An overview of 21 CFR Part 820 - quality systems for medical device manufacturers
What is 21 CFR Part 820?
21 CFR 820 is the FDA federal regulation that pertains to quality systems for medical device manufacturers, and it is part of the agency’s set of Current Good Manufacturing Practices (CGMP) for industry. Also referred to as the FDA’s quality system regulation (QSR), the regulation defines design controls and quality processes at all stages of device development in order to ensure that all medical devices marketed in the United States are safe and effective.
21 CFR 820 consists of 15 subparts, which define quality system requirements for each stage and function within the medical device manufacturing process. We define each subpart below.
Federal regulations are organized as Title → Chapter → Subchapter → Part, which means that 21 CFR 820 is short-hand for:
21 CFR 820 vs ISO 13485
ISO 13485 is the de facto international quality system standard for medical device manufacturers, but this is not currently the standard in the United States. While Part 820 and ISO 13485 are structured differently, they have no conflicting requirements. Therefore, companies that are marketing medical devices in the U.S. and in other markets will need to comply with both ISO 13485 and the FDA’s QSR, as defined in 21 CFR 820.
However, the FDA is moving towards harmonizing these standards, and on February 23, 2022 issued a proposed rule to amend the QSR to align more closely with the international consensus standard for Quality Management Systems, primarily by incorporating reference to the ISO 13485 standard. The FDA has published FAQ’s about the proposed rule.
21 CFR Part 820 Requirements
Part 820: General Controls (subpart A)
The General Controls subpart contains three sections providing general information about the regulation, including the scope and applicability along with key definitions.
Scope
The regulation defines current good manufacturing practice (CGMP) requirements governing the methods, facilities, and controls used for the “design, manufacture, packaging, labeling, storage, installation, and servicing of all finished devices intended for human use." Specifically, this subpart defines:
- Applicability:
The requirements of this regulation are intended to ensure the safety and efficacy of all finished medical devices intended for human use that are manufactured in or imported into the United States. Manufacturers that are involved in some, but not all, manufacturing operations should comply with those requirements that are applicable to the functions they are performing.
Exceptions:
- This regulation does not apply to manufacturers of medical device components, but such manufacturers are encouraged to use this regulation as guidance.
- Class I medical devices are exempt from the Design Controls defined in this regulation, except for those listed in § 820.30(a)(2).
- Manufacturers of blood and blood components are not subject to this regulation but are subject to Biologics good manufacturing practices as defined in Subchapter F, Part 606 of the regulation.
Definitions
This section of the regulation contains definitions for a number of terms used throughout the document. The following are the major definitions related to quality records:
- Design history file (DHF): A compilation of records that describes the design history of a finished device.
- Design input: The physical and performance requirements of a device that are used as a basis for device design.
- Design output: The results of a design effort at each design phase and at the end of the total design effort. The finished design output is the basis for the device master record. The total finished design output consists of the device, its packaging and labeling, and the device master record.
- Device history record (DHR): A compilation of records containing the production history of a finished device.
- Device master record (DMR): A compilation of records containing the procedures and specifications for a finished device.
Quality System
The section of the regulation sets the basic requirement for a quality system by stating that “Each manufacturer shall establish and maintain a quality system that is appropriate for the specific medical device(s) designed or manufactured, and that meets the requirements of this part.”
The term “appropriate” is used throughout this regulation and can be open to interpretation. A manufacturer, however, should assume that all requirements are appropriate and applicable except in cases where non-implementation of the requirement can be shown to have no effect on the product's specified requirements or ability to carry out necessary corrective actions.
Quality system requirements (subpart B)
This section of the regulation defines the overall responsibilities and the resources required for the management of the quality system.
Management responsibilities
Executive management is responsible for establishing a quality policy and ensuring adequate resources to effectively maintain and manage the quality system. In addition, management is responsible for establishing a specific quality plan, consisting of relevant practices, resources, activities, and procedures.
Quality audit
Periodic audits of the quality system are required to be conducted by personnel not directly responsible for the activities being audited. The dates and results of each audit need to be documented, along with the results of the audit. It is expected that corrective actions and, when necessary, reaudits, be performed for any identified noncompliances.
Personnel
Manufacturers are responsible for assigning sufficient personnel with appropriate experience and training to perform all tasks required by the quality system plan.
Design controls (subpart C)
Manufacturers of all class II and class III medical devices, along with the specific class I devices listed in paragraph (a)(2) of this regulation, are required to establish design control procedures that ensure design requirements are met as specified.
Design controls shall define:
- Design and development planning - Plans that describe the design and development activities, and responsibilities for these activities and their implementation.
