,’’
and § 820.70(a), the general process
control procedure requirement.
Contamination control must include
establishing and maintaining adequate
cleaning procedures and schedules, if
such control is necessary to meet
manufacturing process specifications. In
addition, § 820.25 Personnel requires
that employees have a thorough
understanding of their job functions,
which would include a requirement that
the appropriate employees comprehend
52629Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
the cleanliness and sanitation
procedures.
129. The GHTF and others
commented that the requirements of
proposed § 820.70 (d)(1) through (d)(3)
should be deleted and placed in
guidance because they are redundant
with the first sentence in proposed
§ 820.70(d), ‘‘Personnel health and
cleanliness.’’
FDA agrees with the comments and
has deleted § 820.70 (d)(1) through
(d)(3). FDA has also rewritten the
section, now entitled ‘‘Personnel,’’ to
require procedures to achieve the
desired result, rather than dictate the
means to achieve the result. The section
as rewritten provides the manufacturer
with more flexibility and is consistent
with ISO/CD 13485. Under this section,
a manufacturer’s requirements must not
permit unclean or inappropriately
clothed employees, or employees with
medical conditions, to work with
devices where such conditions could
reasonably be expected to have an
adverse effect on product quality. The
procedures must also address acceptable
clothing, hygiene, and personal
practices, if contact between personnel
and product or environment could
reasonably be expected to have an
adverse effect on product quality.
FDA also added the requirement, from
ISO/CD 13485, that personnel who are
working temporarily (such as
maintenance and cleaning personnel)
under special environmental conditions
(such as a clean room) be appropriately
trained or supervised by someone
trained to work in such an environment.
130. One comment stated that the
requirements of § 820.70(e),
‘‘Contamination control,’’ should be
deleted and placed in guidance.
Another comment stated that the
reference to manufacturing materials
should be deleted because it is
redundant with § 820.70(g),
‘‘Equipment.’’
FDA has rewritten the section to
delete the specific references to
contaminants that probably gave rise to
the suggestion that the section would be
more appropriate as guidance. The
section now contains a broad
requirement for the establishment of
procedures to prevent contamination of
equipment or product by any substance
that could reasonably be expected to
have an adverse effect on product
quality. Again, this revision adds
flexibility.
FDA disagrees with the comment that
manufacturing materials should be
deleted from this section. Section
820.70(e) requires procedures to ensure
that manufacturing materials do not
become contaminated. Section
820.70(g), in contrast, establishes
requirements related solely to the
equipment used in the manufacturing
process, and § 820.70(h),
‘‘Manufacturing material,’’ addresses
requirements for the removal or
limitation of manufacturing materials.
Thus, § 820.70 (g) and (h) are distinct
and are intended to achieve different
objectives.
131. The only two comments received
on proposed § 820.70(f), ‘‘Sewage and
refuse disposal,’’ recommended that it
be deleted because it was unnecessary
and/or covered by other Federal
regulations.
Section 820.70(f) has been deleted
because the requirements are adequately
covered in the current requirements
under § 820.70(e), ‘‘Contamination
control,’’ and § 820.70(c),
‘‘Environmental control.’’ Under these
sections, sewage, trash, byproducts,
chemical effluvium, and other refuse
that could affect a device’s safety,
effectiveness, or fitness-for-use must be
adequately controlled.
132. Two comments stated that the
requirement related to equipment in
§ 820.70(g) should ensure that
equipment meets ‘‘specified
requirements,’’ not be ‘‘adequate for its
intended use,’’ because intended use is
determined during the design phase,
and because it is easier to assess
whether equipment meets specified
requirements.
From these comments, FDA can see
that the requirement should be revised
because it may have been
misinterpreted. The requirement is
reworded as suggested. Under the
requirement, the equipment must be
appropriately designed to facilitate
maintenance, adjustment, cleaning, and
use. It must also meet the requirements
that are necessary to ensure its proper
functioning for the manufacture of the
device.
133. A few comments stated that not
all equipment requires maintenance,
and the requirement for a maintenance
schedule in § 820.70(g)(1) should be
revised to make that clear. The GHTF
recommended that the second sentence
of proposed § 820.70(g)(1), which
required that the maintenance schedule
be posted or readily available, be
deleted and placed in guidance.
FDA agrees that not all equipment
may require maintenance and notes that
the general requirement of § 820.70(a)
requires process control procedures that
describe only those controls which are
necessary. Therefore, FDA did not
revise the requirement.
FDA has deleted the requirement that
the maintenance schedule be posted or
readily available. Section 820.70(g),
which directs a manufacturer to ensure
that equipment meets specified
requirements, requires that the
manufacturer ensure that maintenance
is carried out on schedule to comply
with the requirement. To satisfactorily
meet this requirement, FDA expects that
the schedule will be posted on or near
the equipment to be maintained, or
otherwise made readily available to
appropriate personnel. Deletion of the
requirement, however, permits the
manufacturer added flexibility in
complying with this section.
134. Several comments stated that
§ 820.70(g)(2), ‘‘Inspection,’’ and (g)(3),
‘‘Adjustment,’’ should be deleted and
placed in guidance because the
requirements are adequately covered in
§ 820.70(g)(1). Another comment stated
that the requirement for limitations or
tolerances to be ‘‘visibly posted on or
near equipment’’ should be deleted.
FDA believes that to adequately
ensure that equipment continues to
meet its specifications, and to ensure
that inherent limitations and allowable
tolerances are known, these
requirements are imperative. FDA notes
inherent limitations and allowable
tolerances must be visibly posted on or
near equipment or made readily
available to personnel to allow the
manufacturer the flexibility to utilize
any system to make sure that the
limitations or tolerances are readily
available to the personnel that need
them. Both § 820.70(g)(2) and (g)(3) are
requirements in the original CGMP
regulation and the agency has found
them to be useful and necessary.
135. One comment stated that
requiring the removal of manufacturing
material to be documented in proposed
§ 820.70(g)(4), ‘‘Manufacturing
material,’’ would result in impossible
requirements, such as the requirement
to document how much cutting oil is
lost during a metal removing operation,
such as drilling. Others commented that
the requirement needs to be amended to
clarify that only manufacturing
materials that have an adverse effect or
that are unwanted need to be removed
or limited.
FDA disagrees with the first comment
because § 820.70(g)(4) (now § 820.70(h))
only requires that the fact that
manufacturing material was removed or
reduced be documented, not how much
was removed or how much was lost due
to processing. This requirement is
carried over from the original CGMP
regulation, § 820.60(d). FDA has
amended the section, however, to clarify
that this requirement is necessary
‘‘Where a manufacturing material could
reasonably be expected to have an
adverse effect on product quality.’’ FDA
52630 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
purposefully qualifies the general
requirement by that which adversely
affects ‘‘product quality’’ (product as
defined in § 820.3(r)) and limits the
requirement for removal or reduction to
‘‘an amount that does not adversely
affect the device’s quality.’’
136. One comment on § 820.70(h),
‘‘Automated processes,’’ (now
§ 820.70(i)), stated that the section
should be revised to reflect that software
used in such systems must be validated
for ‘‘its intended use,’’ not simply
validated. Another comment stated that
most companies buy software currently
available on the market and do not make
changes to the software. It was
recommended that § 820.70(h) allow for
use of outside personnel for validation
runs and not necessarily require the
development of a software validation
procedure. One comment suggested that
the section should allow verification
rather than validation of off-the-shelf
software. Several comments on
‘‘automated processes’’ stated that the
term ‘‘data processing systems’’ was
unclear and its inclusion rendered the
requirement too broad. Others asked for
clarification of ‘‘automated data
processing systems.’’
FDA has modified the requirement to
mandate validation for the intended use
of the software. In addition, the
requirement that the software be
validated by individuals designated by
the manufacturer has also been deleted
to make clear that validation may be
performed by those other than the
manufacturer. However, whether the
manufacturer designates its own
personnel or relies on outside assistance
to validate software, there must be an
established procedure to ensure
validation is carried out properly.
FDA has maintained the requirement
for validation because the agency
believes that it is necessary that
software be validated to the extent
possible to adequately ensure
performance. Where source code and
design specifications cannot be
obtained, ‘‘black box testing’’ must be
performed to confirm that the software
meets the user’s needs and its intended
uses.
FDA emphasizes that manufacturers
are responsible for the adequacy of the
software used in their devices, and
activities used to produce devices.
When manufacturers purchase ‘‘off-the-
shelf’’ software, they must ensure that it
will perform as intended in its chosen
application.
FDA has amended the requirement to
state ‘‘When computers or automated
data processing systems are used as part
of production or the quality system,’’ for
clarification. Software used in
production or the quality system,
whether it be in the designing,
manufacturing, distributing, or tracing,
must be validated.
ii. Inspection, Measuring, and Test
Equipment (§ 820.72)
137. A few comments stated that it is
unclear what is meant by the
requirement in proposed § 820.84
Inspection, measuring, and test
equipment that equipment be capable of
producing ‘‘valid results.’’ The
comments stated that such equipment
may be ‘‘suitable for its intended
purpose’’ and still not always ‘‘produce
valid results.’’
FDA believes that the term ‘‘valid
results’’ is commonly understood and
notes that it has been in the original
CGMP regulation under § 820.61 for 18
years. The requirement is for the
equipment to work properly, thereby
providing ‘‘valid results.’’
FDA renumbered § 820.84 as § 820.72
in response to comments that stated
these requirements were more
appropriate under subpart G Production
and Process Controls. FDA revised the
requirement in new § 820.72(a),
‘‘Control of inspection, measuring, and
test equipment,’’ to make clear that the
procedures must also ensure that the
equipment is maintained and moved the
requirement that the procedure include
provisions for handling, preservation
and storage of equipment from
§ 820.84(d) in the Working Draft to
§ 820.72(a). FDA deleted the term ‘‘test
software’’ that was in § 820.84(e)
because FDA believes that ‘‘test
software’’ is now covered under
‘‘electronic inspection and test
equipment’’ in § 820.72(a).
138. A few comments stated that the
last sentence in proposed § 820.84(a),
‘‘Calibration,’’ is unnecessary because
the requirement for trained personnel is
redundant with § 820.25(a) Personnel. A
few comments stated that FDA should
identify what must be remedied in
proposed § 820.84(a).
FDA agrees that the requirement for
trained personnel is redundant and has
deleted this sentence from § 820.72(b),
‘‘Calibration.’’ FDA has also added to
this section the requirement that the
calibration procedure include
provisions for remedial action to
‘‘reestablish the limits and to evaluate
whether there was any adverse effect on
the device’s quality’’ to clarify this
remedial action requirement and its
relationship to the requirements in
§ 820.100 Corrective and preventive
action.
139. Several comments stated that
§ 820.84(b), ‘‘Calibration standards,’’
should allow for the use of international
standards.
FDA agrees and has rewritten the
section, now § 820.72(b)(1), ‘‘Calibration
standards,’’ to allow the use of
international standards. The standards
used must be generally accepted by
qualified experts as the prevailing
standards.
140. FDA has deleted the requirement
in proposed § 820.84(c), now
§ 820.72(b)(2), ‘‘Calibration records,’’
that calibration records be ‘‘maintained
by individuals designated by the
manufacturer’’ because, on further
reflection, the agency believes such a
requirement is unnecessary. As long as
the required procedures and records are
maintained and displayed or readily
available as required, the objective of
the section, ensuring that calibration is
performed and acceptable, will be met.
FDA did add ‘‘equipment
identification’’ to the list of items that
had to be documented in response to a
comment that requested clarification in
this regard, so that equipment is clearly
identified in the calibration records
even if the records are not displayed on
or near the particular piece of
equipment.
141. Two comments suggested
deleting proposed § 820.84(d) because
they believed it was unnecessary to
establish procedures to maintain
equipment, because most manufacturers
simply store equipment in protective
covers.
As already noted, FDA has moved the
requirement for establishing
maintenance procedures into the
general requirement in § 820.72. FDA
has retained the requirement because
some equipment requires special
handling, preservation, and storage. For
example, the temperature and humidity
of a room may affect the equipment and
procedures would need to be
established taking those factors into
account.
142. Several comments stated that
proposed § 820.84(e), ‘‘Facilities,’’
should be deleted because it is
redundant with the requirements under
§ 820.70(g) and the general requirements
of proposed § 820.84(a).
FDA agrees that revised § 820.84(a),
which is now § 820.72(a), would require
procedures to ensure that equipment is
protected from adjustments that could
invalidate the calibration, in that the
section requires procedures to ensure
that equipment is properly maintained.
The procedures that require equipment
to be routinely calibrated, inspected,
and checked, will also ensure that
improperly calibrated equipment is not
used. Therefore, FDA has deleted
proposed § 820.84(e).
52631Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
iii. Process Validation (§ 820.75)
143. A few comments on proposed
§ 820.75 Special processes stated that
the meaning of the term ‘‘special
processes’’ was unclear. Other
comments stated that FDA should
provide examples of processes that
would be considered ‘‘special
processes.’’ Several comments stated the
term ‘‘fully verified’’ was unclear and
should be deleted.
In response to the comments, the term
‘‘special processes’’ has been dropped
from the regulation and the term
‘‘process validation’’ is defined in
§ 820.3(z)(1). The section now requires
that when a process ‘‘cannot be fully
verified by subsequent inspection and
test, the process shall be validated with
a high degree of assurance. * * *’’
Examples of such processes include
sterilization, aseptic processing,
injection molding, and welding, among
others. The validation method must
ensure that predetermined
specifications are consistently met. The
new § 820.75, entitled ‘‘Process
validation,’’ is consistent with ISO
9001:1994, section 4.9, including the
terminology ‘‘fully verified.’’ FDA does
not believe this terminology is unclear
since it has been used in ISO 9001:1987
and 1994 and explained in several
guidance documents.
FDA amended this section by
removing the requirement for the
signature of the individual(s)
performing the process and placing the
signature requirement on the approval
of the validation where FDA believes it
is more important and appropriate. FDA
also added that ‘‘where appropriate, the
major equipment validated’’ must be
documented. Depending on the process
that is validated, it may be necessary to
document the person performing the
process or the equipment or both in
order to have adequate controls on the
process.
144. Several comments were received
on proposed § 820.75(a)(1) through
(a)(4) that stated that the requirements
were redundant with other parts of the
regulation and should be modified or
deleted.
FDA disagrees with the comments
and believes that, due to the importance
of process validation and correct
performance of the validated process,
the requirements are necessary. The
requirements have been rearranged in
the revised section.
145. Comments on the first sentence
of proposed § 820.75(b) stated that it
was unclear and unrealistic. Other
comments stated that the requirement
for continuous monitoring is not
practical or necessary.
In response to the comments, FDA has
revised the requirements. Section
820.75(b) applies to the performance of
a process after the process has been
validated. In contrast, § 820.75(a) relates
to the initial validation of the process.
FDA deleted the term ‘‘continuous’’
because the agency concurs that
monitoring can be accomplished at a
determined interval and frequency
depending on the type of validated
process being monitored and controlled.
FDA notes that the interval and
frequency should be periodically
evaluated for adequacy, especially
during any evaluation or revalidation
that occurs in accordance with the
requirements in new § 820.75(c).
New § 820.75(b)(1), which was
proposed § 820.75(c) of the Working
Draft, requires that validated processes
be performed by a qualified
individual(s). FDA notes that
§ 820.75(b)(1) is similar to the
requirements under § 820.25 Personnel
but emphasizes that validated processes
must not only be performed by
personnel with the necessary education,
background, training, and experience for
their general jobs but must be performed
by personnel qualified for those
particular functions. Revised
§ 820.75(b)(2), which was proposed
§ 820.75(d) of the Working Draft,
contains the amended documentation
requirements for validated processes, to
include the monitoring and control
methods and data. FDA notes that it is
always ‘‘appropriate’’ to document the
equipment used in the process where
the manufacturer uses different
equipment on different manufacturing
lines. To investigate a problem with the
device, the manufacturer will need to
know which equipment was used, since
the problem could be with the
equipment itself. The same holds true
for the individual(s) performing the
process.
Section 820.75(c) contains
requirements on process revalidation in
response to several comments and
concerns on when revalidation activities
were necessary. FDA believes that the
new arrangement of § 820.75 should
clarify the requirement.
H. Acceptance Activities (Subpart H)
i. Receiving, In-Process, and Finished
Device Acceptance (§ 820.80)
146. One comment stated that the
emphasis on testing and inspection in
proposed § 820.80 completely ignores
the quality goals, the benefit of requiring
purchasing controls, and statements
made in the preamble of the proposal
reflecting FDA’s negative opinion about
manufacturers relying solely on testing
and inspection. A few comments on the
Working Draft stated that ‘‘acceptance
activities’’ should be defined as
inspections, tests, or other verification
activities so that the regulation does not
require all of these activities but gives
the manufacturer the flexibility to
choose the appropriate method.
FDA agrees with the comments and
has replaced the term ‘‘inspection and
test’’ with ‘‘acceptance activities’’ in
§ 820.80. Further, FDA now defines
‘‘acceptance activities’’ to include
inspections, test, or other verification
activities, such as supplier audits.
147. One comment stated that
recordkeeping is a significant cost factor
in the operation of a total quality
system, and that the revised CGMP
regulation should not add cost through
duplication of documentation. The
comment said recording all quantitative
data is inappropriate and of little value.
FDA agrees that unnecessary
duplication of documentation should be
avoided. FDA believes that the quality
system regulation requires the minimum
documentation necessary to ensure that
safe and effective devices are designed
and produced. FDA similarly believes
that maintaining records of results of
acceptance activities is imperative to
ensure that nonconforming product is
not inadvertently used or distributed.
FDA has, however, deleted from
§ 820.80(a) the requirement for
recording the results of inspections and
testing because § 820.80(e) requires that
the results of acceptance activities be
recorded. The requirement in
§ 820.80(a) was therefore unnecessary.
Further, the regulation does not specify
quantitative data but simply requires
that the results be recorded. FDA
believes that it is essential for the
manufacturer to maintain records which
provide evidence that the product has
gone through the defined acceptance
activities. These records must clearly
show whether the product has passed or
failed the acceptance activities
according to the defined acceptance
criteria. Where product fails to pass
acceptance activities, the procedures for
control of nonconforming product must
be implemented, to include
investigations where defined. If the
acceptance records are not clear about
how the product failed, then the
manufacturer may end up duplicating
the acceptance activities in order to
perform appropriate investigations.
148. Several comments stated that
proposed § 820.80(b), ‘‘Receiving
inspection and testing,’’ did not allow
for urgent use of incoming items. The
comments said that urgent use should
be permitted if forward traceability is
maintained so that recall and
52632 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
replacement is possible if the material is
subsequently found to be
nonconforming. One comment stated
that the requirements in proposed
§ 820.80(b) were too specific and did not
allow flexibility.
FDA agrees in part with the
comments. FDA has permitted
manufacturers to use incoming items
that had not yet been proven acceptable
for use, provided that the manufacturer
maintained control of the unapproved
items and could retrieve the product
that contained the unapproved items
before distribution. Therefore, the
requirement that product ‘‘shall not be
used or processed
until * * * verified’’ has been deleted
from § 820.80(b), now entitled
‘‘Receiving acceptance activities.’’
However, FDA emphasizes that while
the product can be used in production
prior to verification, it cannot be
distributed prior to verification. FDA
does not permit the distribution of
unapproved product through an urgent
use provision, because all finished
devices must comply with § 820.80(d),
‘‘Final acceptance activities,’’ before
they are released for distribution.
In addition to the changes noted
above, FDA has deleted the requirement
that ‘‘individual(s) designated by the
manufacturer shall accept or reject
incoming’’ product. FDA does not
believe this requirement is necessary in
§ 820.80(b) because § 820.80(e) requires
that the identification of the
individual(s) conducting the acceptance
activities be recorded.
149. Several comments stated that an
absolute requirement under proposed
§ 820.80(c), ‘‘In-process inspection and
testing,’’ for in-process testing was
inconsistent with the preamble, which
stated that an appropriate mix of
controls should be established. Other
comments stated that in-process
inspection and testing is unnecessary if
the process is validated and the devices
are subject to final inspection. A few
comments on the Working Draft stated
that the term ‘‘held’’ was too restrictive
and was not consistent with the
requirements and the preamble
discussion for § 820.80(b).
FDA agrees with the comments in
part, but believes that § 820.80 as now
written, with the inclusion of ‘‘where
appropriate,’’ does not mandate in-
process inspection and testing. FDA
acknowledges that in-process
acceptance activities may not be
necessary or possible for every device,
for example, medical socks. Further, the
requirement states that in-process
product must be controlled until the
required inspection and test, or other
verification activities, have been
performed. This will permit
manufacturers to use, under defined
conditions and procedures, product that
has not completed the acceptance
activities described in § 820.80(b) and
(c). This does not means that
manufacturers can ignore the
requirements in § 820.80(b) and (c)
because these requirements must be
completed in order to comply with
§ 820.80(d), which must be satisfied
before devices are released for
distribution.
150. FDA received a similar comment
on proposed § 820.80(d), ‘‘Final
inspection and test,’’ which said that the
provision requires finished device
inspection for all devices, without
defining what inspection is expected.
The comment suggested that § 820.80(d)
could be interpreted to require actual
product inspection, which has been
shown to be ineffective as a means of
controlling product quality. One
comment stated that signatures should
not be the only approved method for
identification of the individual(s)
responsible for release. The comment
stated that use of inspection stamps and
initials should be allowed.
FDA has rewritten § 820.80(d) to
require that manufacturers establish and
maintain procedures for finished device
acceptance to ensure that each
production run, lot, or batch of finished
devices meets specified requirements.
Manufacturers have the flexibility to
choose a combination of methods,
including finished device inspection
and test, provided such methods will
accomplish the required result.
FDA believes that it is important for
the person responsible for release to
have personally documented and dated
that release. This can be accomplished
through use of an inspection stamp, if
the stamp is controlled as discussed
above under § 820.40 Document
controls. Therefore, FDA has retained
the requirement for a signature.
151. Several comments on proposed
§ 820.80(e), ‘‘Inspection and test
records,’’ stated that manufacturers
should not be required to record the use
of general equipment in inspection and
test records, because this requirement
would be burdensome to large
manufacturers who use many common
pieces of equipment. A few comments
stated that the record requirements
under § 820.80(e) are overly prescriptive
and go well beyond ISO 9001’s
comparable requirements. The
comments stated that recordkeeping
should be specified by the manufacturer
in the spirit of ISO 9001, and should
include only the minimum records
necessary to show that finished device
inspections are performed in accordance
with established procedures.
FDA agrees that it may not be
necessary to document every piece of
equipment used in acceptance activities.
The requirement, renamed ‘‘Acceptance
records,’’ now provides that equipment
used shall be documented ‘‘where
appropriate.’’ For some critical
operations and testing, identification of
the equipment used will be imperative
for proper investigations into
nonconforming product.
The requirements, as revised, are
similar to those in ISO 9001:1994. As
discussed above, certain information
must be captured on acceptance records
for the records to be useful in evaluating
nonconformance. Through many years
of experience, FDA has determined
what it believes to be a minimum
requirement for these records. Section
820.80(e) reflects that determination.
ii. Acceptance Status (§ 820.86)
152. Several comments on proposed
§ 820.86, ‘‘Inspection and test status,’’
stated that the section was not flexible
enough to allow identification of the
inspection and test status of product by
various means, because the requirement
was for the status to be ‘‘visible.’’ One
comment questioned why ‘‘component
acceptance’’ was addressed separately.
FDA agrees that the inspection and
test status may be identified by any
method that will achieve the result,
which might include acceptable
computerized identification, markings,
etc. The section has been rewritten to
reflect this intent, has been renamed
‘‘Acceptance status,’’ and is now
consistent with ISO 9001:1994. FDA
also agrees that ‘‘component
acceptance’’ is covered by
‘‘manufacturing’’ and has deleted the
term.
153. FDA has deleted proposed
§ 820.86(b) which required that records
identify those responsible for release of
the product, because the agency believes
that the records required by § 820.80(e)
will identify those responsible for
release of product.
I. Nonconforming Product (Subpart I)
154. FDA has rewritten § 820.90
Nonconforming product to utilize the
term ‘‘product’’ throughout, as defined
in § 820.3(r), for both shorthand
purposes and consistency with ISO
9001:1994.
155. One comment suggested deleting
the term ‘‘inadvertently’’ and adding the
word ‘‘distributed’’ before ‘‘installed’’ in
§ 820.90(a). Several written comments
and persons who testified at the August
and September 1995 meetings stated
that § 820.90(a) should be written so
52633Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
that it is not interpreted to require
investigations for every
nonconformance. A few comments
stated that the term ‘‘provide for’’ was
too broad and unclear. Other comments
stated that the requirement to ‘‘ensure’’
nonconforming product was ‘‘not used
or distributed’’ was inconsistent with
the provisions in § 820.90(b) which
allowed for concessions under certain
circumstances. One comment stated that
the requirement that persons
responsible for nonconforming product
be ‘‘notified’’ should be deleted because
it is overly burdensome and not needed
in all cases.
FDA has reworded the general
requirement for procedures to control
nonconforming product and has deleted
the term ‘‘inadvertently.’’ FDA has also
added the requirement that the
procedures provide for the ‘‘evaluation’’
of nonconforming product because
evaluation is key to protecting against
recurring nonconformance. The
addition is consistent with ISO
9001:1994.
FDA has further revised § 820.90 in
response to the comments on the
Working Draft. First, the manufacturer
must establish procedures to ‘‘control’’
nonconforming product. Second, the
procedures shall ‘‘address the
identification, documentation,
evaluation, segregation, and disposition
of nonconforming product,’’ which
gives the manufacturers the flexibility to
define how they are going to ‘‘control’’
products that are nonconforming. Third,
the evaluation process addressed in the
procedure ‘‘shall include a
determination of the need for an
investigation.’’ Therefore, the
procedures will need to set forth the
manufacturer’s SOP on when
investigations will take place and
provisions for trending and/or
monitoring the situation in the future.
Fourth, FDA added ‘‘The evaluation and
any investigation shall be documented,’’
which would include the explanations
for not performing investigations and
how nonconformances will be trended
and/or monitored. Further, the phrase
‘‘is not used or distributed’’ has been
deleted to be consistent with
§ 820.90(b).
FDA disagrees that the notification
requirement should be deleted. Where
some person or organization is
responsible for nonconformances, they
must be notified to ensure that future
nonconformances are prevented. This
requirement is also in ISO 9001:1994,
section 4.13.1.
156. FDA has rewritten § 820.90(b)(1),
‘‘Nonconformity review and
disposition,’’ to make clear that the
section requires procedures that define
the responsibility for review and
authority for disposition of
nonconforming product and that set
forth the review and disposition
process. FDA believes that proper
disposition of nonconforming product is
essential for ensuring the safety and
effectiveness of devices. Manufacturers
have made determinations that
nonconforming product may be used
which have resulted in defective
devices being distributed. Thus,
although it may be appropriate at times
to use nonconforming products, the
disposition process must be adequately
controlled.
The revision requires that disposition
and justification for concessions be
documented. FDA believes that the
justification should be based on
scientific evidence, which a
manufacturer should be prepared to
provide upon request. Concessions
should be closely monitored and not
become accepted practice. This section
is consistent with ISO 9001:1994,
section 4.13.2.
Several comments on the Working
Draft stated that the term ‘‘concession’’
should be deleted because it is
confusing. FDA has rewritten the
sentence to ensure the meaning of this
requirement is clear. The sentence now
reads, ‘‘Documentation shall include the
justification for the use of
nonconforming product and the
signature of the individual(s)
authorizing the use.’’
157. Several comments were received
on proposed § 820.90(b)(2). One
comment stated that the requirement
should allow for other types of
disposition besides reprocessing. One
comment suggested replacing the term
‘‘reinspection’’ with ‘‘evaluation,’’ to
allow for greater flexibility in
verification methods. Many comments
suggested that the requirement for
identification of reprocessed product
should be deleted because they believed
it would cause the consumer to forego
purchasing the product. Several
comments requested that the term
‘‘rework’’ be used instead of
‘‘reprocessing’’ to harmonize
terminology with ISO standards.
FDA agrees in part with the
comments. FDA, as noted in the
definition section, has substituted the
term ‘‘rework’’ and the ISO 8402:1994
definition for the term ‘‘reprocessing’’ in
response to the comments. FDA believes
that the revised § 820.90(b)(1) clearly
allows for other methods of disposition
besides rework. Section 820.90(b)(2),
which governs rework when it is chosen
as a method of disposition, has been
revised as requested by replacing the
term ‘‘reinspection’’ with
‘‘reevaluation.’’ The change will allow
manufacturers the flexibility to inspect
or use other verification activities.
FDA has also deleted the requirement
for identification of reworked product
from this section because FDA believes
that it is adequately covered in
§§ 820.60 Identification and 820.86
Acceptance status.
Other minor changes made to the
section include requiring that a
determination of any adverse effect of
the rework upon the product be made,
whether there is ‘‘repeated’’ rework or
not. FDA’s intent is that such a
determination be made with any
rework, given the potential harmful
effect rework could have on the product.
The change harmonizes § 820.90 with
ISO/CD 13485. In addition, the sentence
requiring a ‘‘complete reinspection’’ for
reworked product was deleted because
the section already requires retesting
and reevaluation of reworked product.
FDA has also substituted ‘‘current’’ for
‘‘original or subsequently modified’’
approved specifications for clarity. The
requirements as written are consistent
with the original CGMP requirements in
§§ 820.115 and 820.116.
J. Corrective and Preventive Action
(Subpart J)
158. A few comments suggested
revising proposed § 820.100 Corrective
and preventive action to require
procedures for implementing corrective
and preventive action, consistent with
ISO 9001. One comment stated that the
procedures should provide for an initial
halt of distribution of suspect products
or tight control and action concerning
products already distributed before
taking the long term action listed in this
section.
FDA agrees that it is essential that the
manufacturer establish procedures for
implementing corrective and preventive
action and has revised § 820.100(a)
accordingly. The procedures must
include provisions for the remaining
requirements in the section. These
procedures must provide for control and
action to be taken on devices
distributed, and those not yet
distributed, that are suspected of having
potential nonconformities.
159. Other comments stated that the
degree of remedial action should be
commensurate with the risk associated
with a product failure.
FDA agrees that the degree of
corrective and preventive action taken
to eliminate or minimize actual or
potential nonconformities must be
appropriate to the magnitude of the
problem and commensurate with the
risks encountered. FDA cannot dictate
in a regulation the degree of action that
52634 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
should be taken because each
circumstance will be different, but FDA
does expect the manufacturer to develop
procedures for assessing the risk, the
actions that need to be taken for
different levels of risk, and how to
correct or prevent the problem from
recurring, depending on that risk
assessment.
FDA emphasizes that any death, even
if the manufacturer attributes it to user
error, will be considered relevant by
FDA and will have a high risk
potentially associated with it. User error
is still considered to be a nonconformity
because human factors and other similar
tools should have been considered
during the design phase of the device.
FDA acknowledges that a manufacturer
cannot possibly foresee every single
potential misuse during the design of a
device, but when the manufacturer
becomes aware of misuse, the corrective
and preventive action requirements
should be implemented to determine if
redesign of the device or labeling
changes may be necessary.
160. Several comments on proposed
§ 820.100(a)(1) stated that requiring a
manufacturer to analyze ‘‘all’’ processes,
work operations, and other factors
listed, is excessive and unrealistic.
Some comments stated that there should
not be a requirement to conduct an
analysis for ‘‘potential causes’’ of
nonconformances. A few comments
stated that including ‘‘quality audits’’ in
the list was inconsistent with the FDA
policy of not reviewing internal audits.
A few comments stated that the
requirement that the analysis include
‘‘trend analysis’’ should be modified
because it places unnecessary emphasis
on only one statistical method or tool.
Other comments stated that statistical
tools are not always necessary and that
the requirement should be modified.
FDA agrees in part with the
comments. It was not FDA’s intent to
require that processes unrelated to an
existing nonconformity be analyzed.
Instead, § 820.100(a)(1) requires an
analysis of those items listed that could
be related to the problem. To prevent
confusion, the word ‘‘all’’ has been
deleted. The requirement is similar to
that of ISO 9001:1994, section 4.14.3(a).
The inclusion of ‘‘quality audits’’ as a
valuable feedback mechanism for the
manufacturer does not conflict with
FDA’s policy of not reviewing internal
quality audits. Internal audits are
valuable and necessary tools for the
manufacturer to evaluate the quality
system. The audit reports should be
used to analyze the entire quality
system and provide feedback into the
system to close the feedback loop, so
that corrective or preventive actions can
be taken where necessary. FDA will
review the corrective and preventive
action procedures and activities
performed in conformance with those
procedures without reviewing the
internal audit reports. FDA wants to
make it clear that corrective and
preventive actions, to include the
documentation of these activities, which
result from internal audits and
management reviews are not covered
under § 820.180(c).
FDA has further revised the
requirement to delete the reference to
trend analysis in response to the
comments. The provision now requires
that ‘‘appropriate statistical
methodology’’ be employed where
necessary to detect recurring quality
problems. This revision is made because
there may be other statistical tools
available beyond ‘‘trend analysis.’’ FDA
emphasizes that the appropriate
statistical tools must be employed when
it is necessary to utilize statistical
methodology. FDA has seen far too often
the misuse of statistics by manufacturers
in an effort to minimize instead of
address the problem. Such misuse of
statistics would be a violation of this
section.
FDA has retained the requirement for
analysis to identify ‘‘potential causes of
nonconforming product,’’ however,
because FDA believes this is an
important aspect of preventive action.
FDA notes that ISO 9001:1994, section
4.14.1, specifically acknowledges that
corrective and preventive actions are
associated with actual and potential
nonconformities.
161. Several comments stated that
proposed § 820.100(a)(2) was redundant
with requirements in § 820.198
Complaints.
FDA agrees in part with the comments
and has written the section to require
investigation of the cause of
nonconformities relating to process,
product, and the quality system,
consistent with ISO 9001:1994, section
4.14.2(b). The requirement in this
section is broader than the requirement
for investigations under § 820.198,
because it requires that nonconforming
product discovered before or after
distribution be investigated to the
degree commensurate with the
significance and risk of the
nonconformity. At times a very indepth
investigation will be necessary, while at
other times a simple investigation,
followed by trend analysis or other
appropriate tools will be acceptable. In
addition, in contrast to § 820.198, the
requirement in this section applies to
process and quality system
nonconformities, as well as product
nonconformities. For example, if a
molding process with its known
capabilities has a normal 5 percent
rejection rate and that rate rises to 10
percent, an investigation into the
nonconformance of the process must be
performed.
162. One comment stated that
proposed § 820.100(a)(3) should not
require identification of action
necessary to correct ‘‘other quality
problems.’’ Another stated that the
section should be harmonized with ISO.
One comment thought that the
requirement should be to identify action
to correct problems identified by ‘‘trend
analysis.’’
FDA agrees that harmonization is
important and has harmonized the
terminology (and intent) of the section
with ISO 9001:1994, sections 4.14.2(c)
and 4.14.3(b). However, FDA disagrees
that the section should not require
identification of action necessary to
correct ‘‘other quality problems’’
because the objective of § 820.100 is to
correct and prevent poor practices, not
simply bad product. Correction and
prevention of unacceptable quality
system practices should result in fewer
nonconformities related to product.
Therefore, this section addresses
problems within the quality system
itself. For example, it should identify
and correct improper personnel
training, the failure to follow
procedures, and inadequate procedures,
among other things.
FDA also disagrees with the
suggestion to link the requirement in
§ 820.100(a)(3) to trend analysis and has
deleted the reference to trend analysis
in § 820.100(a)(1) to give the
manufacturer the flexibility to use
whatever method of analysis is
appropriate.
163. FDA has revised § 820.100(a)(4)
to reflect that preventive, as well as
corrective, action must be verified or
validated. The section is now consistent
with ISO 9001:1994, sections 4.14.2(d)
and 4.14.3(c). Two comments stated that
the definitions of validation and
verification cause confusion here, but
FDA believes that these concerns should
be resolved with the amended
definitions under § 820.3 (z) and (aa).
164. FDA has also revised
§ 820.100(a)(5) in the same manner, to
relate the requirements to preventive
action. This section is consistent with
ISO 9001:1994, section 4.14.1, third
paragraph.
165. One comment suggested that
proposed § 820.100(a)(6) be revised to
reflect that minor quality problems may
not need to be disseminated to those
directly responsible for ensuring quality
and to be reviewed by management.
52635Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
FDA agrees in part with this
comment. The revised § 820.100 (a)(6)
and (a)(7) require that procedures
ensure that information is disseminated
to those directly responsible for assuring
quality or the prevention of such
problems, and provide for submitting
relevant information on identified
quality problems, as well as corrective
and preventive actions, for management
review. This revision should address the
concern raised by the comment because
only certain information need be
directed to management. The
manufacturer’s procedures should
clearly define the criteria to be followed
to determine what information will be
considered ‘‘relevant’’ to the action
taken and why. FDA emphasizes that it
is always management’s responsibility
to ensure that all nonconformity issues
are handled appropriately. This section
is now consistent with ISO 9001:1994,
section 4.14.3(d).
166. Two comments stated that the
records required under § 820.100(b)
should be treated as part of the internal
audit.
FDA disagrees with these comments
because this information is directly
relevant to the safety and effectiveness
of finished medical devices. FDA has
the authority to review such records and
the obligation to do so to protect the
public health. Comparable information
and documentation is reviewed by the
FDA under the requirements of the
original CGMP, §§ 820.20 (a)(3) and
(a)(4) and 820.162. Manufacturers will
be required to make this information
readily available to an FDA investigator,
so that the investigator may properly
assess the manufacturer’s compliance
with these quality system requirements.
K. Labeling and Packaging Control
(Subpart K)
i. Device Labeling (§ 820.120)
167. Several comments on proposed
§ 820.162 Device labeling stated that the
section should be deleted and placed in
guidance because it is unnecessary and
redundant with requirements under
§§ 820.80 and 820.86. A few comments
stated that the section should be
changed to be the same as that in the
original CGMP regulation, under
§§ 820.120 and 820.121. Another
comment stated that labeling and
packaging requirements should be in
subpart K of part 820 and handling,
storage, distribution, and installation
requirements should be in subpart L of
part 820 because labeling and packaging
functionally occur before distribution
and installation.
FDA believes that the section, as
written, is consistent with the
requirements in the original CGMP.
Section 820.120 relates specifically to
labeling and its requirements are in
addition to those in both §§ 820.80 and
820.86. Further, FDA believes that the
degree of detail in this section is
necessary because these same
requirements have been in place for 18
years, yet numerous recalls every year
are the result of labeling errors or
mixups. FDA therefore believes that
more, not less, control is necessary.
FDA has reordered the subparts but
notes that the handling and storage
requirements apply throughout the
production process.
168. One comment stated that ‘‘to
maintain labeling integrity and to
prevent labeling mixups’’ should be
deleted from the general requirement
because the requirements are detailed in
the following sections. Other comments
stated that all labels need not be affixed
to the device and others stated that
‘‘legible and affixed’’ may not be
appropriate for all implantable devices.
FDA agrees with the comments and
has revised the requirements
accordingly.
169. A few comments stated that what
is now § 820.120(b), ‘‘Labeling
inspections,’’ should allow automated
readers to be used in place of a
‘‘designated individual(s)’’ to examine
the labeling.
FDA disagrees with the comments
because several recalls on labeling have
been attributed to automated readers not
catching errors. The requirement does
not preclude manufacturers from using
automated readers where that process is
followed by human oversight. A
‘‘designated individual’’ must examine,
at a minimum, a representative
sampling of all labels that have been
checked by the automated readers.
Further, automated readers are often
programmed with only the base label
and do not check specifics, such as
control numbers and expiration dates,
among other things, that are distinct for
each label. The regulation requires that
labeling be inspected for these items
prior to release.
170. FDA has amended § 820.120(b) to
add ‘‘any’’ to additional processing
instructions in response to a comment
for clarity. FDA has amended
§ 820.120(d) to include ‘‘The label and
labeling used for each production unit,
lot, or batch shall be documented in the
DHR’’ in response to comments
questioning whether the labeling used
should be recorded in the DMR or the
DHR. FDA also amended § 820.120(e) by
adding ‘‘or shall accompany the device
through distribution’’ and deleting
‘‘itself or its label’’ for clarity.
171. A few comments on proposed
§ 820.165 Critical devices, labeling
stated that this section should be
deleted to eliminate any distinction
between critical and noncritical devices.
FDA agrees in part and has deleted
§ 820.165, but has added the
requirement on control numbers to
§ 820.120(e).
ii. Device Packaging (§ 820.130)
172. Two comments on proposed
§ 820.160 Device packaging stated that
the section should be changed to allow
manufacturers to use third parties, if
desired, for packaging. Another
comment stated that it is very difficult
if not impossible to protect from
intentional damage, such as tampering.
FDA agrees with the comments and
has changed the requirement, now in
§ 820.130, accordingly. FDA believes,
however, that any intentional tampering
would not be covered because the
requirement states ‘‘during customary
conditions.’’
L. Handling, Storage, Distribution, and
Installation (Subpart L)
i. Handling (§ 820.140)
173. One comment on proposed
§ 820.120 Handling suggested that the
procedures be ‘‘designed to prevent,’’
rather than be established to ‘‘ensure
that,’’ problems delineated in the
section do not occur. The comment
stated that the word ‘‘prevent’’ would
add clarity, without compromising the
meaning of the sentence. Another
comment stated that the handling
procedures should apply ‘‘prior to
distribution,’’ not during ‘‘any stage of
handling.’’ One comment stated that the
requirement does not cover the need for
special precautions in handling used
devices which may be contaminated,
and that this is an important issue
covered by ISO/CD 13485.
FDA does not believe that § 820.120,
now § 820.140, as written is unclear.
The procedures are expected to ensure
that mixups, damage, deterioration,
contamination, or other adverse effects
do not occur. FDA amended the
requirement, however, to remove ‘‘any
stage of’’ so it reads ‘‘during handling.’’
The requirement continues to apply to
all stages of handling in which a
manufacturer is involved, which may in
some cases go beyond initial
distribution.
The comparable provision in ISO/CD
13485 states, ‘‘If appropriate, special
provisions shall be established,
documented and maintained for the
handling of used product in order to
prevent contamination of other product,
the manufacturing environment and
52636 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
personnel.’’ FDA agrees with this
requirement and has therefore added the
term ‘‘contamination’’ to §§ 820.140
Handling and 820.150 Storage.
ii. Storage (§ 820.150)
174. Two comments stated that
proposed § 820.122 Storage should be
amended to be similar to ISO 9001, and
that the rest of the requirements should
be deleted and included in a guidance
document. One comment stated that the
term ‘‘obsolete’’ should be deleted
because, although a device may no
longer be sold, thereby making it
obsolete, the components for that device
may still be stored for customer support
of the existing devices.
FDA agrees that § 820.122, now
§ 820.150, could be more consistent
with ISO 9001 and has revised the
section to harmonize with ISO
9001:1994. FDA has not deleted the
term ‘‘obsolete.’’ FDA understands that
a device may no longer be sold, but that
parts and subassemblies may still be
required for customer support;
therefore, those components or
subassemblies are not ‘‘obsolete.’’ FDA’s
intent in this requirement is to ensure
that only the appropriate product be
used or distributed.
FDA has deleted the requirement that
control numbers or identifications be
legible and visible because it believes
the requirement is inherent in
§ 820.150(a), which requires the
manufacturer to establish procedures to
prevent mixups. To do this, a
manufacturer must ensure that product
can be properly identified.
175. A comment stated that restricting
access to designated areas through the
use of keys, bar code readers, or other
means, should be sufficient to meet the
intent of the requirement in proposed
§ 820.122(b), without the need for
written procedures for authorizing
receipt.
FDA has not deleted the requirement
for procedures, now in § 820.150(b), to
authorize receipt of product because the
agency believes that strict control over
product in storage areas and stock
rooms results in decreased distribution
of nonconforming product. Thus, even
where locked storage rooms are utilized,
the procedures should detail, among
other things, who is permitted access
and what steps should be followed prior
to removal.
iii. Distribution (§ 820.160)
176. A few comments on proposed
§ 820.124 Distribution stated that there
are times when ‘‘first in, first out’’
inventory procedures may not be in the
best interest of the customer. The
comments said that especially when
expiration dating is defined and labeled,
a ‘‘first in, first out’’ system should not
be required. The GHTF and other EU
comments stated that if a new section
‘‘Contract review,’’ similar to ISO
9001:1994, section 4.3 was not added to
the regulation, the requirement that
‘‘purchase orders are reviewed to ensure
that ambiguities and errors are resolved
before devices are released for
distribution’’ should be added to this
section.
FDA agrees with the comments. FDA
has amended the requirement in
§ 820.160 to state that the procedures
must ensure that ‘‘expired devices or
devices deteriorated beyond acceptable
fitness for use’’ are not distributed. FDA
has also added the sentence on
reviewing purchase orders.
177. A few comments on proposed
§ 820.124(b) stated that class I devices
should be exempt, or that the
requirement should apply only to
critical devices, because all devices do
not require control numbers. Other
comments stated that the term
‘‘consignee’’ should be defined, or the
word ‘‘primary’’ should be added before
‘‘consignee’’ for clarity.
FDA agrees in part with the comments
and in § 820.160(b) has added the term
‘‘initial’’ before ‘‘consignee’’ to make
clear that the requirement for
maintaining distribution records
extends to the first consignee. FDA has
retained the word ‘‘consignee’’ and
notes that it is a person to whom the
goods are delivered. FDA has also
clarified § 820.160(b)(4) by requiring
‘‘Any control number(s) used.’’
Therefore, if the manufacturer is
required by § 820.65 to have control
numbers, these must be recorded along
with any control numbers voluntarily
used. Logically, control numbers are
used for traceability so they should be
recorded in the DHR distribution
records. FDA disagrees, however, that
the requirement to maintain distribution
records should not apply to class I
devices. The information required by
this section is basic information needed
for any class of product in order to
conduct recalls or other corrective
actions when necessary.
iv. Installation (§ 820.170)
178. Several comments received on
proposed § 820.126, Installation stated
that not all devices require installation.
Several comments on the Working Draft
asked that, ‘‘The results of the
installation inspection shall be made
available to FDA upon request’’ be
deleted because this was redundant
with FDA’s access to these documents
under § 820.180.
FDA agrees with the first set of
comments. As discussed in § 820.1, the
installation requirements only apply to
devices that are capable of being
installed. However, to further clarify the
requirements in § 820.170, FDA has
made clear that the requirement applies
to ‘‘devices requiring installation.’’ FDA
also agrees that the sentence on
document availability is redundant with
§ 820.180 for all records and has deleted
the sentence.
179. Several comments raised the
issue of applying the regulation
requirements to third party installers.