- Design input - Procedures that ensure design requirements are appropriate and address the intended use of the device.
- Design output - Procedures that document design output, including acceptance criteria, so that conformance to design input requirements can be adequately evaluated.
- Design review - Formal and documented reviews of the ensign results that include participation from representatives of all.
- Design verification - Procedures for verifying the device design that confirm that the design output meets the design input requirements.
- Design validation - Procedures for validating the device design, ensuring that devices conform to defined user needs and intended uses, and including testing of production units under actual or simulated conditions.
- Design transfer - Procedures to ensure that the device design is correctly translated into production specification.
- Design changes - Procedures for identifying, documenting, validating, and managing the verification and approval process of all design changes before they are implemented.
- Design history file - A design history file (DHF) is required for each type of device and should include or reference the records necessary to demonstrate that the design was developed in accordance with the approved design plan and device requirements.
Document controls (subpart D)
Medical device manufacturers are required to put in place document controls for all documents required in this regulation.
Document approval and distribution
One or more people must be assigned to review and approve documents prior to issuance. The approval must be documented, include a date and the signature of the approver, and be made available at all locations where applicable. Procedures must also be in place to ensure that obsolete documents are removed and/or prevented from being used.
Document changes
Similar to document approval procedures, changes to documents must be approved, reviewed, and documented. Records of all changes must be maintained.
Purchasing controls (subpart E)
To continue reading this Regulatory Brief, including a definition of the remaining subparts and a comparison of 21 CFR 820 to ISO 13485, please download the full brief.
CE marking guide for medical devices in the EU
This article is an excerpt from the CE marking guide for medical devices in the European Union.
Table of Contents
- What is CE marking?
- Why is CE marking important?
- CE marking responsibilities
- What countries require or accept CE marking?
- Which medical devices require a CE mark?
- Technical documentation
- What are the costs associated with CE marking?
- How do you apply the CE marking?
- CE mark and UDI
- Does the CE mark expire?
- Do I need to CE mark my software?
- Final steps
CE marking is a symbol that consists of “CE, “ which is the abbreviation of the French phrase "Conformité Européene" meaning "European Conformity". The term initially used to describe “CE” was "EC Mark" but it has officially been replaced by "CE marking" according to the EU Directive 93/68/EEC. CE marking is used in all EU official documents, although you will still see "EC Mark" being used in common language. If you are using EC Mark in your documentation, you should change that terminology to CE marking in the future.
The letters ‘CE’ appear on many products traded on the Single Market in all the member states of the European Union plus Iceland, Liechtenstein, Norway and Switzerland. Simply put, The CE mark is a mandatory compliance mark, informing the consumer that the product is compliant with all applicable EU directives and regulations where the CE mark is required.
The Single Market was established in 1993 and is still considered one of the most significant achievements of the European Union. The main goal was to ensure the movement of goods and services freely within all the member states and to establish high safety standards for consumers. The CE mark indicates that goods and services do not need to be verified when shipping into another member country. To further support this movement, in April 2011, the Single Market Act was established to boost growth and strengthen confidence in the economy even further.
CE marking is required for many types of products, not just medical devices. The CE symbol can be found on bicycle helmets, toys, laptop batteries, wheelchairs, construction equipment, gas appliances and cell phone chargers - to name a few. CE marking is required for products manufactured anywhere that are sold in the EU, and only for those products for which EU specifications exist and require CE marking. The CE marking signifies that the product has been found to meet the general safety and performance requirements (GSPRs) of the European health, safety and environmental protection legislation and allows the product to be sold in the EU.
Manufacturer responsibilities for CE marking
Medical device manufacturers are responsible for properly and legally CE marking products before they leave the warehouse.
Most Class II and III medical devices, along with IVDs and some Class I devices, require a conformity assessment performed by a Notified Body to ensure that all legislative requirements are met before it can be placed on the market. Manufacturers of most Class I devices can self assess conformity. This process needs to demonstrate that all the legislative requirements are met, including any testing and inspections, and that all necessary certifications are obtained.
The European Commission lists 6 steps that manufactures should follow to affix a CE marking to their devices:
- Identify the applicable directive(s) and harmonized standards - see EU standards for Medical Devices, In Vitro Diagnostic (IVD) devices, and Implantable Medical Devices.
- Verify product specific requirements using the essential principles identified in the above standards.
- Identify whether an independent conformity assessment by a Notified Body is necessary. Notified bodies will be required to verify compliance with relevant Essential Requirements for most medical devices classified as IIa, IIb, or III - along with sterile class I devices. See the Notified and Designated Organization (NANDO) database for available notified bodies.