FDA has rewritten § 820.170. Persons
who install medical devices have been
regulated under the original CGMP
under § 820.3(k) which describes a
manufacturer as one who ‘‘assembles or
processes a finished medical device,’’
and continue to be regulated under this
quality system regulation under
§ 820.3(o). Section 820.152 Installation
of the original CGMP discussed the
manufacturer or its authorized
representative and persons other than
the manufacturer’s representative. This
regulation eliminates that terminology.
Under the revised requirement in
§ 820.170(a), the manufacturer
establishes installation and inspection
instructions, and where appropriate test
procedures. The manufacturer
distributes the instructions and
procedures with the device or makes
them available to person(s) installing
the device. Section 820.170(b) requires
that the person(s) installing the device
follow the instructions and procedures
described in § 820.170(a) and document
the activities described in the
procedures and instructions to
demonstrate proper installation.
The revised provisions in § 820.170(b)
explicitly require that the installation be
performed according to the
manufacturer’s instructions, regardless
of whether the installer is employed by
or otherwise affiliated with the
manufacturer. Section 820.170(b)
requires records to be kept by whomever
performs the installation to establish
that the installation was performed
according to the procedures. Such
records will be available for FDA
inspection. FDA does not expect the
manufacturer of the finished device to
maintain records of installation
performed by those installers not
affiliated with the manufacturer, but
does expect the third party installer or
the user of the device to maintain such
records.
FDA believes that making these
requirements explicit in the regulation
is necessary to ensure that devices are
safe and effective, and that they perform
as intended after installation. FDA notes
52637Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
again that installers are considered to be
manufacturers under the original CGMP
regulation and that their records are,
and will continue to be, subject to FDA
inspections when the agency deems it
necessary to review such records.
M. Records (Subpart M)
i. General Requirements (§ 820.180)
180. Several comments under
§ 820.180 General requirements
suggested that FDA delete the
requirement that records be stored to
allow ‘‘rapid retrieval’’ because a
reasonable time frame should be
allowed. One comment stated that the
wording of the section needed to be
amended to allow records to be located
in different places, especially for foreign
manufacturers and distributors. Two
comments stated that the requirement
should be qualified by ‘‘subject to
conflicting legal requirements in other
countries’’ because some countries have
‘‘blocking statutes’’ that would prohibit
the release of some information. One
comment stated that wherever the word
‘‘all’’ appeared in the requirements,
FDA should remove it.
FDA has rearranged this section, and
notes that records must be kept in a
location that is ‘‘reasonably accessible’’
to both the manufacturer and FDA
investigators, and that records must be
made ‘‘readily available.’’ FDA expects
that such records will be made available
during the course of an inspection. If the
foreign manufacturer maintains records
at remote locations, such records would
be expected to be produced by the next
working day or 2, at the latest. FDA has
clarified that records can be kept at
other than the inspected establishment,
provided that they are made ‘‘readily
available’’ for review and copying. This
should provide foreign manufacturers
and initial distributors the necessary
flexibility.
FDA has not qualified § 820.180 in
response to the comments on the
‘‘blocking statues’’ because if
manufacturers want to import medical
devices into the United States, then they
must comply with applicable statutory
and regulatory requirements, including
part 820. The records section of this
regulation is essentially the same as that
of the original CGMP and FDA has not
found these ‘‘blocking statutes’’ to
present a problem. Further, countries
increasingly realize the importance of a
global market, thus FDA does not
anticipate this issue to be a problem in
the future.
In response to the comment on the
term ‘‘all’’, FDA notes that where a
requirement exists for ensuring that
records are maintained in a certain
fashion, a manufacturer must keep all
records subject to the regulation in that
manner. The revised section makes clear
that it is ‘‘all records required’’ by the
regulation to which the section’s
requirements pertain.
181. A few comments on § 820.180(b),
‘‘Record retention period,’’ stated that
the section should be amended because
all quality records may not be tied to a
specific device; therefore, such quality
records may not need to be maintained
over the lifetime of a device. A few
comments stated that the retention
period requirement is unclear and
burdensome, while others stated that
the period should be left to the
manufacturer to define. One comment
suggested the deletion of the
requirements related to photocopying
records in proposed § 820.180(b)
because it is technology that is not
necessarily being used.
FDA believes that all records should
be retained for a period equivalent to
the design and expected life of the
device, but in no case less than 2 years,
whether the records specifically pertain
to a particular device or not. The
requirement has been amended to make
clear that all records, including quality
records, are subject to the requirement.
FDA believes this is necessary because
manufacturers need all such records
when performing any type of
investigation. For example, it may be
very important to access the wording of
a complaint handling procedure at the
time a particular complaint came in
when investigating a trend or a problem
that extends to several products or over
an extended period of time. Further,
FDA does not believe that allowing the
manufacturer to define the retention
period will serve the public’s best
interest with regard to safety concerns
and hazard analysis.
In response to the comment on
photocopying, FDA has deleted the last
two sentences. The agency believes that
this requirement is outdated and does
not necessarily reflect the technology
being utilized today. Section 820.180
requires that records be readily available
for inspection and copying by FDA, and
FDA will interpret ‘‘copying’’ to include
the printing of computerized records, as
well as photocopying.
182. One comment on proposed
§ 820.180(c) stated that all quality audit
reports should be subject to FDA review
and public disclosure. A few other
comments stated that for a management
representative to certify that ‘‘corrective
action has been taken’’ would be
difficult because some corrective actions
are long term and may not be completed
at the time of certification.
FDA disagrees with the comment that
quality audit reports should be subject
to FDA review for the reasons given in
the preamble of the original CGMP
regulation, published in the Federal
Register on July 21, 1978 (43 FR 31508),
and believes that the disclosure of the
audit reports themselves would be
counterproductive to the intent of the
quality system. FDA has added
§ 820.180(c), ‘‘Exceptions,’’ to address
which records FDA, as a matter of
policy, will not request to review or
copy during a routine inspection; such
records include quality audit reports.
FDA may request an employee in
management with executive
responsibility to certify in writing that
the management reviews, quality audits,
and supplier audits (where conducted)
have been performed, among other
things. FDA may also seek production of
these reports in litigation under
applicable procedural rules or by
inspection warrant where access to the
records is authorized by statute. Again,
FDA emphasizes that its policy of
refraining from reviewing these reports
extends only to the specific reports, not
to the procedures required by the
sections or to any other quality
assurance records, which will be subject
to review and copying.
FDA agrees with the comments on the
timing of corrective actions and has
amended the certification requirement
to state ‘‘corrective action has been
undertaken.’’
ii. Device Master Record (DMR)
(§ 820.181)
183. A few comments on proposed
§ 820.181 Device master record stated
that the requirement for a ‘‘qualified’’
individual to prepare the DMR should
be deleted because it is unclear or
redundant with the requirements in
§ 820.25.
FDA has not deleted the requirement
for the DMR to be prepared, dated, and
approved by a qualified individual
because the agency believes this is
necessary to assure consistency and
continuity within the DMR. The section
is consistent with the original CGMP,
§ 820.181. FDA has, however,
substituted the phrase ‘‘prepared and
approved in accordance with § 820.40’’
to be consistent with the requirements
already in § 820.40 and to eliminate any
redundancy.
184. Two comments on § 820.181(a)
stated that ‘‘software design
specifications’’ should not be included
in the DMR because these documents
will be located in the DHF. Another
comment requested that the requirement
that the DMR contain ‘‘software source
code’’ information be amended because
52638 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
source codes for commercialized
software will not be available to the
device manufacturers. Another
comment stated that the source code
should not be in the DMR because it
will already be in the DHF.
FDA deleted the reference to
‘‘software source code’’ because this is
already covered with the requirement
for ‘‘software specifications.’’ The final
software specifications should be
transferred into production. Therefore,
the final software specification for the
particular device or type of device
should be located or referenced in the
DMR, while any earlier version should
be located or referenced in the DHF.
FDA believes that it is more important
for manufacturers to construct a
document structure that is workable and
traceable, than to worry about whether
something is contained in one file as
compared to another. The DMR is set up
to contain or reference the procedures
and specifications that are current on
the manufacturing floor. The DHF is
meant to be more of a historical file for
utilization during investigations and
continued design efforts.
185. One comment on § 820.181(c)
stated that the DMR should not contain
quality system documents, but rather
the quality control documents related to
the specific device. Three comments
stated that validation and verification
information belongs in the DHF, not the
DMR.
FDA agrees in part with the comments
and has revised the section to clarify
that the quality records required in the
DMR relate to the specific current
design, not the more general
requirements of the quality system,
which are addressed under new
§ 820.186. However, the comments are
incorrect that all validation and
verification information is related solely
to design. There are requirements for
validation and verification pertaining to
device processing that may be better
kept in the DMR instead of the DHF.
The documentation of such verification
and validation activities relating to
processes that are performed for several
different devices or types of devices can
be placed or referenced in the location
that best suits the manufacturer. Again,
it is more important that the
manufacturer store and retrieve
information in a workable manner, than
keep such information in particular
files.
186. FDA notes that the regulation
contains a few requirements which
apply ‘‘where appropriate’’ or ‘‘at
appropriate stages.’’ FDA emphasizes
that the procedures that the
manufacturer places in the DMR must
clearly define the requirements the
manufacturer is following and when
particular activities are appropriate. The
manufacturer will have failed to comply
with the requirements of the section if
the procedures simply state that the
review or activity occurs at ‘‘appropriate
stages.’’
The same principle applies for every
section of this regulation, which is
written to be flexible enough to cover
the manufacture of all types of devices.
Manufacturers must adopt quality
systems appropriate for their specific
products and processes. In establishing
these procedures, FDA will expect
manufacturers to be able to provide
justifications for the decisions reached.
iii. Device History Record (§ 820.184)
187. One comment on § 820.184
stated that labeling should not be
required in the DHR because it is
already required in the DMR. Another
comment stated that some devices have
25 or more labels and that only the
primary identification labels are
necessary in the DHR. One comment
stated the requirement should be
amended because it explicitly requires
that dates and quantities for each batch
be in the DHR, while only implying
through the general requirement that the
DHR must also contain the batch test
data.
FDA agrees that it may not be
necessary to include all labeling used in
the DHR. However, FDA continues to
believe, as it explained in the preamble
to proposed regulation published in the
Federal Register on November 23, 1993
(58 FR 61952 at 61968), that increased
control over labeling is necessary due to
the many labeling errors resulting in
recalls. Therefore, FDA has retained a
requirement related to labeling in the
DHR, but revised it to make it less
burdensome. The requirement was
amended to ‘‘the primary identification
label and labeling’’ which is consistent
with that contained in the original
CGMP regulation, § 820.185. FDA
believes that the requirement that the
DHR contain the primary label and
labeling used for each production unit,
coupled with the labeling controls in
§ 820.120, should help to ensure that
proper labeling is used and, hopefully,
decrease the number of recalls due to
improper labeling.
FDA agrees with the last comment
and has added in § 820.184 ‘‘(d) The
acceptance records which demonstrate
the device is manufactured in
accordance with the DMR’’ to explicitly
state the requirement to avoid any
confusion.
188. FDA has deleted the requirement
for the DHR to be ‘‘readily accessible
and maintained by a designated
individual(s)’’ because it believes that
the objective of that requirement is met
through §§ 820.40 Document controls
and 820.180 General requirements.
FDA has also added ‘‘device
identification’’ to the requirement under
§ 820.184(f) because it believes that any
identification or control number used
should be documented in the DHR to
facilitate investigations, as well as
corrective and preventive actions. FDA
notes that this provision does not add
any requirement for identification or
traceability not already expressed in
§§ 820.60 and 820.65.
iv. Quality System Record (§ 820.186)
189. Several comments stated that the
regulation should more closely
harmonize with ISO 9001:1994. A few
comments stated that the regulation
should include the requirements for a
quality manual. One comment stated
that general quality system procedures
and instructions should not be required
in the DMR because the DMR is device
specific, and many quality system
procedures are not tied to a particular
device.
FDA agrees in part with these
comments and has developed new
§ 820.186 Quality system record. This
section separates the procedures and
documentation of activities that are not
specific to a particular type of device
from the device specific records.
v. Complaint Files (§ 820.198)
190. Two comments on proposed
§ 820.198 Complaint files stated that the
requirements were very detailed and
that much of the language should be
placed in a guidance document.
FDA disagrees with the comments.
These requirements are essentially the
same as the original CGMP requirements
under § 820.198, and 18 years of
experience with these requirements
shows that many manufacturers still do
not understand and properly handle
complaints. Therefore, FDA believes
that the amount of detail in § 820.198 is
appropriate and necessary. In an effort
to make the requirements more clear,
however, the section has been
reorganized to better illustrate how
complaint information should be
handled.
Section 820.198(a) sets forth the
general requirement for establishing and
maintaining a complaint handling
procedure and includes a few items that
the procedure needs to address. Section
820.198(b) discusses the initial review
and evaluation of the complaints in
order to determine if complaints are
‘‘valid.’’ It is important to note that this
evaluation is not the same as a
complaint investigation. The evaluation
52639Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
is performed to determine whether the
information is truly a complaint or not
and to determine whether the complaint
needs to be investigated or not. If the
evaluation decision is not to investigate,
the justification must be recorded.
Section 820.198(c) then describes one
subset of complaints that must be
investigated, but explains that
duplicative investigations are not
necessary. In cases where an
investigation would be duplicative, a
reference to the original investigation is
an acceptable justification for not
conducting a second investigation.
Section 820.198(d) describes another
subset of complaints that must be
investigated (those that meet the MDR
criteria) and the information that is
necessary in the record of investigation
of those types of complaints. Section
820.198(e) sets out the type of
information that must be recorded
whenever complaints are investigated.
The information described in § 820.198
(e)(1) through (e)(5) would most likely
be attained earlier in order to perform
the evaluation in § 820.198(b). This
information need not be duplicated in
the investigation report as long as the
complaint and investigation report can
be properly identified and tied together.
Section 820.198 (e)(1) through (e)(5) are
considered to be basic information
essential to any complaint investigation.
If there is some reason that the
information described in § 820.198(e)
cannot be obtained, then the
manufacturer should document the
situation and explain the efforts made to
ascertain the information. This will be
considered to be acceptable as long as
a reasonable and good faith effort was
made. For example, a single phone call
to a hospital would not be considered
by FDA to be a reasonable, good faith
effort to obtain information. Section
820.198(f) is the same as § 820.198(d) of
the original CGMP, where the
manufacturing facility is separate or
different from that of the formally
designated complaint handling unit. In
such cases, it is important that the
facility involved in the manufacturing of
the device receive or have access to
complaint and investigation
information. In order to give
manufacturers the flexibility of using
computer or automated data processing
systems, the term ‘‘reasonably
accessible,’’ from § 820.180, is used.
Section 820.198(g) is the complaint
recordkeeping requirement for
distributors. In order to give
manufacturers the same flexibility as
described in § 820.198(f), FDA has
included ‘‘reasonably accessible’’ in
§ 820.198(g).
Throughout § 820.198, when there is
reference to the MDR regulation or to
the types of events that are reportable
under the MDR regulation, this section
simply refers to events or complaints
that ‘‘represent an event which is
required to be reported to FDA under
part 803 or 804 of this chapter.’’
191. A few comments on § 820.198(a)
stated that the section should allow for
more than one ‘‘formally designated
unit’’ to handle complaints, especially
for large corporations where it would
not be feasible or beneficial for all
divisions to have a single complaint
handling unit. A few other comments
stated that § 820.198(a)(2) on oral
complaints should be deleted because it
is too subjective.
FDA disagrees with these comments.
Large corporations may have different
complaint handling units for different
product types or different
manufacturing establishments.
However, there should be only one
formally designated complaint handling
unit for each product type or
establishment. If a corporation chooses
to operate with different complaint
handling units for products and/or
establishments, the manufacturer must
clearly describe and define its corporate
complaint handling procedure to ensure
consistency throughout the different
complaint handling units. A system that
would allow multiple interpretations of
handling, evaluating, categorizing,
investigating, and following up, would
be unacceptable. Each manufacturer
should establish in its procedures which
one group or unit is ultimately
responsible for coordinating all
complaint handling functions.
FDA also disagrees that the
requirement that oral complaints be
documented upon receipt should be
deleted. A December 1986 General
Accounting Office (GAO) report entitled
‘‘Medical Devices; Early Warning of
Problems Is Hampered by Severe
Underreporting,’’ (Ref. 11) showed that
approximately 83 percent of the
hospitals report complaints orally. FDA
believes that these oral complaints must
be captured in the complaint handling
process.
192. FDA, as noted above, has added
to § 820.198(c) the phrase ‘‘unless such
investigation has already been
performed for a similar complaint and
another investigation is not necessary’’
to clarify that duplicative investigations
are not required if the manufacturer can
show that the same type of failure or
nonconformity has already been
investigated.
193. Several comments on proposed
§ 820.198(b), now § 820.198(d), stated
that the evaluation of complaints
pertaining to death, injury, or hazard to
health should be removed from this
section because it is redundant with the
MDR regulation. Several other
comments on § 820.198(b) stated that
complaints pertaining to death, injury,
or hazard to health need not be
maintained separately, as long as they
are identified.
FDA disagrees that the requirements
are redundant, but believes that they
expressly state what is expected in the
handling of this type of complaint
information. The requirements have
been moved to a separate section,
§ 820.198(d).
FDA agrees with the second set of
comments and has revised the section to
permit such complaints to be ‘‘clearly
identified.’’ This will give a
manufacturer flexibility in choosing a
means of ensuring that these types of
complaints can be immediately
recognized and segregated for purposes
of prioritizing and meeting other
requirements.
FDA has substituted the term
‘‘promptly’’ for the term ‘‘immediately’’
to be more consistent with the new
MDR regulation timeframes. FDA has
also clarified that § 820.198 (d)(1)
through (d)(3) are in addition to the
information that must be recorded in
§ 820.198(e).
194. A few comments on proposed
§ 820.198 (c) and (d) stated that FDA
should make clear that some of the
requirements will not always be
applicable. For example, the comments
stated that a record of corrective action
cannot be made if such action is not
required, and is not taken.
Where corrective action is not
necessary and is not taken, it cannot be
documented. The section was revised to
make that clear. As stated in the
preamble to the proposal (58 FR 61952
at 61968), the manufacturer’s
procedures should clearly identify when
corrective action will be taken.
In addition, FDA combined
provisions in § 820.198 (c) through (e) to
eliminate redundancy and added the
requirement that the records include
any device identification, as well as
control number used, to facilitate
corrective and preventive actions. FDA
has also deleted the term ‘‘written’’ in
§ 820.198(e) to be consistent with FDA’s
statements on electronic and computer
systems.
195. FDA deleted the requirements in
proposed § 820.198(f) in response to
comments because it agrees that it is not
necessary to repeat the requirements of
the MDR regulation in the quality
system regulation. Section 820.198(a)
requires that all complaints be evaluated
to determine whether they are subject to
52640 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
the requirements of the MDR regulation
under part 803 or 804.
196. A few comments on proposed
§ 820.198(g), now § 820.198(f), stated
that duplicate records are not needed in
this age of computer systems, and that
the requirement as written would be
counterproductive.
FDA agrees with the comments and
has rewritten the section to allow the
complaints and records of investigation
to be reasonably accessible at the
formally designated complaint unit and
the manufacturing site, where these
locations are distinct. A manufacturer’s
procedures must ensure that the
manufacturing site is alerted to
complaints concerning devices
produced at that site.
197. Several comments on proposed
§ 820.198(h), now § 820.198(g), stated
that the requirement is unnecessary,
given that FDA can inspect a foreign
manufacturer that imports devices, and
is burdensome.
FDA has revised the section to permit
the records to be reasonably accessible,
similar to § 820.198(f), which should
alleviate any burden. However, the
agency must have access to these
records in the United States.
198. Several comments on proposed
§ 820.198 (i) and (j) stated that the
requirements should be deleted because
they are redundant with the MDR
requirements in part 803.
FDA disagrees that all of the
requirements in § 820.198 (i) and (j) are
redundant. The requirement that
procedures ensure that complaints are
processed uniformly and in a timely
manner, and evaluated to determine
whether they are reportable under part
803 or 804, has been moved up to
§ 820.198(a). These are basic
requirements for complaint handling. If
the complaint is determined to be of the
type subject to part 803 or 804, those
requirements apply. The requirements
of parts 803 and 804 are not repeated in
this regulation. FDA has deleted
§ 820.198(j).
N. Servicing (Subpart N)
199. Numerous comments were
received on the servicing requirements
that were proposed. Many of these
comments dealt with competitive issues
between manufacturers that perform or
contract out their own servicing and
third party service organizations. The
comments received, as well as the
recommendations from the GMP
Advisory Committee, were split on
many issues. Therefore in this
regulation, FDA has chosen to codify
only longstanding requirements for
servicing performed by original
manufacturers and remanufacturers.
The requirements in § 820.200 are
similar to those in ISO 9001:1994, with
some supplemental requirements for
clarification on monitoring service
reports, on the relationship of service
reports and complaints, and on the type
of information FDA believes is essential
in any service report. As described
above in the definition section of this
preamble, a separate rulemaking will
specify and clarify the requirements for
third party service organizations.
200. Other comments on proposed
§ 820.200(a) stated that it is impractical
to return a used device to its original
specifications because a certain amount
of wear and tear should be expected,
without detriment to the safety and
effectiveness of the device. Several
comments on § 820.200(a) stated that
the term ‘‘records’’ should be replaced
by ‘‘reports,’’ to be consistent with ISO
9001.
FDA agrees and has revised the
requirements in § 820.200(a) to be
similar to the requirements in ISO
9001:1994 as recommended by
comments at the GMP Advisory
Committee meeting to require that the
servicing instructions and procedures
ensure that the device will meet
‘‘specified requirements’’ for the
device’s intended use. FDA is aware
that with use and age, a device may be
serviced to function as intended, but
may not meet original specifications.
FDA agrees with the comments and
has modified the language in
§ 820.200(b), (c), and (d) to use the term
‘‘service reports.’’
201. A few comments on proposed
§ 820.200(b), ‘‘Service report
evaluation,’’ questioned whether full
corrective action was necessary for
every service report and whether service
calls need to be handled as complaints
only when there is a death, injury, or
hazard to safety.
FDA has rewritten this section into
§ 820.200(b) and (c) to clarify the
agency’s intent and to use terms
consistent with those used in § 820.198.
Section 820.200(b) now states that
‘‘Each manufacturer shall analyze
service reports with appropriate
statistical methodology in accordance
with § 820.100.’’ Full corrective action
may not be required for every service
report. However, if the analysis of a
service report indicates a high risk to
health, or that the frequency of servicing
is higher than expected, the remainder
of the corrective and preventive action
elements are applicable, in accordance
with the corrective and preventive
action procedures established under
§ 820.100.
Section 820.200(c) provides that when
a service report ‘‘represents an event
which must be reported to FDA under
part 803 or 804 of this chapter,’’ it is
automatically considered by FDA to be
a complaint that must be handled
according to § 820.198. FDA emphasizes
that this provision is not intended to
limit ‘‘complaints’’ to MDR reportable
events.
202. FDA has also added in
§ 820.200(d) the requirements for
recording the name of the device, any
device identification(s) and control
number(s) used, as well as test and
inspection data, because FDA believes
such documentation in the service
report will facilitate investigations. This
additional documentation provision
does not add any requirement for
identification or traceability not already
expressed in §§ 820.60 and 820.65.
Therefore, § 820.200(d) as amended
focuses on the type of information that
should be captured on the service report
instead of where the information should
be sent.
O. Statistical Techniques (Subpart O)
203. FDA amended § 820.250(a) to be
consistent with the requirements in ISO
9001:1994, section 4.20.
204. Several comments on
§ 820.250(b) stated that the provision as
written seems to require the use of
sampling plans, and that every
manufacturer does not necessarily use
sampling plans. Another comment
stated that sampling plans are not often
used during reviews of nonconformities,
quality audits, or complaints, and that
these examples should, therefore, be
deleted. Two other comments
questioned the meaning of ‘‘regularly
reviewed.’’
FDA’s intent was not to require the
use of sampling plans, but to require
that where they are used, they should be
written and valid. Section 820.250 was
revised to make that clear. Sampling
plans are not always required, but any
time sampling plans are used, they must
be based on a valid statistical rationale.
Further, FDA acknowledges that the
most common use of sampling plans is
during receiving acceptance, and has
deleted the examples. FDA has also
clarified the review requirement by
stating ‘‘to ensure that when changes
occur the sampling plans are reviewed.’’
VI. Summary of Changes From the July
1995 Working Draft to the Final Rule
and Rationale
Note: Minor changes to improve grammar,
readability, and clarity, as well as changes in
terminology and organization for the sake of
consistency throughout the regulation, are
not listed.
52641Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
A. Section 820.1 Scope
1. Inserted sentence, ‘‘If a
manufacturer engages in only some
operations subject to the requirements
in this part, and not in others, that
manufacturer need only comply with
those requirements applicable to the
operations in which it is engaged’’ for
further clarification of the scope in
response to many comments.
2. Amended sentence on component
manufacturers to read, ‘‘This regulation
does not apply to manufacturers of
components or parts of finished devices,
but such manufacturers are encouraged
to use appropriate provisions of this
regulation as guidance’’ as a result of the
many written comments and oral
testimony at the August and September
1995 meetings.
3. Inserted sentence on how to
interpret the phrase ‘‘where
appropriate’’ in the regulation, as
recommended by the GMP Advisory
Committee. This sentence is consistent
with International Organization for
Standards (ISO)/CD 13485—
‘‘Application of Quality Systems to
Medical Devices.’’
B. Section 820.3 Definitions
4. Amended the definition of
Complaint by inserting ‘‘after it is
released for distribution’’ in response to
comments for clarification and to
harmonize with ISO/CD 13485.
5. Amended the definition of
Component by deleting ‘‘packaging’’ for
clarification that every piece of
packaging is not necessarily a
component, only the materials that are
part of the ‘‘finished, packaged, and
labeled device.’’
6. Amended the definition of Design
output to clarify its relationship with
the Device Master Record.
7. Amended the definition of Design
review to delete ‘‘and propose the
development of solutions’’ in order to
allow the manufacturer the flexibility to
determine whom the appropriate
person(s) is to propose solutions.
8. Deleted the definition of End of life
in response to the many written
comments and oral testimony at the
August and September 1995 meetings.
9. Amended the definition of
Manufacturer to delete component
manufacturers and to remove the terms
‘‘servicer’’ and ‘‘refurbisher.’’ The
obligations of servicers and refurbishers
will be addressed in a separate
rulemaking later this year. The terms
‘‘installation’’ and ‘‘remanufacturing’’
were added to codify longstanding FDA
policy and interpretations of the original
CGMP regulation.
10. Amended the definition of
Manufacturing material in response to
comments requesting clarification and
separation of examples.
11. Deleted the definition of Record to
avoid confusion. Record will continue
to be defined by the act and case law.
12. Removed the definition of
Refurbisher for reasons discussed in
paragraph 28, section V.A. of this
document.
13. Inserted the definition of
Remanufacturer for reasons discussed
in paragraph 28, section V.A. of this
document, and made the language
consistent with that of the 510(k)
provision and the PMA amendment/
supplement requirements.
14. Changed the term Reprocessing to
Rework and adopted a definition
consistent with ISO 8402 Quality
Management and Assurance Vocabulary
Standard in response to comments for
closer harmonization of terminology.
15. Removed the definition of
Servicing, and Servicer which was
proposed to the GMP Advisory
Committee, for reasons discussed above.
16. Amended the definition of
Validation as recommended by the GMP
Advisory Committee for further clarity
by delineating the terms validation,
process validation, and design
validation.
17. Amended the definition of
Verification for further clarity in
response to comments and to more
closely harmonize with ISO 8402.
C. Section 820.5 Quality System
18. Deleted the requirements in
§ 820.5(a) and (b) because these
requirements are now found in § 820.20.
D. Section 820.20 Management
Responsibility
19. Moved the requirements from
§ 820.186 and rewrote into new
§ 820.20(d) and (e) for clarity, better
organization, and closer harmonization
with ISO/CD 13485.
E. Section 820.25 Personnel
20. Inserted the phrase, ‘‘establish
procedures for identifying training
needs’’ in § 820.25(b) in response to
comments to add this requirement and
to harmonize with the requirement in
ISO/CD 13485.
21. Deleted the sentence in § 820.25
on understanding the ‘‘CGMP
requirements applicable to their job
function’’ to provide manufacturers
with the flexibility to appropriately
train personnel.
F. Section 820.30 Design Controls
22. Amended the requirements in
Design and development planning for
clarity and to more closely harmonize
with ISO/CD 13485.
23. In § 820.30(c), inserted the
sentence, ‘‘The procedures shall include
a mechanism for addressing incomplete,
ambiguous, or conflicting requirements’’
in response to comments to add this
requirement and to harmonize with the
requirement in ISO/CD 13485.
24. In § 820.30(d), deleted the
sentence, ‘‘Design output procedures
shall ensure that design output meets
the design input requirements’’ because
this was redundant with the
requirement in § 820.30(f) Design
verification.
25. Amended § 820.30(e) Design
review to clarify that the procedures
shall ensure that an independent person
is included in design reviews.
26. Section 820.30(f) Design
verification and validation was split
into two paragraphs, (f) Design
verification and (g) Design validation
and the requirements were separated
between the two paragraphs, in
response to many written comments and
oral testimony at the August and
September 1995 meetings and to
improve clarity and consistency with
ISO/CD 13485.
27. Amended the requirement for
§ 820.30(i) Design changes to add the
phrase ‘‘before their implementation’’
due to an inadvertent omission in the
July 1995 Working Draft.
G. Section 820.50 Purchasing Controls
28. Deleted the last two sentences in
§ 820.50(b) and inserted ‘‘Purchasing
data shall be approved in accordance
with § 820.40’’ because the last two
sentences were redundant with the
requirements in § 820.40.
H. Section 820.65 Traceability
29. Substituted the definition of
critical device from the original CGMP
for the phrase ‘‘where necessary to
ensure the protection of the public
health,’’ in response to many comments
requesting clarification as to when
traceability is necessary.
30. Added ‘‘where appropriate’’ for
the traceability of components in
response to the recommendation of the
GMP Advisory Committee, the written
comments, and to harmonize with ISO/
CD 13485.
I. Section 820.70 Production and
Process Controls
31. Inserted ‘‘identified and
approved’’ in § 820.70(a)(5) before
‘‘representative samples’’ to clarify that
the samples have to be established and
deemed appropriate before they are
used as a standard.
32. Substituted in § 820.70(b) ‘‘where
appropriate validated according to
§ 820.75’’ for ‘‘unless inspection and test
52642 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
fully verifies the results of the changes’’
because it was redundant with the
requirements set forth in § 820.75.
33. Amended the requirement in
§ 820.70(c) to apply only ‘‘Where
environmental conditions could
reasonably be expected to have an
adverse effect on product quality,’’ in
response to comments and to be
consistent with the original CGMP
requirements.
34. Amended the requirements in
§ 820.70(d) and (e) to include ‘‘could
reasonably be expected to have an
adverse effect on product quality’’ to
consistently qualify when these
provisions are appropriate.
35. Amended the requirement in
§ 820.70(h) to apply only ‘‘Where a
manufacturing material could
reasonably be expected to have an
adverse effect on product quality,’’ in
response to comments and to be
consistent with the original CGMP
requirements.
36. Rearranged the wording in
§ 820.70(i) to clarify ‘‘automated data
processing systems.’’
J. Section 820.72 Inspection,
Measuring, and Test Equipment
37. Renumbered § 820.84 as § 820.72
for better organization because
Inspection, measuring, and test
equipment requirements are more
appropriate under Subpart G—
Production and Process Controls than
under Subpart H—Acceptance
Activities.
38. Section 820.72(b) ‘‘Calibration
standards’’ and (c) ‘‘Calibration records’’
were reorganized as paragraphs(1) and
(2), respectively under paragraph (b)
‘‘Calibration.’’
39. Amended § 820.72(b) to include
provisions for remedial action to
‘‘reestablish the limits and to evaluate
whether there was any adverse effect on
the device’s quality’’ in response to
comments which questioned whether
this was adequately covered under
§ 820.100.
40. Section 820.84(d), ‘‘Maintenance,’’
is reorganized into § 820.72(a) ‘‘Control
of inspection, measuring, and test
equipment’’ and ‘‘test software’’ is
deleted because it is considered to be
covered under ‘‘electronic inspection
and test equipment’’ in the general
requirement.
K. Section 820.75 Process Validation
41. Section 820.75(a) is amended for
clarity. The phrase ‘‘with a high degree
of assurance’’ was deleted from the
definition of ‘‘Validation’’ and added as
a requirement under process validation.
42. Section 820.75(b)(2) was amended
to state ‘‘where appropriate, the
individual(s) performing the process or
the major equipment used’’ in response
to comments requesting that flexibility
be given to the manufacturer to
determine when these items needed to
be documented.
43. Section 820.75 (c) and (d) were
redesignated as paragraphs (b)(1) and
(b)(2) for better organization and flow.
44. Section 820.75(c) was added to
address comments and concerns on
when revalidation activities were
necessary.
L. Section 820.80 Receiving, In-
process, and Finished Device
Acceptance
45. Section 820.80(c) was amended to
add ‘‘where appropriate’’ to reinforce
the discussion in the preamble that in-
process testing is not always necessary
depending upon the type of device and
the manufacturing set-up.
M. Section 820.90 Nonconforming
Product
46. Amended the requirement in
§ 820.90(a) to include, ‘‘The evaluation
of nonconformance shall include a
determination of the need for an
investigation * * *. The evaluation
and any investigation shall be
documented.’’ in response to many
written comments and oral testimony at
the August and September 1995
meetings on whether every
nonconformance had to be investigated.
47. Amended the requirement in
§ 820.90(b)(1) to read, ‘‘Documentation
shall include the justification for use of
nonconforming product’’ in response to
several comments confused about the
meaning of the term ‘‘concession.’’
48. In § 820.90(b)(2), substituted the
term ‘‘rework’’ for the term
‘‘reprocessing’’ for reasons described in
the definitions section.
49. Deleted the sentence,
‘‘Reprocessed product shall be clearly
identified during reprocessing, and shall
be subjected to reevaluation’’ in
§ 820.90(b)(2) because the requirement
was redundant with the requirements in
§§ 820.60 Identification and 820.86
Acceptance status.
N. Section 820.100 Corrective and
Preventive Action
50. Amended § 820.100(a)(7) to clarify
what information is to be submitted to
management for review.
O. Section 820.120 Device Labeling
51. Inserted ‘‘where appropriate’’
before ‘‘use’’ in § 820.120(a) because
every device may not have a label
directly affixed to the device itself (e.g.
implantable devices).
52. Inserted the sentence, ‘‘The label
and labeling used for each production
unit, lot, or batch shall be documented
in the DHR’’ into § 820.120(d) in
response to comments questioning
whether the labeling used should be
recorded in the device master record or
the device history record.
P. Section 820.160 Distribution
53. Inserted the requirement in
§ 820.160 ‘‘that purchase orders are
reviewed to ensure that ambiguities and
errors are resolved before devices are
released for distribution’’ in response to
the GHTF comments and other EU
comments that the regulation did not
address the requirements in ISO 9001,
section 4.3, ‘‘Contract Review.’’
Q. Section 820.170 Installation
54. Amended the installation
requirements for clarity and deleted the
last sentence in § 820.170(b), ‘‘The
results of the installation inspection
shall be made available to FDA upon
request’’ because this sentence is
redundant with the requirements in
§ 820.180 for all records.
R. Section 820.181 Device Master
Record (DMR)
55. In § 820.181 deleted the phrase
‘‘dated, and signature of the qualified
individual(s) designated by the
manufacturer’’ and inserted ‘‘and
approved in accordance with § 820.40’’
to be consistent with the requirements
already in § 820.40.
56. In § 820.181 deleted the phrase
‘‘and software source code for
customized software’’ because
comments stated that this was already
covered with the requirement for
‘‘software specifications.’’
S. Section 820.186 Quality System
Record (QSR)
57. Amended the requirement in
§ 820.186 by adding the sentence,
The QSR shall include, or refer to the
location of, procedures and the
documentation of activities required by this
part that are not specific to a particular type
of device(s), including but not limited to the
records required by § 820.20. Each
manufacturer shall ensure that the QSR is
prepared and approved in accordance with
§ 820.40.
Deleted the requirements in § 820.186(a)
through (d) because those requirements
are now found in § 820.20. This change
was in response to comments and
suggestions made by the GHTF for
further harmonization with ISO/CD
13485 and for clarity.
T. Section 820.198 Complaint Files
58. In § 820.198 deleted the
terminology ‘‘pertaining to death,
52643Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
injury, or any hazard to safety’’
throughout this section and inserted ‘‘an
event which must be reported to the
FDA under part 803 or 804 of this
chapter’’ to reference the MDR
regulation.
59. Added the phrase ‘‘unless such
investigation has already been
performed for a similar complaint and
another investigation is not necessary’’
in § 820.198(c) in response to comments
which thought a second investigation
was always mandated by this
requirement.
60. Amended § 820.198(d) by
changing the word ‘‘immediately’’ to
‘‘promptly’’ to be consistent with the
new MDR regulation. Added, ‘‘In
addition to the information required by
§ 820.198(e),’’ to clarify that an
investigation under § 820.198(d) was to
include requirements under paragraphs
(d)(1) through (d)(3) and under
paragraphs (e)(1) through (e)(8).
61. Substituted the phrase
‘‘reasonably accessible’’ for
‘‘concurrently maintained’’ in § 820.198
(f) and (g) as recommended by the GMP
Advisory Committee to clarify FDA’s
intent of allowing these records to be
available in other media forms besides
the hard copies which were previously
required.
U. Section 820.200 Servicing
62. Amended § 820.200(a) to adopt
language consistent with ISO/CD 13485,
which was suggested at the GMP
Advisory Committee meeting, in order
to clarify the requirement and further
harmonize.
63. Deleted the last two sentences in
§ 820.200(a) on providing information to
third party servicers since this industry
will be addressed in a separate
rulemaking, as discussed above.
64. Section 820.200(d) was amended
for clarity and to focus on the service
report and what type of information
should be captured on the report instead
of where the information should be sent.
V. Section 820.250 Statistical
Techniques
65. Amended § 820.250(b) by
inserting the phrase, ‘‘to ensure that
when changes occur the sampling plans
are reviewed’’ in response to comments
for clarification on when the plans
needed to be reviewed.
VII. Environmental Impact
The agency has determined under 21
CFR 25.24(a)(8) and (a)(10) that this
action is of a type that does not
individually or cumulatively have a
significant effect on the human
environment. Therefore, neither an
environmental assessment nor an
environmental impact statement is
required.
VIII. Intergovernmental Partnership
The agency has analyzed this
rulemaking in accordance with the
principles and criteria set forth in
Executive Order 12875, ‘‘Enhancing the
Intergovernmental Partnership’’ and in
the Unfunded Mandates Reform Act of
1995 (Pub. L. 104–4). Executive Order
12875 states that no agency or executive
department shall issue any regulation
that is not required by statute and that
creates a mandate upon a State, local, or
tribal government unless the Federal
Government supplies funds necessary to
comply with the mandate, or the agency
provides the Office of Management and
Budget (OMB) a description of the
agency’s consultation with affected
State, local, and tribal governments, the
nature of their concerns, any written
communications submitted to the
agency by such units of government,
and the agency’s position supporting the
need to issue the regulation containing
the mandate. Executive Order 12875
does not apply to this final rule because
the regulatory requirements are not
generally applicable to government
facilities but to finished device
manufacturers. The agency notes,
however, that the membership of the
advisory committee established to
review this regulation and make
recommendations to the agency on the
feasibility and reasonableness of the
regulation (GMP Advisory Committee)
must include three members who are
officers or employees of any State or
local government or of the Federal
Government, and that in 1995 this
committee included two State
government representatives and one
Federal Government representative.
The agency has also examined the
consistency of this final rule with the
Unfunded Mandates Reform Act of
1995. The Unfunded Mandates Reform
Act requires (in section 202) that
agencies prepare an assessment of
anticipated costs and benefits before
proposing any rule that may result in an
annual expenditure by State, local, and
tribal governments, in the aggregate, or
by the private sector, of $100 million
(adjusted annually for inflation). FDA
believes that the private sector
expenditures for this rule fall below
$100 million annually but nonetheless,
due to uncertainties of these estimates,
the agency has prepared for the private
sector an assessment of anticipated costs
and benefits for the 1993 proposed rule
and this final rule as described in
section IX. of this document.
IX. Economic Impact
A. Summary
FDA has examined the impacts of the
final rule under Executive Order 12866
and the Regulatory Flexibility Act (Pub.
L. 96–354). Executive Order 12866
directs agencies to assess all costs and
benefits of available regulatory
alternatives and, when regulation is
necessary, to select regulatory
approaches that maximize net benefits
(including potential economic,
environmental, public health and safety,
and other advantages; distributive
impacts; and equity). The agency
believes that this final rule is consistent
with the regulatory philosophy and
principles identified in the Executive
Order. As explained in detail below,
FDA finds that this final rule has an
estimated total annual incremental cost
of $81.9 million to the U.S. industry and
an estimated average annual benefit of
from $180 million to $220 million in
lives saved and is economically
significant under Executive Order
12866. Consequently, the agency has
completed this full regulatory flexibility
analysis which demonstrates that this
rule is consistent with the principles set
forth in the Executive Order and the
Regulatory Flexibility Act, and also with
the Unfunded Mandates Reform Act as
described in section VIII. of this
document. This analysis, together with
the preamble published in the Federal
Register and supporting analysis and
materials, constitutes a final regulatory
flexibility analysis. In addition, this
document has been reviewed by OMB as
an economically significant regulatory
action under Executive Order 12866.
The detailed data for this analysis
were developed by Eastern Research
Group, Inc. (ERG), under contract to
FDA and their two reports: ‘‘Economic
Analysis of the Proposed Revisions to
the Good Manufacturing Practices
Regulation for Medical Devices,’’ and
‘‘Addendum to the Final Report’’ are on
file at the Dockets Management Branch
(HFA–305), Food and Drug
Administration, 12420 Parklawn Dr.,
rm. 1–23, Rockville, MD 20857.
The objective of this rule is to reduce
the number of fatalities and injuries
attributable to defective medical
devices. FDA finds that private market
incentives do not adequately reduce the
risk of design-related device failures
because neither physicians nor
consumers have all of the information
needed to make adequate judgments of
product quality and legal tort remedies
are slow, inefficient, and extremely
costly.
The changes to the CGMP regulation
will require manufacturers to extend
52644 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
1 Fisher, A.; Chestnut, L.; and Violette, D. (1989).
‘‘The Value of Reducing Risks of Death: A Note on
New Evidence.’’ Journal of Policy Analysis and
Management, 8 (pp. 88–100).
2 Gilmartin, R.V. (1992). ‘‘The Benefits of
Cooperation for Industry and Regulators Alike: A
Global Perspective.’’ Presented at the Third Annual
Global Medical Device Conference, October 2.
their quality systems to include several
new areas, such as design and
purchasing, and to clarify or expand
selected existing requirements. Several
of the changes to the regulation make it
more consistent with ISO 9001:1994
quality standards. The rule will affect
all medical device establishments
engaged in the design, manufacture,
contract sterilization, and packaging of
medical devices.
This analysis presents the costs and
benefits of the final CGMP rule and
reflects the differences between the
proposed and final regulation. The
complete methodology and preliminary
economic analysis was presented in the
November 1993 ERG report, ‘‘Economic
Analysis of Proposed Revisions to the
Good Manufacturing Practices
Regulation for Medical Devices’’. While
the proposed rule covered component
manufacturers, the cost of compliance
for such manufacturers was
inadvertently omitted from the
November 1993 ERG report. However,
FDA has decided not to cover
component manufacturers, therefore
most of the preliminary analysis
remains valid (e.g., estimates of labor
and resource requirements, level of
compliance, and number of firms
remain the same for the final analysis,
except where noted).
Based on the ERG study, the total
annual incremental costs to the U.S.
industry of the final CGMP regulation
are estimated to be about $81.9 million.
These costs are more than offset,
however, by benefits to public health
and by economic benefits to the medical
device industry. FDA estimates that the
benefits to public health will include 36
to 44 fewer deaths and 484 to 677 fewer
serious injuries per year, which are
attributed to design-related device
failures. Studies on the value of a
statistical-life have reported estimates
ranging from $1.6 million to $8.5
million.1 Assuming an economic value
of $5 million per fatality avoided, the
monetary value of saving 36 to 44 lives
each year will be $180 to $220 million.
Therefore, the value of the public health
benefits of preventing deaths alone
easily exceeds the cost of compliance
even without estimating benefits from a
reduced number of serious injuries.
Moreover, additional economic benefits
to medical device establishments will
result from cost savings due to fewer
design-related product recalls, better
product quality, and greater
productivity. In addition, medical
device establishments exporting to the
EU will greatly benefit from the
harmonization of the CGMP regulation
with the ISO 9001:1994 quality
standards. Because the EU is adopting
ISO 9001:1994 as a basis for its medical
device manufacturing quality system,
the harmonization of the two quality
requirements will eliminate the need for
device manufacturers to maintain
different quality systems for each
market.
FDA supports the international
harmonization of standards and
regulations governing medical devices
and the eventual mutual recognition of
CGMP inspections between major
device markets. While full achievement
of this goal is still in the future, the
harmonization of quality standards is an
important first step.
FDA believes in a step wise approach
toward harmonization and eventual
mutual recognition. For CGMP
inspections or Quality System
Conformity Assessments, these goals
comprise four basic steps. First, the
harmonization of quality system
requirements is a fundamental building
block of all future work in this area.
FDA believes that by working with the
GHTF, specifically Study Group #3 of
the GHTF, it has developed a final rule
that incorporates the harmonized
quality system requirements which are
recognized around the world. Second is
the harmonization of regulatory auditing
or compliance inspections. This work is
currently underway in the GHTF in
Study Group #4, which has developed
one draft document entitled ‘‘Guidelines
For Regulatory Auditing Quality
Systems of Medical Device
Manufacturers,’’ expected to be
finalized in 1997. The third step is for
harmonization of the policy,
interpretation, and regulatory
consequences of noncompliance with
the quality system requirements in this
rule and in counterpart requirements of
other countries. Underlying these
activities is an ongoing need for
confidence building between the parties
working towards mutual recognition.
FDA believes that this regulation will
provide a sound foundation for the goal
of mutual recognition of inspections, a
goal that will benefit industry, as well
as the agency. The Health Industry
Manufacturers Association has stated
that reciprocity for quality assurance
inspections could save the medical
device industry millions of dollars as
well as provide significant savings to
governments.2
For individual establishments, the
economic impact of the regulation will
depend on a number of factors, such as
the level of current compliance, the type
of activities performed at the
establishment, and the nature of the
product. On average, the smaller
establishments will bear a relatively
greater economic burden.