- Test the product and check its conformity.
- Create and keep available the required technical documentation.
- Affix the CE marking and create the EU Declaration of Conformity.
Importer responsibilities for CE marking
If you are importing medical devices into the EU, it is your responsibility to review all the technical documentation and maintain a copy, or to make sure that it’s available to you upon request.
You should verify:
- That the device has been CE marked and that the EU declaration of conformity has been completed.
- That the manufacturer has designated and established an authorized representative.
- That the device is labeled appropriately and contains instructions for use (IFU).
- When applicable, that a UDI has been assigned to the product.
- Whether or not the product is registered in EUDAMED (registration is currently voluntary).
Take action:
- List your name and address on the device or packaging, in addition to the manufacturer’s information.
- Keep records of complaints, non-conformities, recalls, etc. on file.
- Report any noticed non-conformity or product complaints from end users to the manufacturer and authorized representative immediately.
- Maintain a copy of the EU declaration of conformity and any other relevant certificates.
Distributor responsibilities for CE marking
If you are a distributor, you are responsible for reviewing the technical documentation provided to you so that you can verify the product is safe to put on the local market. You must also be sure the product is labeled correctly with the CE marking symbol clearly visible. The technical file documentation contains all of the information that is necessary to show conformity of the product to the applicable requirements.
You should verify:
- That the device has been CE marked and that the EU declaration of conformity has been completed.
- That the device includes all the appropriate labeling, including instructions for use.
- That if imported, the importer has complied with all the EU regulations.
- When applicable, that a UDI has been assigned to the product.
Take action:
- Report any noticed non-conformity to the manufacturer, importer, and authorized representative immediately.
- If a product appears to be out of compliance to the regulations and could pose a serious risk, the information should be reported to the Competent Authority, and to the manufacturer, importer and authorized representative.
- Any complaints or reports from end users about the product should be reported to the manufacturer and, if necessary, to the importer and authorized representative.
Important note: If the importer or distributor markets the product under their own company name, then they become responsible for CE marketing, and take over that role from the manufacturer.
CE marking is mandatory when importing products into the European Union, which is part of the larger European Economic Area (EEA). The EEA Agreement, established in 1992 and made official in 1994, is an international agreement that enables the extension of the European Union’s single market to non-EU members. It consists of the 27 EU countries plus the four European Free Trade Association (EFTA) countries - Iceland, Liechtenstein, Norway and Switzerland. Today, the EFTA has 29 Free Trade Agreements (FTAs) with 40 countries and territories outside the EU. Because these countries operate in the single market, this allows free movement of goods and services across all of the EEA.
Source: European Environment Agency (EEA).
All medical devices sold in the EU require a CE mark. While a CE mark is not required for items such as chemicals and pharmaceuticals, it can be required for combination devices and medical device software. For these two situations, how do you know if your product requires a CE mark?
To continue reading this ebook, including an overview of CE mark costs, and the associated technical documentation/general safety and performance requirements (GSPRs) that manufacturers are required to maintain please register to download the full version
Is a medical device accessory a medical device?
Rimsys’ own James Gianoutsos recently contributed an article on www.meddeviceonline.com discussing FDA’s guidance document describing accessories and classification pathways.
On Dec. 20, 2017, the FDA issued Medical Device Accessories – Describing Accessories and Classification Pathways: Guidance for Industry and Food and Drug Administration Staff, which applies to the Center for Devices and Radiological Health (CDRH) and Center for Biologics Evaluation and Research (CBER) for combination products.
The guidance document offers welcomed clarity on the role of an “accessory” and its regulatory relationship to its parent device. As always, guidance documents are not legally enforceable; rather, they describe the Agency’s current thinking on a topic and should be viewed only as recommendations, unless specific regulatory or statutory requirements are cited.
The guidance explains which devices FDA generally considers “accessories” and describes the processes under Section 513(f)(6) of the Federal Food, Drug, and Cosmetic Act (FD&C Act) to allow requests for risk- and regulatory control-based classification of accessories. In other words, it specifically details what is and is not an accessory, as well as the regulatory routes to classification.
The updated guidance was derived from an August 2017 amendment to section 513(f) of the FD&C Act (FDA Reauthorization Act of 2017 (Pub. L. 115-52)) to state that “the Secretary shall … classify an accessory under [section 513] based on the risks of the accessory when used as intended and the level of regulatory controls necessary to provide a reasonable assurance of safety and effectiveness of the accessory, notwithstanding the classification of any other device with which such accessory is intended to be used.”