B. Industry Profile
Firms in the medical device industry
are heterogeneous. They vary in size,
product type, product and process
technology, and rate of new product
introductions. There are over 7,000
medical device establishments involved
in the production of approximately
4,000 different types of devices (Table
1). Sixty-two percent of these
establishments are very small (fewer
than 20 employees), while 27 percent
are of medium-size (20 to 99
employees), 7 percent are large (100 to
249 employees), and 4 percent are very
large (250 or more employees). These
size categories were developed to reflect
size categories within the medical
device industry and differ from the
Small Business Administration
definition. Under the Small Business
Administration definition, over 98% of
all establishments would be small.
TABLE 1.—DISTRIBUTION OF AFFECTED ESTABLISHMENTS BY EMPLOYMENT SIZE
Type of establishment Total 1
Employment size 2
Small
(1–19)
Medium
(20–99)
Large
(100–249)
Very large
(≥250)
Design and Production Manufacturer ....................................................... 5,415 3,323 1,414 415 265
Contract manufacturer .............................................................................. 419 257 109 32 20
Specification developer ............................................................................. 541 352 162 27 0
Repacker/relabeler .................................................................................... 828 538 248 41 0
52645Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
TABLE 1.—DISTRIBUTION OF AFFECTED ESTABLISHMENTS BY EMPLOYMENT SIZE—Continued
Type of establishment Total 1
Employment size 2
Small
(1–19)
Medium
(20–99)
Large
(100–249)
Very large
(≥250)
Contract sterilizer ...................................................................................... 34 22 10 2 0
Total ............................................................................................... 7,237 4,492 1,943 517 285
1 Based on data from FDA’s Registration and Listing Branch, 1992, adjusted to reflect 13 percent not required to register and 6 percent exempt
from CGMP requirements.
2 ERG (1993), Section 3.
C. Comments to November, 1993
Proposed Changes to the CGMP
Regulation
A small percentage of the public
comments on the November 1993
proposed regulation addressed the
economic impact analysis. The majority
of these comments made very general,
nonspecific observations and therefore
cannot be addressed directly. Many of
these comments stated that FDA
underestimated the regulatory burden
that the proposed CGMP regulation
would place on medical device
manufacturers. Others stated that their
companies would expend more than the
per establishment estimated costs; some
discussed the hiring of additional
personnel to address the compliance
requirements.
In developing the cost estimates for
the 1993 proposal, ERG attempted to
describe the labor hours (and associated
costs) needed to achieve an acceptable
minimum level of compliance with each
requirement. These estimates took into
account the incremental labor and
capital resources that would be needed
to progress from the existing compliance
level to the new level required by the
proposal. For individual establishments,
the economic impact of the CGMP
regulation would depend on a number
of factors, such as the level of current
compliance, the type of activities
performed, and the nature of the
product. Not surprisingly, those
establishments that currently undertake
relatively few of the activities to be
required would incur greater
compliance costs than the averages
presented.
In the final rule, FDA has eliminated
or modified several requirements to give
medical device establishments greater
flexibility in selecting compliance
methods. In general, the words ‘‘where
appropriate’’ were added to many
requirements to make them less
prescriptive and allow establishments to
determine if or when they are
appropriate for their product. For
example, in § 820.65 Traceability, the
final requirement allows the
manufacturer to identify which
components require traceability. In
addition, many procedures may not
need to be changed, only documented.
To further minimize compliance costs,
FDA intends to provide additional
guidance materials. The DSMA
currently offers guidance materials and
regional seminars on CGMP matters.
1. Health Industry Manufacturers
Association (HIMA)
HIMA commented that FDA
understated the costs for personnel
training, maintenance of new systems,
documentation revisions, and
operational costs.
ERG agrees that it did not fully
address the initial training requirements
in the cost analysis for the proposed
CGMP regulation. New costs for initial
training were included in the cost
analysis for the final CGMP regulation.
However, the existing CGMP regulation
requires periodic training of personnel.
Therefore no incremental costs for
periodic training were estimated.
ERG did not change its cost estimate
for quality system maintenance and
procedure revisions. Estimates were
made for the incremental compliance
costs associated with an annual review
of each new procedure, but these
procedures would be revised only
sporadically and probable estimates of
their future costs would be small and
could not be reasonably quantified.
ERG recognized that companies will
incur incremental costs to use new
procedures. Although a separate
estimate of these operational costs was
not made, they were incorporated into
the estimates of the individual
requirements where applicable.
2. Other General Comments
Some manufacturers of low-risk
devices and some that have never
experienced a product recall or MDR
event questioned the merit and benefits
of applying design controls to all
products. In the proposed and final
CGMP regulation, FDA exempted almost
all class I devices because the public
health benefits gained did not exceed
the costs of implementation. However,
FDA believes that all class II and III
devices should be covered because their
failure could adversely affect public
health. Even firms with excellent past
records put their consumers at future
risk if their design systems are
inadequate. ERG estimates that strict
compliance to the final CGMP
regulation will avert about 43 deaths
and over 600 serious injuries per year.
In addition, the literature on quality
systems consistently states that firms
implementing such systems, which
begin with design controls, report cost
savings in the long-run.
A number of comments argued that
the proposed CGMP regulation would
slow product innovation and increase
health care costs. FDA believes that the
gains from improvements in quality
control and greater efficiencies will
lessen the impact on both innovation
and health care costs and will not lower
the innovation rate for products with
significant medical benefit.
Manufacturers will also avoid the costs
of most design-related medical device
recalls. ERG estimated that design-
related recalls cost industry
approximately $40 million per year.
Health care spending overall will also
decrease as deaths, injuries and
malfunctions from medical device
failures decrease.
Some comments suggested that the
proposed CGMP regulation would hurt
the domestic medical device industry’s
competitiveness and encourage
companies to move their operations to
foreign countries. FDA has sought to
harmonize the final CGMP regulation
with ISO 9001:1994 and ISO/CD 13485.
Some comments had stated they would
like to see even greater harmonization in
the final regulation. The harmonization
of regulatory requirements will benefit
medical device establishments because
they will be able to maintain a single
regulatory compliance program. The
harmonization of CGMP requirements is
also a first step in developing mutual
recognition agreements between U.S.
and foreign governments. An FDA
sponsored survey of innovative medical
52646 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
3 ERG (1994). FDA Survey of Establishments
Introducing New Medical Devices. (Task Order 3,
Contract No. 223–91–8100.)
4 ERG (1994). FDA Survey of Establishments
Introducing New Medical Devices. (Task Order 3,
Contract No. 223–91–8100).
device companies found that nearly 65
percent of them sold their products
outside the United States, including 40
percent of the small and 70 percent of
the medium-sized companies.3 Thus, a
majority of firms should benefit from
harmonization efforts. Since foreign
firms exporting their products to the
United States must comply with the
U.S. CGMP regulation, they will incur
essentially the same incremental costs
to comply with the final CGMP
regulation as domestic establishments.
3. Small Business Concerns
Some comments representing small
businesses were concerned about the
increase in procedural and
documentation requirements. The
procedures and paperwork requirements
will be simpler for small medical device
establishments relative to larger firms.
Further, small businesses can reduce
compliance costs by using FDA
guidance and training materials,
industry-generated guidance, and other
technical assistance that is available.
FDA is preparing an extensive range of
technical support regarding the final
CGMP regulation, including guidance
documents, workshops, and other
materials and presentations.
Several small businesses argued that
the regulatory costs fall
disproportionately on small business,
hindering industry growth. The
regulatory requirements apply equally
to whoever is designing and developing
new devices. However, the vast majority
of firms are small and medium in size
and these firms are least likely to have
such design control procedures already
in place. As a result, their incremental
costs may be higher. Nevertheless,
because procedures reflect the
complexity of the processes they guide,
small and medium-sized establishments
should incur proportionately lower
gross compliance costs for those
activities than larger establishments.
4. Section 820.22 Quality audit
Some comments believed that
requiring quality audits to be performed
by individuals without direct
responsibility for the matters being
audited poses a severe burden for small
business. This requirement is already
present in the original CGMP regulation
and thus was not addressed in the
economic analysis of the final
regulation.
5. Section 820.25 Personnel
Comments stated that the requirement
to maintain files on consultants was
onerous and interfered with
manufacturers’ selection processes. FDA
modified this requirement and moved it
to § 820.50 Purchasing, in the final
CGMP regulation. Companies will now
be required to verify that consultants
meet specified requirements and define
the type and extent of control they will
exercise over them. The incremental
compliance costs were judged to be
negligible.
6. Section 820.30 Design control
Comments believed that the
requirement stipulating that devices be
sampled from three production runs
before a device is released for routine
distribution was too prescriptive and
burdensome. FDA has modified the
requirement in the final rule to require
design validation of initial production
units, lots, or batches, or their
equivalent. This modification should
give manufacturers greater flexibility in
implementing this requirement.
Some comments from small
businesses were critical of the
requirement that independent personnel
perform design reviews and stated that
they will have to hire outside engineers
for this task. In the final rule FDA
allows greater flexibility and states that
the independent personnel can be
individual(s) who do not have direct
responsibility for the design stage being
reviewed. Thus, staff personnel
(including engineers working on other
components of the device and
nonengineering personnel) can perform
design reviews.
7. Section 820.40 Document control
Some comments believed that the cost
of implementing documentation
systems and other paperwork was
understated. However, ERG’s estimates
included the incremental compliance
costs for formalizing a written document
control procedure and ERG considered
paperwork requirements in its
estimation. The final rule also extends
document control requirements to the
design phase and cost estimates for
these requirements were added to the
economic assessment.
Most companies consider document
control procedures to be essential and
have realized some benefits from such
procedures, typically in the form of
efficiency gains and avoided
documentation mixups. These potential
benefits were not quantified.
8. Section 820.50 Purchasing control
Comments questioned the need to
establish the quality of materials
purchased from long-established
suppliers or from new suppliers of small
quantities of components. Historical
records, however, even for suppliers of
small quantities, can be used to assess
a supplier’s quality. Supplier audits are
not mandated in the CGMP regulation,
but may be a useful tool in assessing a
supplier’s capabilities. Cost estimates
for auditing from one- half to four new
suppliers per year for small to very large
establishments were included in the
economic assessment.
9. Section 820.80 Receiving, in-
process, and finished device acceptance
One comment believed that requiring
manufacturers to retain the quantitative
results of testing was excessive. The
final rule stipulates that ‘‘the results’’ of
acceptance activities are to be recorded,
but does not specify that all quantitative
results must be recorded. Because this
requirement is consistent with current
industry practices, incremental costs
were not assigned to this section.
10. Section 820.90 Nonconforming
product
Comments noted that identifying a
product as ‘‘reprocessed’’ has a negative
impact on sales. (FDA now uses the
term ‘‘reworked’’.) This language was
revised in the final rule to clarify that
reworked devices need to be identified
as such at the manufacturing facility to
avoid mixups. No costs were estimated
for this requirement.
D. Industry Costs
ERG estimated the total annual
incremental cost of the final rule at
$81.9 million. This includes $9.5
million in one-time costs that were
annualized over 5 years at a 10 percent
discount rate. Table 2 lists the most
costly of the new requirements.
Costs were based on the incremental
tasks each manufacturer must perform
to achieve compliance. ERG retained
most of the methodology and data from
the proposed rule to estimate the costs
of the final rule. Where applicable, costs
were estimated for additional or
changed final requirements. Also, the
distribution of costs across
establishment size was modified to
reflect new information on the rate of
product innovation.4 The rates of
innovation per year used for this
analysis are: 0.4 percent for small, 1.3
percent for medium-sized, 2.6 percent
for large, and 6.5 percent for very large
establishments.
52647Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
TABLE 2.—TOTAL COMPLIANCE COSTS, BY MOST COSTLY INCREMENTAL TASKS
[$ millions]
Incremental tasks One-timeannualized 1
Annual Total
annualizedLabor Nonlabor
Design Controls:
Design Verification .................................................................................................... NA 18.2 27.4 45.6
Design Review .......................................................................................................... NA 6.2 NA 6.2
Design Changes ........................................................................................................ NA 4.0 NA 4.0
Design and Development Planning ........................................................................... NA 1.2 NA 1.2
Other:
Quality Audit .............................................................................................................. 0.5 4.7 NA 5.2
Evaluation of Suppliers and Contractors .................................................................. 0.6 1.9 0.9 3.4
Management Review ................................................................................................. NA 2.2 NA 2.2
Purchasing Data ........................................................................................................ NA 1.1 NA 1.1
All Remaining ................................................................................................................... 8.4 4.6 0.0 13.0
Total for Final Regulation ................................................................................... 9.5 44.1 28.3 81.9
1 One-time costs annualized over 5 years at discount rate of 10 percent.
NA=Not Applicable.
Note: Totals may not add due to rounding.
Source: ERG (1996), Section 4.
The great majority of costs for all size
establishments will be associated with
the establishment of design controls for
new products. Therefore, the more
innovative establishments will
experience greater compliance costs
than the less innovative establishments.
The estimated annual design control
costs total $57.5 million, which
represents 70 percent of the total annual
incremental costs of compliance. The
most costly task within the design
control category is design verification
($45.6 million), which includes design
validation. Other costly tasks are design
review ($6.2 million), which
encompasses conducting and
documenting design reviews; design
changes ($4.0 million), which includes
documenting and maintaining design
change procedures; and design and
development planning ($1.2 million),
which includes documenting and
maintaining plans for device design and
development. The requirement for
extending the quality system audit ($5.2
million) and the evaluation of suppliers
and contractors ($3.4 million) are also
relatively high cost items.
The estimated total cost of
compliance for the final rule ($81.9
million) is $2.6 million less than the
estimated cost of the November 1993
proposed rule ($84.5 million). Some
cost increases were due to added
requirements for increased
documentation. However, these cost
increases were offset partly by a
decrease of $0.5 million from the
modification of some requirements (e.g.
§§ 820.65 Traceability and 820.160
Distribution). The remaining changes
resulted from changes in assumptions or
new information about cost and
compliance rates in design control and
supplier audits and from new
information regarding product
innovation rates across establishment
size.
The projected average cost per
establishment (see Table 3) varies
substantially across industry sectors and
establishment size categories. As
expected, the average incremental costs
are largest for establishments that design
medical devices: design and production
manufacturers and specification
developers. For these two sectors, the
average per establishment costs are
$15,994 for design and production
manufacturers and $14,767 for
specification developers. Actual per
establishment costs will vary
substantially depending on the product
type, design complexity, innovation
rate, and level of design control
currently in place. The average
incremental costs for the other three
sectors are significantly lower: $3,554
for contract manufacturer, $1,995 for
repacker/relabeler, and $2,040 for
contract sterilizer.
TABLE 3.—AVERAGE TOTAL ANNUALIZED 1 COSTS PER ESTABLISHMENT BY TYPE AND SIZE
[Dollars]
Establishment type Small (1–19) Medium(20–99)
Large
(100–249)
Very large
(≥250) All
Design and Production Manufacturer ............................................. 11,085 25,800 22,748 12,258 15,994
Specification Developer .................................................................. 9,927 24,052 20,583 NA 14,767
Contract Manufacturer .................................................................... 2,357 4,027 5,802 10,678 3,554
Repacker/Relabeler ........................................................................ 1,471 2,588 3,969 NA 1,995
Contract Sterilizer ........................................................................... 1,491 2,621 3,999 NA 2,400
1 One-time costs annualized over 5 years at a discount rate of 10 percent.
NA=Not Applicable.
Source: ERG (1996), Section 6.
Because average current compliance
rates tend to vary directly with
establishment size and there are
relatively few large and very large
establishments (7 and 4 percent of all
medical device establishments,
respectively), the largest share of the
costs are incurred by small
establishments, $35.2 million (43
52648 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
5 There is no code in the MDR database to identify
design-related events.
percent) and medium-size
establishments, $34.5 million (42
percent), while the smallest share is
incurred by very large establishments,
$3.4 million (4 percent) (see Table 4).
TABLE 4.—TOTAL ANNUALIZED COSTS BY SIZE CATEGORY
[$ millions]
Establishment size One-timeannualized 1
Annual Total
annualizedLabor Nonlabor
Small (1–19) ..................................................................................................................... 4.9 18.2 12.1 35.2
Medium (20–99) ............................................................................................................... 3.0 18.2 13.3 34.5
Large (100–249) ............................................................................................................... 1.0 5.1 2.8 8.8
Very large (≥250) .............................................................................................................. 0.7 2.6 0.1 3.4
All establishments ............................................................................................................. 9.5 44.1 28.3 81.9
1 One-time costs annualized over five years at discount rate of 10 percent.
Note: Totals may not add due to rounding.
Source: ERG (1996), Section 4.
E. Benefits From Proposed Changes to
the CGMP Regulation
ERG used the methodology and data
from the proposed rule to estimate the
benefits of the final CGMP regulation.
Adjustments to the number and
distribution of MDR’s were made based
on updated numbers of closed cases.
Also, more reliable estimates of industry
savings from avoided design-related
recalls were incorporated.
The changes to the CGMP regulation
will provide public health benefits to
medical device users and economic
benefits to the medical device industry.
Based on its review of medical device
recalls over the 4-year period 1988 to
1991, FDA has estimated that 30 percent
of all medical device product recalls are
due to inadequate design controls. It is
extremely difficult to judge how many
of these recalls could reasonably have
been avoided, but ERG judged that a
majority would have been prevented if
manufacturers had fully implemented
the CGMP design control requirements.
1. Public Health Benefits
ERG used the MDR database to
estimate the public health benefits of
the final CGMP regulation. There were
over 41,600 MDR’s submitted to FDA in
1991; 97 percent of these MDR’s are
closed (i.e., a review of the case is
completed). Of these closed cases, FDA
determined that 9.3 percent of the
fatalities and 12.4 percent of the serious
injuries were due to device failures. The
bulk of the remaining incidents were
due to user problems, but also include
cases where cause could not be clearly
established. To estimate the total
number of deaths and serious injuries
for 1991 by cause, the 1988–1991
averages of device recalls were used. To
estimate the number of deaths and
serious injuries due to design-related
causes, ERG assumed that the percent of
MDR’s that were design-related was the
same as that for recalls (30 percent).5
Based on these assumptions, medical
devices contributed to an estimated 49
fatalities and 663 serious injuries in
1991 due to design-related problems in
class II and III devices (see Table 5). To
correct for the substantial under
reporting of MDR’s, ERG made an
upward adjustment in the number of
MDR’s of 20 percent for fatalities and 40
percent for serious injuries. The number
of estimated fatalities adjusted for
underreporting of MDR’s would be 59,
with 929 serious injuries.
TABLE 5.—NUMBER OF DESIGN-RELATED REPORTS AND ESTIMATED AVOIDED DEATHS AND SERIOUS INJURIES
Fatalities Serious Injuries
Class II Class III Total Class II Class III Total
Number in 1991 ............................................................................ 555 475 1,030 4,391 11,794 16,185
Device-related ............................................................................... 105 59 164 330 1,881 2,211
Design-related 1 ............................................................................. 32 18 49 99 564 663
Number avoided ............................................................................ 23 13 36 72 412 484
Adjusted number of design-related MDR’s 2 ................................. 38 21 59 139 790 929
Adjusted Number avoided ............................................................ 28 15 43 101 576 677
1 Assumes 30 percent of device-related MDR’s are design-related, based on FDA recall data.
2 Total number of fatalities and injuries increased by 20 and 40 percent, respectively, to adjust for under-reporting.
Source: ERG (1996), Section 5.
To develop an approximate idea of
the preventability of these incidents,
ERG convened a panel of industrial
engineers and regulatory specialists
with extensive experience in the design
of medical devices. The panel examined
a random sample of 100 design-related
medical device recalls and judged
whether implementation of design
controls could have prevented the
recall. ERG found that the expected
value of their judgments implied that
proper design controls would have
prevented about 73 percent of these
recalls. Assuming the same
preventability ratio for design-related
MDR events, ERG calculated that the
proposal would prevent about 36 to 43
deaths and 484 to 677 serious injuries
per year, depending on the degree of
MDR underreporting.
To verify the reasonableness of the
estimates, FDA examined an alternative
method of estimating the number of
52649Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
6 Design-related medical device recalls cost the
industry approximately $40 million annually.
(Eastern Research Group, Inc. (1994). FDA Survey
of Medical Device Recall Costs. (Task Order 3,
Contract Number 223–91–8100).
7 ERG (1994). FDA Survey of Establishments
Introducing New Medical Devices. (Task Order 3,
Contract No. 223–91–8100.)
fatalities caused by design-related
failures. For this calculation, 3 years of
design-related recalls were assumed
linked to MDR fatalities that occurred
for these devices 1 year before or 3
months after the date of the recall. This
approach, which provides a
conservative estimate because not all
relevant fatalities and subsequent
MDR’s would occur during this limited
time period, found that about 60 deaths
per year were due to design-related
device failures. If 73 percent of such
incidents could be avoided through
compliance with the proposed CGMP
regulation, 44 deaths per year would be
prevented.
These estimates of the public health
benefits from fewer design-related
deaths and serious injuries represent
FDA’s best projections, given the
limitations and uncertainties of the data
and assumptions. The above numbers,
however, do not capture the quality of
life losses to patients who experience
less severe injuries than those reported
in MDR’s, who experience anxiety as a
result of treatment with an unreliable
medical device, or who experience
inconvenience and additional medical
costs because of device failure.
Medical device malfunctions are
substantially more numerous than
deaths or injuries from device failures
and also represent a cost to society.
Malfunctions represent a loss of product
and an inconvenience to users and/or
patients. Additionally, medical device
malfunctions burden medical personnel
with additional tasks, such as repeating
treatments, replacing devices, returning
and seeking reimbursement for failed
devices, and providing reports on the
circumstances of medical device
failures. No attempt was made to
quantify these additional costs.
2. Industry Benefits
The medical device industry would
gain substantial economic benefits from
the proposed changes to the CGMP
regulation in three ways: Cost savings
from fewer recalls, productivity gains
from improved designs, and efficiency
gains for export-oriented manufacturers
who would now need to comply with
only one set of quality standards.
An average of 359 medical device
recall events per year were reported to
FDA over the period 1988 to 1991. As
stated above, FDA estimates that design-
related deficiencies contributed to 30
percent of those recall events annually.
Applying the 73 percent recall
preventability factor, ERG projects that
there would be 67 fewer recalls of class
II and III devices each year under the
final CGMP regulation (see Table 6).
Based on data from a recent survey of
recall costs, 67 fewer recalls implies that
the industry would avoid roughly $29
million worth of recall expenses per
year by complying with the final CGMP
regulation.6
TABLE 6.—NUMBER OF AVOIDED DE-
SIGN-RELATED RECALL EVENTS BY
CLASS OF DEVICE
[FY 1988–FY 1991]
Device class
Average
number
of design-
related
recall
events1
Number
of avoid-
ed de-
sign-relat-
ed recall
events2
I ................................. 15 NA
II ................................ 80 58
III ............................... 12 9
All Devices ............. 107 67
1 Office of Compliance and Surveillance,
CDRH.
2 ERG estimates based on random sample
of 100 design-related recalls.
Source: ERG (1996), Section 5.
ERG also found that the design
control requirements in the final CGMP
regulation would require manufacturers
to integrate their design and production
operations and that most industry
experts believe that this change would
lead to better quality products, more
efficient engineering, lower
manufacturing costs, and reduced
product development time. These
savings, however, could not be
quantified.
Still another benefit of the revised
regulation relates to the harmonization
of the final CGMP regulation with the
ISO 9001:1994 international standard.
This change would especially benefit
export-oriented establishments, because
they would need to meet only one set
of quality standards. ERG could not
derive quantitative measures of this
benefit. However, 65 percent of
innovative medical device companies
export their products, thus a majority
should benefit from harmonization of
CGMP regulation between major trading
partners.7
F. Economic and Small Business Impact
The ability of medical device
establishments to pass on the added cost
of the final regulation will determine
the economic impact to the industry.
The diversity of medical devices
precludes any easy characterization of
their product markets. Under the
current medical care system, however,
the demand for many medical devices
tends to be price inelastic because they
are often prescribed by physicians and
frequently paid for by third parties.
Thus, small price increases have not
typically prompted significant declines
in industry sales. Nonetheless,
competitive pressures have increased
substantially under new health care
cost-containment measures. Therefore,
to examine the potential effect of the
costs of compliance on the industry’s
competitive structure, ERG calculated
the maximum impact on industry
average prices and products, using
extreme scenarios. Financial data
characterizing the scope of FDA-
regulated medical device establishments
are not available. To make estimates of
the regulatory impact on price and
profits, ERG used a combination of
census and Dun and Bradstreet data (see
ERG (1993) for methodology). ERG
assumed that the firms characterized in
these data sources had the same size
and product distribution, and
introduced new products at the same
rate as the population of FDA-regulated
establishments. While the validity of
these assumptions is uncertain, it was
the only data available to measure
regulatory impact. ERG presents two
extreme scenarios, the first reflects the
magnitude of the potential impact on
product prices if all costs were passed
forward. The second demonstrates the
maximum drop in profits if no costs
were passed forward. In reality, some
combination of these scenarios will
occur.
Based on the assumption that all costs
of compliance are passed through to the
end user, with no loss in sales and no
offset for avoided recalls or other
industry productivity gains, ERG found
that the average increase in the price of
medical devices would be less than 0.13
percent. Estimated price increases
ranged from 0.04 percent for X-Ray
Apparatus and Tubes (SIC 3844) to 0.34
percent for Dental Equipment and
Supplies (SIC 3843) (see Table 7). The
maximum price increase was calculated
using aggregate compliance costs as a
percentage of the value of shipments.
The price increases calculated by size of
establishment suggest that small
establishments will be under greater
pressure to increase prices. The cost of
compliance represented an average of
1.36 percent of the value of shipments
for small establishments and 0.01
percent for very large establishments.
These differences in impacts by size
reflect the finding that small
52650 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
8 The Small Business Administrations definition
is by the employment size at the company level.
Detailed demographic and financial data is not
available by company size, therefore FDA used
establishment data. FDA does not know the impact
on companies.
9 ERG (1994). FDA Survey of Establishments
Introducing New Medical Devices. (Task Order 3,
Contract No. 223–91–8100.)
establishments have lower current
compliance than large establishments.
To estimate the potential impact of
compliance costs on medical device
industry profits, ERG calculated after-
tax compliance costs as a percentage of
after-tax income for each medical device
SIC (see Table 7). Again, no adjustments
were made for avoided recalls or
expected productivity gains. If
manufacturers have no ability to
increase prices to offset the increase in
compliance costs, this estimate
represents an upper bound of the
potential effect on entity income. Under
these circumstances, the medical device
sectors could incur reductions in
income ranging from about 0.81 percent
(SIC 3845, Electromedical Equipment)
to about 4.27 percent (SIC 3843, Dental
Equipment and Supplies). ERG
concluded that such impacts may affect
some establishments’ decisions to
develop new products where expected
profits are marginal or highly uncertain,
but judged that the level of incremental
costs imposed by this regulation would
not substantially lower the innovation
rate especially for products with
significant medical benefits.
TABLE 7.—MAXIMUM POTENTIAL IM-
PACT ON PRICE OR PROFITS BY IN-
DUSTRY AND EMPLOYMENT SIZE
Total
annualized
compli-
ance costs
as a per-
centage of
shipments
After-tax
compli-
ance
costs as
a per-
centage
of after-
tax in-
come
Industry:
3841 Surgical and
medical instru-
ments ................ 0.12 2.00
3842 Surgical ap-
pliance and sup-
plies .................. 0.14 1.78
3843 Dental equip-
ment and sup-
plies .................. 0.34 4.27
3844 x-ray appara-
tus and tubes .... 0.04 0.88
3845
Electromedical
equipment ......... 0.05 0.81
3851 Ophthalmic
goods ................ 0.24 3.54
All ......................... 0.13 1.87
Establishment size:
Small (1–19) ......... 1.36 NA
Medium (20–99) ... 0.35 NA
Large (100–249) 0.09 NA
Very large (≥250) 0.01 NA
All ......................... 0.13 NA
NA = not available.
Source: ERG (1996), Section 6.
The Regulatory Flexibility Act
requires agencies to analyze regulatory
options that would minimize any
significant impact of a rule on small
entities. This section together with other
discussions in this preamble and
supporting analysis and materials
constitute the agency’s regulatory
flexibility analysis. A description of the
projected reporting, recordkeeping, and
compliance requirements including the
type of professional skills required is
included in the ERG economic analysis
reports that are referenced above and on
file at the Dockets Management Branch
(address above). In accordance with the
Regulatory Flexibility Act, FDA has
considered the effect of this action on
small businesses and has determined
that there will be a significant impact on
a substantial number of small
businesses. Almost all medical device
establishments are classified as small
under the Small Business
Administrations definition of size.8 The
incremental costs are greatest for
establishments that design medical
devices and that currently have lower
levels of compliance with the new
design control requirements. These
requirements account for 70 percent of
the total incremental costs of the final
rule but affect only design and
production manufacturers and
specification developers (82 percent of
the total affected establishments). Other
sectors of the industry will incur
substantially lower costs (see Table 3).
The actual added cost per
establishment will vary by the
establishment’s current level of
compliance, complexity of product
design, product type, and rate of
product innovation. As indicated in
Table 3, the average medium-size and
large manufacturers of devices will
incur greater compliance costs ($25,800
and $22,748 per establishment,
respectively) relative to small and very
large establishments ($11,085 and
$12,258, respectively). However, the
potential impact on product price
(measured as a percent of the value of
shipments) is greatest for small (1.36
percent) and medium-size (0.35 percent)
establishments. Large and very large
establishments will incur only a 0.09
percent and 0.01 percent increase,
respectively, due to much larger values
of shipments and higher rates of
compliance with the final rule. Smaller
establishments producing differentiated
products or marketing to niche markets
may not be at a disadvantage because of
their ability to pass on the added cost
of compliance. However, those smaller
establishments that compete with larger
establishments based on price alone
would suffer a drop in profits if they
currently operate at lower levels of
compliance than their competitors.
FDA believes that actual per
establishment compliance costs will be
lower than estimated for the following
reasons: First, the final CGMP regulation
closely parallels the ISO 9001:1994
quality standards, which have been
adopted as the quality standard for the
EU and are becoming the international
quality standards for medical devices.
Close to 65 percent of domestic medical
device manufacturers export their
products and generate approximately
one-third of their sales from exports.9
Compliance with the quality control
requirements is necessary for firms to
maintain international competitiveness
and in fact many U.S. medical device
manufacturers have become ISO
certified since the 1993 publication of
the proposed CGMP regulation and the
EU implementation of unified
regulatory requirements.
Second, the FDA has extended the
effective date of the final rule to June 1,
1997, and has chosen not to take
regulatory action for an additional year
on the design control requirements. This
revised effective date will also reduce
the cost of implementation estimated for
the 1993 proposal where the proposed
effective date was only 180 days after
date of publication. The extension will
give manufacturers a longer time to
implement the new requirements,
allowing the costs to be spread over
almost a 2-year period as compared to
180 days. June 1998 coincides with the
implementation of the EU’s Inactive
Medical Device Directive. Therefore, the
economic impact of complying with the
new quality system regulation will be
shared with the economic impact of
complying with the new EU Medical
Device Directive for any manufacturer
who also produces devices for sale in
the EU, lessening the direct impact of
the new quality system regulation.
Third, ERG estimates of the number of
labor hours needed for design controls
assume that many establishments have
little or no formal system in place. Once
an establishment has developed a
system, minor modifications to an
establishment’s existing product (for
which many 510(k) applications and
PMA supplements are submitted) may
be less costly than ERG assumed.
52651Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
Finally, cost estimates assume that
establishments will use in-house
expertise or hired consultants for all
compliance activities. In fact, FDA and
trade publications have disseminated
much of the information that would be
needed by the firms. FDA has taken
many steps specifically to assist small
businesses in complying with this final
rule. The two stage implementation of
the regulation was a concerted effort to
reduce the regulatory burden on small
businesses. Stage 1 was set up to be a
1 year training and cooperative phase
for the entire medical device
community. FDA and industry would be
participating in a number of cooperative
efforts as well as joint training exercises.
Most importantly, FDA would be
evaluating design controls and
providing industry with feedback in the
nature of a report. During this time, to
truly allow it to be a learning experience
for both the device manufacturers and
the FDA investigators, there would be
no regulatory actions taken as a result of
these evaluations and reports. The
biggest benefactor of the two stage
implementation would clearly be small
businesses.
Further, several guidances have been
prepared by FDA for this regulation as
a whole, as well as on subject matters
that are significant in this final rule.
FDA plans to release the following three
guidances within 60 days after the final
rule is published: (1) DSMA’s ‘‘Medical
Device Quality Systems Manual: A
Small Entity Compliance Guide,’’ which
includes discussion on the entire
regulation plus multiple examples of
procedures and forms that can be
adopted and modified by
manufacturers; (2) ‘‘Design Control
Guidance For Medical Device
Manufacturers,’’ which is intended to
assist manufacturers in understanding
the intent of the design control
requirements. Assistance is provided by
interpreting the language of the
regulation and explaining the
underlying concepts in practical terms;
and (3) ‘‘Do It By Design: An
Introduction to Human Factors in
Medical Devices,’’ which contains
background information about human
factors as a discipline, descriptions and
illustrations of device problems, and a
discussion of human factors principles
and methods as a part of the design
control system. FDA also plans to
release the following guidances after
publication of this final rule: (1) A
guidance on ‘‘Validation,’’ which will
include discussions on design
validation, computer validation, and
process validation; and (2) a draft of the
‘‘Design Control Inspectional Strategy,’’
which will be the questions that FDA
investigators will be asking when
assuring compliance with the design
control requirements.
FDA is also prepared to release
shortly after publication of this final
rule a 4 hour series of videotapes
discussing the Quality System
Regulation. The videotapes will also be
accompanied by a guidebook entitled
‘‘The FDA and World Wide Quality
System Requirements Guidebook For
Medical Devices.’’ This guidebook will
contain the entire Quality System
Regulation from FDA, the entire text of
ISO 9001:1994, FDA guidance from the
regulation’s preamble, and guidance on
quality systems from the GHTF.
FDA has also tentatively scheduled
two teleconferences. The first
teleconference, which would be to
discuss the Quality System Regulation
and answer questions that have come up
from manufacturers beginning to
implement the regulation, is tentatively
scheduled for December 1996. A second
teleconference is tentatively scheduled
for April/May of 1997 and will
specifically address design controls and
the final Design Control Inspectional
Strategy. FDA is also exploring the
possibility of conducting regional
workshops in May of 1997 to further
discuss the design control requirements
and their implementation.
In addition to these activities, FDA
and DSMA will continue to provide
guidance and workshops that can help
small business with their compliance
activities, and will continue to
participate in industry association
workshops, conferences, and meetings.
While all of the above-mentioned
activities will be available to all
manufacturers, small manufacturers will
benefit the most from these FDA
activities without having to pay
substantial costs, as most of the
guidance and written material will be
available on the world wide web, and
the teleconferences and other
workshops sponsored or cosponsored by
FDA will be of nominal cost.
Finally, as described elsewhere in this
preamble, FDA intends to conduct a
midcourse review of the new design
control requirements during the
transition year (June 1997 to June 1998).
Specifically, the results of the first
several months of design control
inspections will be reviewed by early
1998, and any midcourse adjustments to
the inspectional strategy will be
instituted and made public by the
Spring of 1998. Also during this
midcourse review FDA will evaluate the
information gathered at that point and
determine if the design control
requirements as written in this final rule
are appropriate to obtain the goals
expressed in this preamble. Any
necessary adjustments or proposed
revisions will be published in the
Federal Register and comments will be
solicited as necessary during the spring
of 1998. This implementation strategy is
responsive to requests by industry for
FDA to harmonize the quality system
regulation’s implementation with the
mandatory date for implementation of
the EU’s Medical Device Directive,
which is June 1998. However, if during
the midcourse review of stage one it is
determined that the industry and/or
FDA needs more time to fully
implement the design control
requirements, FDA will publish that
decision in the Spring of 1998 prior to
the June 1, 1998, regulatory
implementation date.
Small businesses will also benefit in
that FDA considered but rejected
applying design requirements to all
class I devices, because the added
benefits to public health were not great
enough to offset the increased burden
on industry. Two requirements were
eliminated or modified in the final rule
that decreased the burden on industry:
The applicability of the CGMP
regulation to component suppliers was
removed, and § 820.65 Traceability was
limited to traceability of components
where necessary to assure the protection
of public health. These changes will
particularly aid small businesses. In
addition, revisions were made to many
requirements in the final rule to make
it less prescriptive and to allow
establishments greater flexibility in
implementing the requirements. Cost
savings from these changes were not
estimated.
In addition, revisions were made to
many requirements in the final rule to
make it less comprehensive in scope,
less prescriptive and to allow
establishments greater flexibility in
implementing the requirements. Cost
savings from these changes were not
estimated. Based on the above, the
agency has determined that the current
rule represents the least burdensome
alternative that meets the public health
goal of reducing deaths and serious
injuries attributable to defective medical
devices.
In summary, FDA concludes that the
estimated $81.9 million annual
incremental cost to comply with the
final CGMP regulation is likely an
upward bound figure and that it would
be substantially offset by significant
savings from avoided recalls and more
importantly, the avoidance of deaths
and serious injuries due to design-
related device failures. FDA’s estimate
of public health benefits includes the
52652 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
prevention of 36 to 44 deaths and 484
to 677 serious injuries annually.
Establishing design controls will also
result in better designed and higher
quality devices and fewer device
failures. This quality improvement will
in turn reduce the inconvenience and
expense of repetitive treatments or
diagnoses. The agency also believes the
actual cost to comply with the final rule
will be lower than estimated because
the industry compliance baselines used
to estimate costs are from 1993. Since
that time, market pressures have
induced many firms that export to the
EU to become ISO 9001:1994 certified.
These firms would now be in
compliance with most of FDA’s final
CGMP regulation. Further, FDA has
provided continued education efforts
over the past 15 years, to mitigate
industry costs.
IX. Paperwork Reduction Act of 1995
This final rule contains information
collections that are subject to review by
OMB under the Paperwork Reduction
Act of 1995 (Pub. L. 104–13). The title,
description and respondents of the
information collection are shown below
with an estimate of the annual
incremental increase in the
recordkeeping burden that respondents
must undertake to achieve compliance
with the final regulation.
Title: Medical Devices, Quality
System Regulations, Current Good
Manufacturing Practice Requirements.
Description: This final quality system
regulation amends and revises the
current good manufacturing practice
requirements for medical devices, set
out at 21 CFR part 820. This final
regulation replaces quality assurance
program requirements with quality
system requirements; adds design and
purchasing controls; modifies the
critical device requirements; revises
certain existing requirements, such as
validation and management
responsibility, to clarify the intent of the
requirements; and harmonizes the
CGMP regulations for medical devices
with quality system specifications in
ISO 9001:1994 ‘‘Quality Systems-Model
for Quality Assurance in Design,
Development, Production, Installation
and Servicing.’’
Description of Respondents: Business
or other for-profit and small businesses
or organizations.
CFR section
Number of
record-keep-
ers
Annual fre-
quency of rec-
ordkeeping
Total annual
records
Hours per
record-keeper Total hours
Total operat-
ing and main-
tenance costs
820.20(a) ................................................... 7,237 1 7,237 10.96 79,386 ........................
820.20(b) ................................................... 7,237 1 7,237 4.88 35,285 ........................
820.20(c) ................................................... 7,237 1 7,237 10.28 74,364 ........................
820.20(d) ................................................... 7,237 1 7,237 16.49 119,305 ........................
820.20(e) ................................................... 7,237 1 7,237 16.49 119,305 ........................
820.22(a) ................................................... 7,237 1 7,237 52.03 376,507 ........................
820.25(b) ................................................... 7,237 1 7,237 21.13 152,896 ........................
820.30(a)(1) .............................................. 7,237 1 7,237 2.92 21,162 ........................
820.30(b) ................................................... 7,237 1 7,237 9.91 71,718 ........................
820.30(c) ................................................... 7,237 1 7,237 2.92 21,162 ........................
820.30(d) ................................................... 7,237 1 7,237 2.92 21,162 ........................
820.30(e) ................................................... 7,237 1 7,237 38.98 282,115 ........................
820.30(f) .................................................... 7,237 1 7,237 62.37 451,342 $27,359,420
820.30(g) ................................................... 7,237 1 7,237 62.37 451,342 ........................
820.30(h) ................................................... 7,237 1 7,237 5.56 40,236 ........................
820.30(i) .................................................... 7,237 1 7,237 28.77 208,173 ........................
820.30(j) .................................................... 7,237 1 7,237 4.40 31,848 ........................
820.40 ....................................................... 7,237 1 7,237 11.76 85,081 ........................
820.40(b) ................................................... 7,237 1 7,237 ........................ ........................ ........................
820.50 (a)(1) to (a)(3) ............................... 7,237 1 7,237 31.12 225,240 898,500
820.50(b) ................................................... 7,237 1 7,237 10.04 72,679
820.60 ....................................................... 7,237 1 7,237 0.54 3,914 ........................
820.65 ....................................................... 7,237 1 7,237 ........................ ........................ ........................
820.70 (a)(1) to (a)(5) ............................... 7,237 1 7,237 ........................ ........................ ........................
820.70 (b)–(c) ........................................... 7,237 1 7,237 ........................ ........................ ........................
820.70(d) ................................................... 7,237 1 7,237 3.09 22,335 ........................
820.70(e) ................................................... 7,237 1 7,237 ........................ ........................ ........................
820.70 (g)(1) to (g)(3) ............................... 7,237 1 7,237 ........................
820.70(h) ................................................... 7,237 1 7,237 ........................ ........................ ........................
820.70(i) .................................................... 7,237 1 7,237 9.41 68,092 ........................
829.72(a) ................................................... 7,237 1 7,237 5.83 42,165 ........................
820.72 (b)(1) to (b)(3) ............................... 7,237 1 7,237 ........................ ........................ ........................
820.75(a) ................................................... 7,237 1 7,23 72.79 20,172 ........................
820.75(b) ................................................... 7,237 1 7,237 ........................ ........................ ........................
820.75(b)(2) .............................................. 7,237 1 7,237 0.15 1,096 ........................
820.75(c) ................................................... 7,237 1 7,237 0.15 1,096 ........................
820.80 (a)–(e) ........................................... 7,237 1 7,237 ........................ ........................ ........................
820.86 ....................................................... 7,237 1 7,237 ........................ ........................ ........................
820.90(a) ................................................... 7,237 1 7,237 6.11 44,217 ........................
820.90 (b)(1) to (b)(2) ............................... 7,237 1 7,237 6.11 44,217 ........................
820.100 (a)(1) to (a)(7) ............................. 7,237 1 7,237 20.06 145,144 ........................
820.100(b) ................................................. 7,237 1 7,237 ........................ ........................ ........................
820.120 ..................................................... 7,237 1 7,237 ........................ ........................ ........................
820.120(b) ................................................. 7,237 1 7,237 ........................ ........................ ........................
820.120(d) ................................................. 7,237 1 7,237 ........................ ........................ ........................
820.130 ..................................................... 7,237 1 7,237 ........................ ........................ ........................
820.140 ..................................................... 7,237 1 7,237 9.45 68,418 ........................
820.150 (a)–(b) ......................................... 7,237 1 7,237 9.45 68,418 ........................
820.160 (a)–(b) ......................................... 7,237 1 7,237 ........................ ........................ ........................
52653Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
CFR section
Number of
record-keep-
ers
Annual fre-
quency of rec-
ordkeeping
Total annual
records
Hours per
record-keeper Total hours
Total operat-
ing and main-
tenance costs
820.170 (a)–(b) ......................................... 7,237 1 7,237 ........................ ........................ ........................
820.180 ..................................................... 7,237 1 7,237 ........................ ........................ ........................
820.181 (a)–(e) ......................................... 7,237 1 7,237 ........................ ........................ ........................
820.184 (a)–(f) .......................................... 7,237 1 7,237 ........................ ........................ ........................
820.186 ..................................................... 7,237 1 7,237 ........................ ........................ ........................
820.198 (a)–(c) ......................................... 7,237 1 7,237 3.71 26,850 ........................
820.200(a) and 820.200(d) ....................... 7,237 1 7,237 4.35 31,459 ........................
820.250 ..................................................... 7,237 1 7,237 ........................ ........................ ........................
Totals .......................................... 7,237 1 7,237 487.50 3,527,901 28,257,920
1 Incremental increase in hours and costs to achieve compliance with additional requirements.
Note: Totals may not add due to rounding
Under OMB information collection
0910–0073, which expired on June 30,
1995, there were 375,266 burden hours
approved for recordkeeping
requirements currently contained in
part 820 to include 114,882 burden
hours as a one time start up expenditure
for 750 new firms. The additional
requirements contained in this final rule
will add 3,527,901 burden hours to the
burden, resulting in a total annual
recordkeeping burden of 3,903,167
hours. The 3,527,901 burden hours
includes 1,433,579 burden hours for a
one time start up expenditure for 7,237
manufacturers and 2,094,321 burden
hours expended annually by 7,237
manufacturers.
The final rule estimate of
recordkeeping burden includes about
9.6 times as many manufacturers with a
one time start up expenditure, due to
the addition of the design control
requirements, than did FDA’s estimate
of the manufacturers that would have
had a one time start up expenditure
under the old regulation. Further the
recordkeeping burden hour calculations
for the new regulation were done under
contract using a more complex
methodology involving the estimated
noncompliance ratio for small, medium,
large, and very large manufacturers (as
defined above) times the number of
manufacturers in each category and
factors in a rate of product innovation
for new products, including 510(k)
devices. This methodology is more
precise than the methodology
previously utilized. Therefore, it is very
difficult to directly compare the total
burden hours in this final rule as
compared to the estimated burden hours
filed for the old regulation which
expired June 1995.
Approximately 85 percent of the
additional burden hours for the final
rule are from the following four subparts
of part 820: (1) Subpart B—Quality
System Requirements; (2) Subpart C—
Design Controls; (3) Subpart E—
Purchasing Controls; and (4) Subpart J—
Corrective and Preventive Action. Over
45 percent of the 3,527,901 burden
hours are attributed directly to the
addition of design control requirements.
The recordkeeping burden hours for
design control are significant because of
the nature of the new requirements, as
well as in response to numerous
comments on the 1993 and 1995
proposals. The comments requested that
the regulation focus on procedures
required under design control as
compared to prescriptive requirements
on the design activities. The quality
system requirements, as well as the
corrective and preventive action
requirements combined are
approximately 31 percent of the
additional recordkeeping burden hours
and were in response to two major
issues: (1) Most importantly, FDA had
identified these two areas as two of the
top four deficiencies found during
inspections of the medical device
industry, across all sizes of
manufacturers; and (2) numerous
comments requested harmonization
with the ISO 9000 series standards. The
involvement of management with
executive responsibility, the concept of
a total quality system which is a closed
feedback loop system, and the practice
of using that closed loop system in
taking appropriate corrective and
preventive action is paramount in
ensuring that safe and effective medical
devices are available to the public. The
purchasing control requirements and
the respective recordkeeping burden are
approximately 8 percent of the
additional recordkeeping burden.