The amendment allows for some accessories to have a lower risk profile than that of their parent device and, therefore, may warrant being regulated in a lower class. As classifications for accessories are now risk-based, it provides manufacturers with regulatory flexibility to loosen some of the regulatory burdens on accessories that may not have the same risk profile as their parent devices.
For example, an accessory to a class III parent device may pose lower risk that could be mitigated through general controls, or a combination of general and special controls, and thus could be regulated as class I or class II. A common example of this would be a ventilation system (parent device) with a face mask (accessory).
Additionally, the guidance details the applicable definitions within Section IV: Definitions:
- Accessory — “A finished device that is intended to support, supplement, and/or augment the performance of one or more parent devices.”
- Component (21 CFR 820.3(c)) — “[A]ny raw material, substance, piece, part, software, firmware, labeling, or assembly which is intended to be included as part of the finished, packaged, and labeled device.”
- Finished Device (21 CFR 820.3(l)) — “[A]ny device or accessory to any device that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized.”
- Parent Device — “A finished device whose performance is supported, supplemented, and/or augmented by one or more accessories.”
Accessory classification policy
The risks of an accessory are the risks it presents when used with the corresponding parent device as intended. To classify an accessory, FDA addresses the following two questions:
- Is the article an accessory? This can be answered by determining the intended use of the accessory. Is it intended for use with one or more parent devices, and does it support, supplement, and/or augment the performance of one or more parent devices?
- What is the risk of the accessory when used as intended with the parent device(s), and what regulatory controls are necessary to provide a reasonable assurance of its safety and effectiveness? This can be answered by providing a detailed risk assessment, outlining the potential hazards and reasonable regulatory and quality controls necessary to assure the accessory’s safety and effectiveness.
Individual accessories may be classified pursuant to the same regulation as a corresponding parent device, when appropriate, or be regulated independently.
Once an accessory has been classified, there is another consideration manufacturers need to decide: the Unique Device Identifier (UDI) rule. Not only does your parent device need to have a UDI, but any and all accessories each need to be assigned a UDI.
As 21 CFR 801 Labeling, Subpart B, Section 801.20(a) states: “(1) The label of every medical device shall bear a unique device identifier (UDI) that meets the requirements of this subpart and part 830 of this chapter,” and “(2) Every device package shall bear a UDI that meets the requirements of this subpart and part 830 of this chapter.”
Further, 21 CFR 830 UDI, Subpart A, Section 830.3 defines “finished device” and “device package” as follows:
- Finished device* means any device or accessory to any device that is suitable for use or capable of functioning.
- Device package means a package that contains a fixed quantity of a particular version or model of a device.
*Note that, although “medical device” and “finished device” are not consistent terminology used within the chapters, the terms are one and the same.
In short, any sellable finished device must bear a UDI, either on the device itself, on the device package, or both. Components to the finished device (i.e., service components and spare parts kits) are not considered accessories, and therefore are not required to bear a UDI.
What does this ultimately mean for manufacturers?
If there was any confusion as to whether a specific accessory is classified as a medical device, it has now been clarified, or at least partially clarified, depending on your specific situation. If there is still confusion among your engineering and regulatory teams, FDA recommends contacting them, via the accessory classification process outlined in the guidance, to classify the accessory appropriately. FDA will treat each accessory classification request as a Q-Submission. Requests may be for a new accessory type (new classification), an existing accessory type (reclassification), or classification of a new accessory type through the de novo process.
A gap analysis should be performed to identify a thorough and complete list of your current and future accessories to determine applicability to the guidance document. Justification also should be documented, should an accessory not apply to the guidance document. Additionally, internal procedures and the process associated with assigning UDIs may need to be updated to ensure there are no compliance gaps.
Podcast – Streamlining the MDSAP device marketing authorization and facility registration process
I had the opportunity to sit down with Jon Speer, Founder & VP of QA/RA at Greenlight Guru to record a podcast to discuss streamlining the MDSAP Marketing Authorization & Facility Registration Process.
If you are not familiar with this topic, you need to hear this.
We discuss:
- Why your regulatory team may be perceived as a bottleneck and why it is important everyone needs to be on the same page about when the product can be released.
- The connection between marketing authorization and facility registration required for various countries – United States, European Union, or elsewhere.
- The need to get organized, get better systems in place, and stay compliant when an auditor comes through your door or when you plan to sell into markets.
- Why small and large companies need to get organized now (i.e. small companies have too much information to maintain, organize, and track while large companies may have resources but suffer from miscommunication and disjointed processes.)
- The need to not be complacent and not be afraid to change systems. Rimsys was created to help regulatory professionals successfully and efficiently handle documentation.
You can hear the podcast below or at the Greenlight Guru blog.