Purchasing requirements were the
overwhelming choice of the medical
device industry as compared to the
option of the final rule encompassing
component manufacturers. See the
discussion in section V.7. of this
document.
It is important to note that small
manufacturers may comply with this
final rule with less procedures and
paperwork than larger manufacturers of
the same product because the structure
and interfaces for a small manufacturer
often require less documentation and
paperwork.
Although the November 23, 1993,
proposed rule provided a 90 day
comment period under the Paperwork
Reduction Act of 1980, and this final
rule incorporates the comments
received, as required by 44 U.S.C.
section 3507(d), FDA is providing
additional opportunities for public
comment under the Paperwork
Reduction Act of 1995, which applies to
this final rule and was enacted after the
expiration of the comment period.
Therefore, the agency solicits public
comment on the information collection
requirements in order to: (1) Evaluate
whether the proposed collection of
information is necessary for the proper
performance of the functions of the
agency, including whether the
information will have practical utility;
(2) evaluate the accuracy of the agency’s
estimate of the burden of the proposed
collection of information, including the
validity of the methodology and
assumptions used; (3) enhance the
quality, utility, and clarity of the
information to be collected; and (4)
minimize the burden of the collection of
information on those who are to
respond, including through the use of
appropriate automated, electronic,
mechanical, or other technological
collection techniques or other forms of
information technology, e.g., permitting
electronic submission of responses.
Individuals and organizations may
submit comments on the information
collection requirements by December 6,
1996, and should direct comments to
FDA’s Dockets Management Branch
(address above).
Prior to the effective date of this final
rule, FDA will publish a notice in the
Federal Register when the information
collection requirements in this rule are
submitted for OMB approval, and again
when OMB makes a decision to
approve, modify, or disapprove the
52654 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
information collection requirements.
Persons are not required to respond to
a collection of information unless it
displays a currently valid OMB control
number.
X. Congressional Review
This final rule has been determined to
be a major rule for purposes of 5 U.S.C.
801 et seq., Subtitle E of the Small
Business Regulatory Enforcement
Fairness Act of 1996 (Pub. L. 104–121).
FDA is submitting the information and
reports as required by that statute.
XI. References
The following references have been placed
on display in the Dockets Management
Branch and may be seen by interested
persons between 9 a.m. and 4 p.m., Monday
through Friday.
1. ‘‘Device Recalls: A Study of Quality
Problems,’’ FDA, Center for Devices and
Radiological Health, Rockville, MD 20857,
HHS Publication FDA 90–4235, January
1990.
2. ‘‘FDA Medical Device Regulation From
Premarket Review to Recall,’’ Office of
Inspector General, Washington, DC, HHS
Publication OEI 09–90–00040, February
1991.
3. ‘‘Software Related Recalls for Fiscal
Years FY 83—FY 91,’’ FDA, Center for
Devices and Radiological Health, Rockville,
MD 20857, May 1992.
4. ISO 9001:1994 ‘‘Quality Systems—
Model for Quality Assurance in Design,
Development, Production, Installation, and
Servicing.’’
5. ISO draft revision of ISO/CD 13485
‘‘Quality Systems—Medical Devices—
Supplementary Requirements to ISO 9001.’’
6. Federal Register notice entitled
‘‘Medical Devices; Current Good
Manufacturing Practices (CGMP) Regulations
Document; Suggested Changes; Availability,’’
November 30, 1990 (55 FR 49644).
7. Federal Register notice entitled
‘‘Medical Devices; Current Good
Manufacturing Practice (CGMP) Regulations;
Proposed Revisions; Request for Comments,’’
November 23, 1993 (55 FR 61952).
8. Federal Register notice entitled
‘‘Medical Devices; Working Draft of the
Current Good Manufacturing Practice
(CGMP) Final Rule; Notice of Availability;
Request for Comments; Public Meeting,’’ July
24, 1995 (60 FR 37856).
9. European Standard (EN) 46001 ‘‘Quality
Systems—Medical Devices—Particular
Requirements for the Application of EN
29001.’’
10. ‘‘Guidelines on General Principles of
Process Validation,’’ Center for Drugs and
Biologics, and Center for Devices and
Radiological Health, FDA, Rockville, MD
20857, May 11, 1987.
11. ‘‘Medical Devices; Early Warning of
Problems Is Hampered by Severe
Underreporting,’’ United States General
Accounting Office, Washington, DC, GAO/
PEMD–87–1.
List of Subjects
21 CFR Part 808
Intergovernmental relations, Medical
devices.
21 CFR Part 812
Health records, Medical devices,
Medical research, Reporting and
recordkeeping requirements.
21 CFR Part 820
Medical devices, Reporting and
recordkeeping requirements.
Therefore, under the Federal Food,
Drug, and Cosmetic Act and under
authority delegated to the Commissioner
of Food and Drugs, 21 CFR parts 808,
812, and 820 are amended as follows:
PART 808—EXEMPTIONS FROM
FEDERAL PREEMPTION OF STATE
AND LOCAL MEDICAL DEVICE
REQUIREMENTS
1. The authority citation for 21 CFR
part 808 is revised to read as follows:
Authority: Secs. 520, 521, 701 of the
Federal Food, Drug, and Cosmetic Act (21
U.S.C. 360j, 360k, 371).
2. Section 808.1 is amended by
adding new paragraph (d)(10) to read as
follows:
§ 808.1 Scope.
* * * * *
(d) * * *
(10) Part 820 of this chapter (21 CFR
part 820) (CGMP requirements) does not
preempt remedies created by States or
Territories of the United States, the
District of Columbia, or the
Commonwealth of Puerto Rico.
* * * * *
PART 812—INVESTIGATIONAL
DEVICE EXEMPTIONS
3. The authority citation for 21 CFR
part 812 is revised to read as follows:
Authority: Secs. 301, 501, 502, 503, 505,
506, 507, 510, 513–516, 518–520, 701, 702,
704, 721, 801, 803 of the Federal Food, Drug,
and Cosmetic Act (21 U.S.C. 331, 351, 352,
353, 355, 356, 357, 360, 360c-360f, 360h-360j,
371, 372, 374, 379e, 381, 383); secs. 215, 301,
351, 354–360F of the Public Health Service
Act (42 U.S.C. 216, 241, 262, 263b-263n).
4. Section 812.1 Scope is amended by
revising the fourth sentence of
paragraph (a) to read as follows:
§ 812.1 Scope.
(a) * * * An IDE approved under
§ 812.30 or considered approved under
§ 812.2(b) exempts a device from the
requirements of the following sections
of the Federal Food, Drug, and Cosmetic
Act (the act) and regulations issued
thereunder: Misbranding under section
502 of the act, registration, listing, and
premarket notification under section
510, performance standards under
section 514, premarket approval under
section 515, a banned device regulation
under section 516, records and reports
under section 519, restricted device
requirements under section 520(e), good
manufacturing practice requirements
under section 520(f) except for the
requirements found in § 820.30, if
applicable (unless the sponsor states an
intention to comply with these
requirements under § 812.20(b)(3) or
§ 812.140(b)(4)(v)) and color additive
requirements under section 721.
* * * * *
5. Part 820 is revised to read as
follows:
PART 820—QUALITY SYSTEM
REGULATION
Subpart A—General Provisions
Sec.
820.1 Scope.
820.3 Definitions.
820.5 Quality system.
Subpart B—Quality System Requirements
820.20 Management responsibility.
820.22 Quality audit.
820.25 Personnel.
Subpart C—Design Controls
820.30 Design controls.
Subpart D—Document Controls
820.40 Document controls.
Subpart E—Purchasing Controls
820.50 Purchasing controls.
Subpart F—Identification and Traceability
820.60 Identification.
820.65 Traceability.
Subpart G—Production and Process
Controls
820.70 Production and process controls.
820.72 Inspection, measuring, and test
equipment.
820.75 Process validation.
Subpart H—Acceptance Activities
820.80 Receiving, in-process, and finished
device acceptance.
820.86 Acceptance status.
Subpart I—Nonconforming Product
820.90 Nonconforming product.
Subpart J—Corrective and Preventive
Action
820.100 Corrective and preventive action.
Subpart K—Labeling and Packaging
Control
820.120 Device labeling.
820.130 Device packaging.
Subpart L—Handling, Storage, Distribution,
and Installation
820.140 Handling.
820.150 Storage.
52655Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
820.160 Distribution.
820.170 Installation.
Subpart M—Records
820.180 General requirements.
820.181 Device master record.
820.184 Device history record.
820.186 Quality system record.
820.198 Complaint files.
Subpart N—Servicing
820.200 Servicing.
Subpart O—Statistical Techniques
820.250 Statistical techniques.
Authority: Secs. 501, 502, 510, 513, 514,
515, 518, 519, 520, 522, 701, 704, 801, 803
of the Federal Food, Drug, and Cosmetic Act
(21 U.S.C. 351, 352, 360, 360c, 360d, 360e,
360h, 360i, 360j, 360l, 371, 374, 381, 383).
Subpart A—General Provisions
§ 820.1 Scope.
(a) Applicability.
(1) Current good manufacturing
practice (CGMP) requirements are set
forth in this quality system regulation.
The requirements in this part govern the
methods used in, and the facilities and
controls used for, the design,
manufacture, packaging, labeling,
storage, installation, and servicing of all
finished devices intended for human
use. The requirements in this part are
intended to ensure that finished devices
will be safe and effective and otherwise
in compliance with the Federal Food,
Drug, and Cosmetic Act (the act). This
part establishes basic requirements
applicable to manufacturers of finished
medical devices. If a manufacturer
engages in only some operations subject
to the requirements in this part, and not
in others, that manufacturer need only
comply with those requirements
applicable to the operations in which it
is engaged. With respect to class I
devices, design controls apply only to
those devices listed in § 820.30(a)(2).
This regulation does not apply to
manufacturers of components or parts of
finished devices, but such
manufacturers are encouraged to use
appropriate provisions of this regulation
as guidance. Manufacturers of human
blood and blood components are not
subject to this part, but are subject to
part 606 of this chapter.
(2) The provisions of this part shall be
applicable to any finished device as
defined in this part, intended for human
use, that is manufactured, imported, or
offered for import in any State or
Territory of the United States, the
District of Columbia, or the
Commonwealth of Puerto Rico.
(3) In this regulation the term ‘‘where
appropriate’’ is used several times.
When a requirement is qualified by
‘‘where appropriate,’’ it is deemed to be
‘‘appropriate’’ unless the manufacturer
can document justification otherwise. A
requirement is ‘‘appropriate’’ if
nonimplementation could reasonably be
expected to result in the product not
meeting its specified requirements or
the manufacturer not being able to carry
out any necessary corrective action.
(b) Limitations. The quality system
regulation in this part supplements
regulations in other parts of this chapter
except where explicitly stated
otherwise. In the event that it is
impossible to comply with all
applicable regulations, both in this part
and in other parts of this chapter, the
regulations specifically applicable to the
device in question shall supersede any
other generally applicable requirements.
(c) Authority. Part 820 is established
and issued under authority of sections
501, 502, 510, 513, 514, 515, 518, 519,
520, 522, 701, 704, 801, 803 of the act
(21 U.S.C. 351, 352, 360, 360c, 360d,
360e, 360h, 360i, 360j, 360l, 371, 374,
381, 383). The failure to comply with
any applicable provision in this part
renders a device adulterated under
section 501(h) of the act. Such a device,
as well as any person responsible for the
failure to comply, is subject to
regulatory action.
(d) Foreign manufacturers. If a
manufacturer who offers devices for
import into the United States refuses to
permit or allow the completion of a
Food and Drug Administration (FDA)
inspection of the foreign facility for the
purpose of determining compliance
with this part, it shall appear for
purposes of section 801(a) of the act,
that the methods used in, and the
facilities and controls used for, the
design, manufacture, packaging,
labeling, storage, installation, or
servicing of any devices produced at
such facility that are offered for import
into the United States do not conform to
the requirements of section 520(f) of the
act and this part and that the devices
manufactured at that facility are
adulterated under section 501(h) of the
act.
(e) Exemptions or variances. (1) Any
person who wishes to petition for an
exemption or variance from any device
quality system requirement is subject to
the requirements of section 520(f)(2) of
the act. Petitions for an exemption or
variance shall be submitted according to
the procedures set forth in § 10.30 of
this chapter, the FDA’s administrative
procedures. Guidance is available from
the Center for Devices and Radiological
Health, Division of Small Manufacturers
Assistance, (HFZ–220), 1350 Piccard
Dr., Rockville, MD 20850, U.S.A.,
telephone 1–800–638–2041 or 1–301–
443–6597, FAX 301–443–8818.
(2) FDA may initiate and grant a
variance from any device quality system
requirement when the agency
determines that such variance is in the
best interest of the public health. Such
variance will remain in effect only so
long as there remains a public health
need for the device and the device
would not likely be made sufficiently
available without the variance.
§ 820.3 Definitions.
(a) Act means the Federal Food, Drug,
and Cosmetic Act, as amended (secs.
201–903, 52 Stat. 1040 et seq., as
amended (21 U.S.C. 321–394)). All
definitions in section 201 of the act
shall apply to the regulations in this
part.
(b) Complaint means any written,
electronic, or oral communication that
alleges deficiencies related to the
identity, quality, durability, reliability,
safety, effectiveness, or performance of
a device after it is released for
distribution.
(c) Component means any raw
material, substance, piece, part,
software, firmware, labeling, or
assembly which is intended to be
included as part of the finished,
packaged, and labeled device.
(d) Control number means any
distinctive symbols, such as a
distinctive combination of letters or
numbers, or both, from which the
history of the manufacturing, packaging,
labeling, and distribution of a unit, lot,
or batch of finished devices can be
determined.
(e) Design history file (DHF) means a
compilation of records which describes
the design history of a finished device.
(f) Design input means the physical
and performance requirements of a
device that are used as a basis for device
design.
(g) Design output means the results of
a design effort at each design phase and
at the end of the total design effort. The
finished design output is the basis for
the device master record. The total
finished design output consists of the
device, its packaging and labeling, and
the device master record.
(h) Design review means a
documented, comprehensive, systematic
examination of a design to evaluate the
adequacy of the design requirements, to
evaluate the capability of the design to
meet these requirements, and to identify
problems.
(i) Device history record (DHR) means
a compilation of records containing the
production history of a finished device.
(j) Device master record (DMR) means
a compilation of records containing the
procedures and specifications for a
finished device.
52656 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
(k) Establish means define, document
(in writing or electronically), and
implement.
(l) Finished device means any device
or accessory to any device that is
suitable for use or capable of
functioning, whether or not it is
packaged, labeled, or sterilized.
(m) Lot or batch means one or more
components or finished devices that
consist of a single type, model, class,
size, composition, or software version
that are manufactured under essentially
the same conditions and that are
intended to have uniform characteristics
and quality within specified limits.
(n) Management with executive
responsibility means those senior
employees of a manufacturer who have
the authority to establish or make
changes to the manufacturer’s quality
policy and quality system.
(o) Manufacturer means any person
who designs, manufactures, fabricates,
assembles, or processes a finished
device. Manufacturer includes but is not
limited to those who perform the
functions of contract sterilization,
installation, relabeling,
remanufacturing, repacking, or
specification development, and initial
distributors of foreign entities
performing these functions.
(p) Manufacturing material means any
material or substance used in or used to
facilitate the manufacturing process, a
concomitant constituent, or a byproduct
constituent produced during the
manufacturing process, which is present
in or on the finished device as a residue
or impurity not by design or intent of
the manufacturer.
(q) Nonconformity means the
nonfulfillment of a specified
requirement.
(r) Product means components,
manufacturing materials, in- process
devices, finished devices, and returned
devices.
(s) Quality means the totality of
features and characteristics that bear on
the ability of a device to satisfy fitness-
for-use, including safety and
performance.
(t) Quality audit means a systematic,
independent examination of a
manufacturer’s quality system that is
performed at defined intervals and at
sufficient frequency to determine
whether both quality system activities
and the results of such activities comply
with quality system procedures, that
these procedures are implemented
effectively, and that these procedures
are suitable to achieve quality system
objectives.
(u) Quality policy means the overall
intentions and direction of an
organization with respect to quality, as
established by management with
executive responsibility.
(v) Quality system means the
organizational structure,
responsibilities, procedures, processes,
and resources for implementing quality
management.
(w) Remanufacturer means any
person who processes, conditions,
renovates, repackages, restores, or does
any other act to a finished device that
significantly changes the finished
device’s performance or safety
specifications, or intended use.
(x) Rework means action taken on a
nonconforming product so that it will
fulfill the specified DMR requirements
before it is released for distribution.
(y) Specification means any
requirement with which a product,
process, service, or other activity must
conform.
(z) Validation means confirmation by
examination and provision of objective
evidence that the particular
requirements for a specific intended use
can be consistently fulfilled.
(1) Process validation means
establishing by objective evidence that a
process consistently produces a result or
product meeting its predetermined
specifications.
(2) Design validation means
establishing by objective evidence that
device specifications conform with user
needs and intended use(s).
(aa) Verification means confirmation
by examination and provision of
objective evidence that specified
requirements have been fulfilled.
§ 820.5 Quality system.
Each manufacturer shall establish and
maintain a quality system that is
appropriate for the specific medical
device(s) designed or manufactured, and
that meets the requirements of this part.
Subpart B—Quality System
Requirements
§ 820.20 Management responsibility.
(a) Quality policy. Management with
executive responsibility shall establish
its policy and objectives for, and
commitment to, quality. Management
with executive responsibility shall
ensure that the quality policy is
understood, implemented, and
maintained at all levels of the
organization.
(b) Organization. Each manufacturer
shall establish and maintain an
adequate organizational structure to
ensure that devices are designed and
produced in accordance with the
requirements of this part.
(1) Responsibility and authority. Each
manufacturer shall establish the
appropriate responsibility, authority,
and interrelation of all personnel who
manage, perform, and assess work
affecting quality, and provide the
independence and authority necessary
to perform these tasks.
(2) Resources. Each manufacturer
shall provide adequate resources,
including the assignment of trained
personnel, for management,
performance of work, and assessment
activities, including internal quality
audits, to meet the requirements of this
part.
(3) Management representative.
Management with executive
responsibility shall appoint, and
document such appointment of, a
member of management who,
irrespective of other responsibilities,
shall have established authority over
and responsibility for:
(i) Ensuring that quality system
requirements are effectively established
and effectively maintained in
accordance with this part; and
(ii) Reporting on the performance of
the quality system to management with
executive responsibility for review.
(c) Management review. Management
with executive responsibility shall
review the suitability and effectiveness
of the quality system at defined
intervals and with sufficient frequency
according to established procedures to
ensure that the quality system satisfies
the requirements of this part and the
manufacturer’s established quality
policy and objectives. The dates and
results of quality system reviews shall
be documented.
(d) Quality planning. Each
manufacturer shall establish a quality
plan which defines the quality
practices, resources, and activities
relevant to devices that are designed
and manufactured. The manufacturer
shall establish how the requirements for
quality will be met.
(e) Quality system procedures. Each
manufacturer shall establish quality
system procedures and instructions. An
outline of the structure of the
documentation used in the quality
system shall be established where
appropriate.
§ 820.22 Quality audit.
Each manufacturer shall establish
procedures for quality audits and
conduct such audits to assure that the
quality system is in compliance with the
established quality system requirements
and to determine the effectiveness of the
quality system. Quality audits shall be
conducted by individuals who do not
have direct responsibility for the matters
being audited. Corrective action(s),
including a reaudit of deficient matters,
52657Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
shall be taken when necessary. A report
of the results of each quality audit, and
reaudit(s) where taken, shall be made
and such reports shall be reviewed by
management having responsibility for
the matters audited. The dates and
results of quality audits and reaudits
shall be documented.
§ 820.25 Personnel.
(a) General. Each manufacturer shall
have sufficient personnel with the
necessary education, background,
training, and experience to assure that
all activities required by this part are
correctly performed.
(b) Training. Each manufacturer shall
establish procedures for identifying
training needs and ensure that all
personnel are trained to adequately
perform their assigned responsibilities.
Training shall be documented.
(1) As part of their training, personnel
shall be made aware of device defects
which may occur from the improper
performance of their specific jobs.
(2) Personnel who perform
verification and validation activities
shall be made aware of defects and
errors that may be encountered as part
of their job functions.
Subpart C—Design Controls
§ 820.30 Design controls.
(a) General. (1) Each manufacturer of
any class III or class II device, and the
class I devices listed in paragraph (a)(2)
of this section, shall establish and
maintain procedures to control the
design of the device in order to ensure
that specified design requirements are
met.
(2) The following class I devices are
subject to design controls:
(i) Devices automated with computer
software; and
(ii) The devices listed in the following
chart.
Section Device
868.6810 Catheter, Tracheobronchial Suc-
tion.
878.4460 Glove, Surgeon’s.
880.6760 Restraint, Protective.
892.5650 System, Applicator, Radio-
nuclide, Manual.
892.5740 Source, Radionuclide Tele-
therapy.
(b) Design and development planning.
Each manufacturer shall establish and
maintain plans that describe or
reference the design and development
activities and define responsibility for
implementation. The plans shall
identify and describe the interfaces with
different groups or activities that
provide, or result in, input to the design
and development process. The plans
shall be reviewed, updated, and
approved as design and development
evolves.
(c) Design input. Each manufacturer
shall establish and maintain procedures
to ensure that the design requirements
relating to a device are appropriate and
address the intended use of the device,
including the needs of the user and
patient. The procedures shall include a
mechanism for addressing incomplete,
ambiguous, or conflicting requirements.
The design input requirements shall be
documented and shall be reviewed and
approved by a designated individual(s).
The approval, including the date and
signature of the individual(s) approving
the requirements, shall be documented.
(d) Design output. Each manufacturer
shall establish and maintain procedures
for defining and documenting design
output in terms that allow an adequate
evaluation of conformance to design
input requirements. Design output
procedures shall contain or make
reference to acceptance criteria and
shall ensure that those design outputs
that are essential for the proper
functioning of the device are identified.
Design output shall be documented,
reviewed, and approved before release.
The approval, including the date and
signature of the individual(s) approving
the output, shall be documented.
(e) Design review. Each manufacturer
shall establish and maintain procedures
to ensure that formal documented
reviews of the design results are
planned and conducted at appropriate
stages of the device’s design
development. The procedures shall
ensure that participants at each design
review include representatives of all
functions concerned with the design
stage being reviewed and an
individual(s) who does not have direct
responsibility for the design stage being
reviewed, as well as any specialists
needed. The results of a design review,
including identification of the design,
the date, and the individual(s)
performing the review, shall be
documented in the design history file
(the DHF).
(f) Design verification. Each
manufacturer shall establish and
maintain procedures for verifying the
device design. Design verification shall
confirm that the design output meets the
design input requirements. The results
of the design verification, including
identification of the design, method(s),
the date, and the individual(s)
performing the verification, shall be
documented in the DHF.
(g) Design validation. Each
manufacturer shall establish and
maintain procedures for validating the
device design. Design validation shall
be performed under defined operating
conditions on initial production units,
lots, or batches, or their equivalents.
Design validation shall ensure that
devices conform to defined user needs
and intended uses and shall include
testing of production units under actual
or simulated use conditions. Design
validation shall include software
validation and risk analysis, where
appropriate. The results of the design
validation, including identification of
the design, method(s), the date, and the
individual(s) performing the validation,
shall be documented in the DHF.
(h) Design transfer. Each
manufacturer shall establish and
maintain procedures to ensure that the
device design is correctly translated into
production specifications.
(i) Design changes. Each manufacturer
shall establish and maintain procedures
for the identification, documentation,
validation or where appropriate
verification, review, and approval of
design changes before their
implementation.
(j) Design history file. Each
manufacturer shall establish and
maintain a DHF for each type of device.
The DHF shall contain or reference the
records necessary to demonstrate that
the design was developed in accordance
with the approved design plan and the
requirements of this part.
Subpart D—Document Controls
§ 820.40 Document controls.
Each manufacturer shall establish and
maintain procedures to control all
documents that are required by this
part. The procedures shall provide for
the following:
(a) Document approval and
distribution. Each manufacturer shall
designate an individual(s) to review for
adequacy and approve prior to issuance
all documents established to meet the
requirements of this part. The approval,
including the date and signature of the
individual(s) approving the document,
shall be documented. Documents
established to meet the requirements of
this part shall be available at all
locations for which they are designated,
used, or otherwise necessary, and all
obsolete documents shall be promptly
removed from all points of use or
otherwise prevented from unintended
use.
(b) Document changes. Changes to
documents shall be reviewed and
approved by an individual(s) in the
same function or organization that
performed the original review and
approval, unless specifically designated
otherwise. Approved changes shall be
52658 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
communicated to the appropriate
personnel in a timely manner. Each
manufacturer shall maintain records of
changes to documents. Change records
shall include a description of the
change, identification of the affected
documents, the signature of the
approving individual(s), the approval
date, and when the change becomes
effective.
Subpart E—Purchasing Controls
§ 820.50 Purchasing controls.
Each manufacturer shall establish and
maintain procedures to ensure that all
purchased or otherwise received
product and services conform to
specified requirements.
(a) Evaluation of suppliers,
contractors, and consultants. Each
manufacturer shall establish and
maintain the requirements, including
quality requirements, that must be met
by suppliers, contractors, and
consultants. Each manufacturer shall:
(1) Evaluate and select potential
suppliers, contractors, and consultants
on the basis of their ability to meet
specified requirements, including
quality requirements. The evaluation
shall be documented.
(2) Define the type and extent of
control to be exercised over the product,
services, suppliers, contractors, and
consultants, based on the evaluation
results.
(3) Establish and maintain records of
acceptable suppliers, contractors, and
consultants.
(b) Purchasing data. Each
manufacturer shall establish and
maintain data that clearly describe or
reference the specified requirements,
including quality requirements, for
purchased or otherwise received
product and services. Purchasing
documents shall include, where
possible, an agreement that the
suppliers, contractors, and consultants
agree to notify the manufacturer of
changes in the product or service so that
manufacturers may determine whether
the changes may affect the quality of a
finished device. Purchasing data shall
be approved in accordance with
§ 820.40.
Subpart F—Identification and
Traceability
§ 820.60 Identification.
Each manufacturer shall establish and
maintain procedures for identifying
product during all stages of receipt,
production, distribution, and
installation to prevent mixups.
§ 820.65 Traceability.
Each manufacturer of a device that is
intended for surgical implant into the
body or to support or sustain life and
whose failure to perform when properly
used in accordance with instructions for
use provided in the labeling can be
reasonably expected to result in a
significant injury to the user shall
establish and maintain procedures for
identifying with a control number each
unit, lot, or batch of finished devices
and where appropriate components. The
procedures shall facilitate corrective
action. Such identification shall be
documented in the DHR.
Subpart G—Production and Process
Controls
§ 820.70 Production and process controls.
(a) General. Each manufacturer shall
develop, conduct, control, and monitor
production processes to ensure that a
device conforms to its specifications.
Where deviations from device
specifications could occur as a result of
the manufacturing process, the
manufacturer shall establish and
maintain process control procedures
that describe any process controls
necessary to ensure conformance to
specifications. Where process controls
are needed they shall include:
(1) Documented instructions, standard
operating procedures (SOP’s), and
methods that define and control the
manner of production;
(2) Monitoring and control of process
parameters and component and device
characteristics during production;
(3) Compliance with specified
reference standards or codes;
(4) The approval of processes and
process equipment; and
(5) Criteria for workmanship which
shall be expressed in documented
standards or by means of identified and
approved representative samples.
(b) Production and process changes.
Each manufacturer shall establish and
maintain procedures for changes to a
specification, method, process, or
procedure. Such changes shall be
verified or where appropriate validated
according to § 820.75, before
implementation and these activities
shall be documented. Changes shall be
approved in accordance with § 820.40.
(c) Environmental control. Where
environmental conditions could
reasonably be expected to have an
adverse effect on product quality, the
manufacturer shall establish and
maintain procedures to adequately
control these environmental conditions.
Environmental control system(s) shall
be periodically inspected to verify that
the system, including necessary
equipment, is adequate and functioning
properly. These activities shall be
documented and reviewed.
(d) Personnel. Each manufacturer
shall establish and maintain
requirements for the health, cleanliness,
personal practices, and clothing of
personnel if contact between such
personnel and product or environment
could reasonably be expected to have an
adverse effect on product quality. The
manufacturer shall ensure that
maintenance and other personnel who
are required to work temporarily under
special environmental conditions are
appropriately trained or supervised by a
trained individual.
(e) Contamination control. Each
manufacturer shall establish and
maintain procedures to prevent
contamination of equipment or product
by substances that could reasonably be
expected to have an adverse effect on
product quality.
(f) Buildings. Buildings shall be of
suitable design and contain sufficient
space to perform necessary operations,
prevent mixups, and assure orderly
handling.
(g) Equipment. Each manufacturer
shall ensure that all equipment used in
the manufacturing process meets
specified requirements and is
appropriately designed, constructed,
placed, and installed to facilitate
maintenance, adjustment, cleaning, and
use.
(1) Maintenance schedule. Each
manufacturer shall establish and
maintain schedules for the adjustment,
cleaning, and other maintenance of
equipment to ensure that manufacturing
specifications are met. Maintenance
activities, including the date and
individual(s) performing the
maintenance activities, shall be
documented.
(2) Inspection. Each manufacturer
shall conduct periodic inspections in
accordance with established procedures
to ensure adherence to applicable
equipment maintenance schedules. The
inspections, including the date and
individual(s) conducting the
inspections, shall be documented.
(3) Adjustment. Each manufacturer
shall ensure that any inherent
limitations or allowable tolerances are
visibly posted on or near equipment
requiring periodic adjustments or are
readily available to personnel
performing these adjustments.
(h) Manufacturing material. Where a
manufacturing material could
reasonably be expected to have an
adverse effect on product quality, the
manufacturer shall establish and
maintain procedures for the use and
removal of such manufacturing material
52659Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
to ensure that it is removed or limited
to an amount that does not adversely
affect the device’s quality. The removal
or reduction of such manufacturing
material shall be documented.
(i) Automated processes. When
computers or automated data processing
systems are used as part of production
or the quality system, the manufacturer
shall validate computer software for its
intended use according to an
established protocol. All software
changes shall be validated before
approval and issuance. These validation
activities and results shall be
documented.
§ 820.72 Inspection, measuring, and test
equipment.
(a) Control of inspection, measuring,
and test equipment. Each manufacturer
shall ensure that all inspection,
measuring, and test equipment,
including mechanical, automated, or
electronic inspection and test
equipment, is suitable for its intended
purposes and is capable of producing
valid results. Each manufacturer shall
establish and maintain procedures to
ensure that equipment is routinely
calibrated, inspected, checked, and
maintained. The procedures shall
include provisions for handling,
preservation, and storage of equipment,
so that its accuracy and fitness for use
are maintained. These activities shall be
documented.
(b) Calibration. Calibration
procedures shall include specific
directions and limits for accuracy and
precision. When accuracy and precision
limits are not met, there shall be
provisions for remedial action to
reestablish the limits and to evaluate
whether there was any adverse effect on
the device’s quality. These activities
shall be documented.
(1) Calibration standards. Calibration
standards used for inspection,
measuring, and test equipment shall be
traceable to national or international
standards. If national or international
standards are not practical or available,
the manufacturer shall use an
independent reproducible standard. If
no applicable standard exists, the
manufacturer shall establish and
maintain an in-house standard.
(2) Calibration records. The
equipment identification, calibration
dates, the individual performing each
calibration, and the next calibration date
shall be documented. These records
shall be displayed on or near each piece
of equipment or shall be readily
available to the personnel using such
equipment and to the individuals
responsible for calibrating the
equipment.
§ 820.75 Process validation.
(a) Where the results of a process
cannot be fully verified by subsequent
inspection and test, the process shall be
validated with a high degree of
assurance and approved according to
established procedures. The validation
activities and results, including the date
and signature of the individual(s)
approving the validation and where
appropriate the major equipment
validated, shall be documented.
(b) Each manufacturer shall establish
and maintain procedures for monitoring
and control of process parameters for
validated processes to ensure that the
specified requirements continue to be
met.
(1) Each manufacturer shall ensure
that validated processes are performed
by qualified individual(s).
(2) For validated processes, the
monitoring and control methods and
data, the date performed, and, where
appropriate, the individual(s)
performing the process or the major
equipment used shall be documented.
(c) When changes or process
deviations occur, the manufacturer shall
review and evaluate the process and
perform revalidation where appropriate.
These activities shall be documented.
Subpart H—Acceptance Activities
§ 820.80 Receiving, in-process, and
finished device acceptance.
(a) General. Each manufacturer shall
establish and maintain procedures for
acceptance activities. Acceptance
activities include inspections, tests, or
other verification activities.
(b) Receiving acceptance activities.
Each manufacturer shall establish and
maintain procedures for acceptance of
incoming product. Incoming product
shall be inspected, tested, or otherwise
verified as conforming to specified
requirements. Acceptance or rejection
shall be documented.
(c) In-process acceptance activities.
Each manufacturer shall establish and
maintain acceptance procedures, where
appropriate, to ensure that specified
requirements for in-process product are
met. Such procedures shall ensure that
in-process product is controlled until
the required inspection and tests or
other verification activities have been
completed, or necessary approvals are
received, and are documented.
(d) Final acceptance activities. Each
manufacturer shall establish and
maintain procedures for finished device
acceptance to ensure that each
production run, lot, or batch of finished
devices meets acceptance criteria.
Finished devices shall be held in
quarantine or otherwise adequately
controlled until released. Finished
devices shall not be released for
distribution until: (1) The activities
required in the DMR are completed; (2)
the associated data and documentation
is reviewed; (3) the release is authorized
by the signature of a designated
individual(s); and (4) the authorization
is dated.
(e) Acceptance records. Each
manufacturer shall document
acceptance activities required by this
part. These records shall include: (1)
The acceptance activities performed; (2)
the dates acceptance activities are
performed; (3) the results; (4) the
signature of the individual(s)
conducting the acceptance activities;
and (5) where appropriate the
equipment used. These records shall be
part of the DHR.
§ 820.86 Acceptance status.
Each manufacturer shall identify by
suitable means the acceptance status of
product, to indicate the conformance or
nonconformance of product with
acceptance criteria. The identification of
acceptance status shall be maintained
throughout manufacturing, packaging,
labeling, installation, and servicing of
the product to ensure that only product
which has passed the required
acceptance activities is distributed,
used, or installed.
Subpart I—Nonconforming Product
§ 820.90 Nonconforming product.
(a) Control of nonconforming product.
Each manufacturer shall establish and
maintain procedures to control product
that does not conform to specified
requirements. The procedures shall
address the identification,
documentation, evaluation, segregation,
and disposition of nonconforming
product. The evaluation of
nonconformance shall include a
determination of the need for an
investigation and notification of the
persons or organizations responsible for
the nonconformance. The evaluation
and any investigation shall be
documented.
(b) Nonconformity review and
disposition. (1) Each manufacturer shall
establish and maintain procedures that
define the responsibility for review and
the authority for the disposition of
nonconforming product. The procedures
shall set forth the review and
disposition process. Disposition of
nonconforming product shall be
documented. Documentation shall
include the justification for use of
nonconforming product and the
signature of the individual(s)
authorizing the use.
52660 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
(2) Each manufacturer shall establish
and maintain procedures for rework, to
include retesting and reevaluation of the
nonconforming product after rework, to
ensure that the product meets its current
approved specifications. Rework and
reevaluation activities, including a
determination of any adverse effect from
the rework upon the product, shall be
documented in the DHR.
Subpart J—Corrective and Preventive
Action
§ 820.100 Corrective and preventive
action.
(a) Each manufacturer shall establish
and maintain procedures for
implementing corrective and preventive
action. The procedures shall include
requirements for:
(1) Analyzing processes, work
operations, concessions, quality audit
reports, quality records, service records,
complaints, returned product, and other
sources of quality data to identify
existing and potential causes of
nonconforming product, or other quality
problems. Appropriate statistical
methodology shall be employed where
necessary to detect recurring quality
problems;
(2) Investigating the cause of
nonconformities relating to product,
processes, and the quality system;
(3) Identifying the action(s) needed to
correct and prevent recurrence of
nonconforming product and other
quality problems;
(4) Verifying or validating the
corrective and preventive action to
ensure that such action is effective and
does not adversely affect the finished
device;
(5) Implementing and recording
changes in methods and procedures
needed to correct and prevent identified
quality problems;
(6) Ensuring that information related
to quality problems or nonconforming
product is disseminated to those
directly responsible for assuring the
quality of such product or the
prevention of such problems; and
(7) Submitting relevant information
on identified quality problems, as well
as corrective and preventive actions, for
management review.
(b) All activities required under this
section, and their results, shall be
documented.
Subpart K—Labeling and Packaging
Control
§ 820.120 Device labeling.
Each manufacturer shall establish and
maintain procedures to control labeling
activities.
(a) Label integrity. Labels shall be
printed and applied so as to remain
legible and affixed during the customary
conditions of processing, storage,
handling, distribution, and where
appropriate use.
(b) Labeling inspection. Labeling shall
not be released for storage or use until
a designated individual(s) has examined
the labeling for accuracy including,
where applicable, the correct expiration
date, control number, storage
instructions, handling instructions, and
any additional processing instructions.
The release, including the date and
signature of the individual(s)
performing the examination, shall be
documented in the DHR.
(c) Labeling storage. Each
manufacturer shall store labeling in a
manner that provides proper
identification and is designed to prevent
mixups.
(d) Labeling operations. Each
manufacturer shall control labeling and
packaging operations to prevent labeling
mixups. The label and labeling used for
each production unit, lot, or batch shall
be documented in the DHR.
(e) Control number. Where a control
number is required by § 820.65, that
control number shall be on or shall
accompany the device through
distribution.
§ 820.130 Device packaging.
Each manufacturer shall ensure that
device packaging and shipping
containers are designed and constructed
to protect the device from alteration or
damage during the customary
conditions of processing, storage,
handling, and distribution.
Subpart L—Handling, Storage,
Distribution, and Installation
§ 820.140 Handling.
Each manufacturer shall establish and
maintain procedures to ensure that
mixups, damage, deterioration,
contamination, or other adverse effects
to product do not occur during
handling.
§ 820.150 Storage.
(a) Each manufacturer shall establish
and maintain procedures for the control
of storage areas and stock rooms for
product to prevent mixups, damage,
deterioration, contamination, or other
adverse effects pending use or
distribution and to ensure that no
obsolete, rejected, or deteriorated
product is used or distributed. When the
quality of product deteriorates over
time, it shall be stored in a manner to
facilitate proper stock rotation, and its
condition shall be assessed as
appropriate.
(b) Each manufacturer shall establish
and maintain procedures that describe
the methods for authorizing receipt from
and dispatch to storage areas and stock
rooms.
§ 820.160 Distribution.
(a) Each manufacturer shall establish
and maintain procedures for control and
distribution of finished devices to
ensure that only those devices approved
for release are distributed and that
purchase orders are reviewed to ensure
that ambiguities and errors are resolved
before devices are released for
distribution. Where a device’s fitness for
use or quality deteriorates over time, the
procedures shall ensure that expired
devices or devices deteriorated beyond
acceptable fitness for use are not
distributed.
(b) Each manufacturer shall maintain
distribution records which include or
refer to the location of:
(1) The name and address of the
initial consignee;
(2) The identification and quantity of
devices shipped;
(3) The date shipped; and
(4) Any control number(s) used.
§ 820.170 Installation.
(a) Each manufacturer of a device
requiring installation shall establish and
maintain adequate installation and
inspection instructions, and where
appropriate test procedures. Instructions
and procedures shall include directions
for ensuring proper installation so that
the device will perform as intended
after installation. The manufacturer
shall distribute the instructions and
procedures with the device or otherwise
make them available to the person(s)
installing the device.
(b) The person installing the device
shall ensure that the installation,
inspection, and any required testing are
performed in accordance with the
manufacturer’s instructions and
procedures and shall document the
inspection and any test results to
demonstrate proper installation.
Subpart M—Records
§ 820.180 General requirements.
All records required by this part shall
be maintained at the manufacturing
establishment or other location that is
reasonably accessible to responsible
officials of the manufacturer and to
employees of FDA designated to
perform inspections. Such records,
including those not stored at the
inspected establishment, shall be made
readily available for review and copying
by FDA employee(s). Such records shall
be legible and shall be stored to
52661Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
minimize deterioration and to prevent
loss. Those records stored in automated
data processing systems shall be backed
up.
(a) Confidentiality. Records deemed
confidential by the manufacturer may be
marked to aid FDA in determining
whether information may be disclosed
under the public information regulation
in part 20 of this chapter.
(b) Record retention period. All
records required by this part shall be
retained for a period of time equivalent
to the design and expected life of the
device, but in no case less than 2 years
from the date of release for commercial
distribution by the manufacturer.
(c) Exceptions. This section does not
apply to the reports required by
§ 820.20(c) Management review,
§ 820.22 Quality audits, and supplier
audit reports used to meet the
requirements of § 820.50(a) Evaluation
of suppliers, contractors, and
consultants, but does apply to
procedures established under these
provisions. Upon request of a
designated employee of FDA, an
employee in management with
executive responsibility shall certify in
writing that the management reviews
and quality audits required under this
part, and supplier audits where
applicable, have been performed and
documented, the dates on which they
were performed, and that any required
corrective action has been undertaken.
§ 820.181 Device master record.
Each manufacturer shall maintain
device master records (DMR’s). Each
manufacturer shall ensure that each
DMR is prepared and approved in
accordance with § 820.40. The DMR for
each type of device shall include, or
refer to the location of, the following
information:
(a) Device specifications including
appropriate drawings, composition,
formulation, component specifications,
and software specifications;
(b) Production process specifications
including the appropriate equipment
specifications, production methods,
production procedures, and production
environment specifications;
(c) Quality assurance procedures and
specifications including acceptance
criteria and the quality assurance
equipment to be used;
(d) Packaging and labeling
specifications, including methods and
processes used; and
(e) Installation, maintenance, and
servicing procedures and methods.
§ 820.184 Device history record.
Each manufacturer shall maintain
device history records (DHR’s). Each
manufacturer shall establish and
maintain procedures to ensure that
DHR’s for each batch, lot, or unit are
maintained to demonstrate that the
device is manufactured in accordance
with the DMR and the requirements of
this part. The DHR shall include, or
refer to the location of, the following
information:
(a) The dates of manufacture;
(b) The quantity manufactured;
(c) The quantity released for
distribution;
(d) The acceptance records which
demonstrate the device is manufactured
in accordance with the DMR;
(e) The primary identification label
and labeling used for each production
unit; and
(f) Any device identification(s) and
control number(s) used.
§ 820.186 Quality system record.
Each manufacturer shall maintain a
quality system record (QSR). The QSR
shall include, or refer to the location of,
procedures and the documentation of
activities required by this part that are
not specific to a particular type of
device(s), including, but not limited to,
the records required by § 820.20. Each
manufacturer shall ensure that the QSR
is prepared and approved in accordance
with § 820.40.
§ 820.198 Complaint files.
(a) Each manufacturer shall maintain
complaint files. Each manufacturer shall
establish and maintain procedures for
receiving, reviewing, and evaluating
complaints by a formally designated
unit. Such procedures shall ensure that:
(1) All complaints are processed in a
uniform and timely manner;
(2) Oral complaints are documented
upon receipt; and
(3) Complaints are evaluated to
determine whether the complaint
represents an event which is required to
be reported to FDA under part 803 or
804 of this chapter, Medical Device
Reporting.
(b) Each manufacturer shall review
and evaluate all complaints to
determine whether an investigation is
necessary. When no investigation is
made, the manufacturer shall maintain
a record that includes the reason no
investigation was made and the name of
the individual responsible for the
decision not to investigate.
(c) Any complaint involving the
possible failure of a device, labeling, or
packaging to meet any of its
specifications shall be reviewed,
evaluated, and investigated, unless such
investigation has already been
performed for a similar complaint and
another investigation is not necessary.
(d) Any complaint that represents an
event which must be reported to FDA
under part 803 or 804 of this chapter
shall be promptly reviewed, evaluated,
and investigated by a designated
individual(s) and shall be maintained in
a separate portion of the complaint files
or otherwise clearly identified. In
addition to the information required by
§ 820.198(e), records of investigation
under this paragraph shall include a
determination of:
(1) Whether the device failed to meet
specifications;
(2) Whether the device was being
used for treatment or diagnosis; and
(3) The relationship, if any, of the
device to the reported incident or
adverse event.
(e) When an investigation is made
under this section, a record of the
investigation shall be maintained by the
formally designated unit identified in
paragraph (a) of this section. The record
of investigation shall include:
(1) The name of the device;
(2) The date the complaint was
received;
(3) Any device identification(s) and
control number(s) used;
(4) The name, address, and phone
number of the complainant;
(5) The nature and details of the
complaint;
(6) The dates and results of the
investigation;
(7) Any corrective action taken; and
(8) Any reply to the complainant.
(f) When the manufacturer’s formally
designated complaint unit is located at
a site separate from the manufacturing
establishment, the investigated
complaint(s) and the record(s) of
investigation shall be reasonably
accessible to the manufacturing
establishment.
(g) If a manufacturer’s formally
designated complaint unit is located
outside of the United States, records
required by this section shall be
reasonably accessible in the United
States at either:
(1) A location in the United States
where the manufacturer’s records are
regularly kept; or
(2) The location of the initial
distributor.
Subpart N—Servicing
§ 820.200 Servicing.
(a) Where servicing is a specified
requirement, each manufacturer shall
establish and maintain instructions and
procedures for performing and verifying
that the servicing meets the specified
requirements.
(b) Each manufacturer shall analyze
service reports with appropriate
52662 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
statistical methodology in accordance
with § 820.100.
(c) Each manufacturer who receives a
service report that represents an event
which must be reported to FDA under
part 803 or 804 of this chapter shall
automatically consider the report a
complaint and shall process it in
accordance with the requirements of
§ 820.198.
(d) Service reports shall be
documented and shall include:
(1) The name of the device serviced;
(2) Any device identification(s) and
control number(s) used;
(3) The date of service;
(4) The individual(s) servicing the
device;
(5) The service performed; and
(6) The test and inspection data.
Subpart O—Statistical Techniques
§ 820.250 Statistical techniques.
(a) Where appropriate, each
manufacturer shall establish and
maintain procedures for identifying
valid statistical techniques required for
establishing, controlling, and verifying
the acceptability of process capability
and product characteristics.
(b) Sampling plans, when used, shall
be written and based on a valid
statistical rationale. Each manufacturer
shall establish and maintain procedures
to ensure that sampling methods are
adequate for their intended use and to
ensure that when changes occur the
sampling plans are reviewed. These
activities shall be documented.
Dated: October 1, 1996.
David A. Kessler,
Commissioner of Food and Drugs.
Donna E. Shalala,
Secretary of Health and Human Services.
[FR Doc. 96–25720 Filed 10–3–96; 11:22 am]
BILLING CODE 4160–01–P