Medical Devices; Current Good Manufacturing Practice (CGMP) Final Rule; Quality System Regulation  

 [Federal Register: October 7, 1996 (Volume 61, Number 195)] [Rules and Regulations]               

[Page 52601-52662]

From the Federal Register Online via GPO Access [wais.access.gpo.gov]

[[Page 52601]]

-------------------------------------------------------------------------------------------------------

Part VII 

Department of Health and Human Services

--------------------------------------------------------------------------------------------------------

Food and Drug Administration

-------------------------------------------------------------------------------------------------------- 

21 CFR Parts 808, 812, and 820 

Medical Devices; Current Good

Manufacturing Practice (CGMP); Final Rule 

[[Page 52602]] 

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Food and Drug Administration 21 CFR Parts 808, 812, and 820 

[Docket No. 90N-0172] RIN 0910-AA09   

Medical Devices; Current Good Manufacturing Practice (CGMP) Final  Rule; Quality System Regulation 

AGENCY: Food and Drug Administration, HHS. 

ACTION: Final rule. 

----------------------------------------------------------------------- 

SUMMARY: The Food and Drug Administration (FDA) is revising the current  good manufacturing practice (CGMP) requirements for medical devices and  incorporating them into a quality system regulation. The quality system  regulation includes requirements related to the methods used in, and  the facilities and controls used for, designing, manufacturing,  packaging, labeling, storing, installing, and servicing of medical  devices intended for human use. This action is necessary to add  preproduction design controls and to achieve consistency with quality  system requirements worldwide. This regulation sets forth the framework  for device manufacturers to follow and gives them greater flexibility  in achieving quality requirements.  DATES: The regulation is effective June 1, 1997. For more information  on compliance with 21 CFR 820.30 see section IV. of this document.

     Written comments on the information collection requirements should  be submitted by December 6, 1996.  ADDRESSES: Submit written comments on the information collection  requirements to the Dockets Management Branch (HFA-305), Food and Drug  Administration, 12420 Parklawn Dr., rm. 1-23, Rockville, MD 20857. All  comments should be identified with the docket number found in brackets  in the heading of this document.  FOR FURTHER INFORMATION CONTACT: Kimberly A. Trautman, Center for  Devices and Radiological Health (HFZ-341), Food and Drug  Administration, 2098 Gaither Rd., Rockville, MD 20850, 301-594-4648.  SUPPLEMENTARY INFORMATION:  I. Background

      Manufacturers establish and follow quality systems to help ensure  that their products consistently meet applicable requirements and  specifications. The quality systems for FDA-regulated products (food,  drugs, biologics, and devices) are known as CGMP’s. CGMP requirements  for devices in part 820 (21 CFR part 820) were first authorized by  section 520(f) of the Federal Food, Drug, and Cosmetic Act (the act)  (21 U.S.C. 360j(f)), which was among the authorities added to the act  by the Medical Device Amendments of 1976 (Pub. L. 94-295).

    Under section 520(f) of the act, FDA issued a final rule in the  Federal Register of July 21, 1978 (43 FR 31 508), prescribing CGMP  requirements for the methods used in, and the facilities and controls  used for the manufacture, packing, storage, and installation of medical  devices. This regulation became effective on December 18, 1978, and is  codified under part 820. Except for editorial changes to update  organizational references in the regulation and revisions to the list  of critical devices that was included in the preamble to the final  regulation, the device CGMP requirements have not been revised since  1978. This final rule is the result of an extensive effort begun in  1990 to revise this regulation.

     The Safe Medical Devices Act of 1990 (the SMDA) (Pub. L. 101-629),  enacted on November 28, 1990, amended section 520(f) of the act,  providing FDA with the authority to add preproduction design controls  to the CGMP regulation. This change in law was based on findings that a  significant proportion of device recalls were attributed to faulty  design of product. Specifically, in January 1990, FDA published the  results of an evaluation of device recalls that occurred from October  1983 through September 1989, in a report entitled ``Device Recalls: A  Study of Quality Problems’’ (Ref. 1). (See 55 FR 21108, May 22, 1990,  where FDA announced the availability of the report.) FDA found that  approximately 44 percent of the quality problems that led to voluntary  recall actions during this 6-year period were attributed to errors or  deficiencies that were designed into particular devices and may have  been prevented by adequate design controls. These design-related  defects involved both noncritical devices (e.g., patient chair lifts,  in vitro diagnostics, and administration sets) and critical devices  (e.g., pacemakers and ventilators). Also in 1990, the Department of  Health and Human Services’ Inspector General conducted a study entitled  ``FDA Medical Device Regulation From Premarket Review to Recall’’ (Ref.  2), which reached similar conclusions. With respect to software used to  operate medical devices, the data were even more striking. A subsequent  study of software-related recalls for the period of fiscal year (FY)  1983 through FY 1991 indicated that over 90 percent of all software- related device failures were due to design-related errors, generally,  the failure to validate software prior to routine production (Ref. 3). 

 

    The SMDA also added new section 803 to the act (21 U.S.C. 383)  which, among other things, encourages FDA to work with foreign  countries toward mutual recognition of CGMP requirements. FDA undertook  the revision of the CGMP regulation to add the design controls  authorized by the SMDA to the CGMP regulation, as well as because the  agency believed that it would be beneficial to the public and the  medical device industry for the CGMP regulation to be consistent, to  the extent possible, with the requirements for quality systems  contained in applicable international standards, primarily, the  International Organization for Standards (ISO) 9001:1994 ``Quality  Systems--Model for Quality Assurance in Design, Development,  Production, Installation, and Servicing’’ (Ref. 4), and the ISO  committee draft (CD) revision of ISO/CD 13485 ``Quality Systems-- Medical Devices--Supplementary Requirements to ISO 9001’’ (Ref. 5).     This action is being taken under those provisions of the SMDA and  in response to the following: (1) Notices that appeared in the Federal  Register of April 25, 1990 (55 FR 17502), and in the Federal Register  of April 17, 1991 (56 FR 15626), that announced meetings of the  agency’s Device Good Manufacturing Practice Advisory Committee (GMP  Advisory Committee), at which the need for revisions to the CGMP  regulation was explored; (2) an advance notice of proposed rulemaking  (ANPRM) that appeared in the Federal Register of June 15, 1990 (55 FR  24544), that announced the agency’s intent to revise the CGMP  regulation; (3) a notice of availability of a document that appeared in  the Federal Register of November 30, 1990 (55 FR 49644), entitled  ``Medical Devices; Current Good Manufacturing Practices (CGMP)  Regulations Document; Suggested Changes; Availability’’ (Ref. 6) and  comments solicited from the public about the document; (4) a proposed  rule in the Federal Register of November 23, 1993 (58 FR 61952), (Ref.  7) and comments solicited from the public about the proposal; (5) a  notice of availability that appeared in the Federal Register of July  24, 1995 (60 FR 37856), announcing the availability of the ``Working  Draft of the Current Good Manufacturing Practice (CGMP) Final Rule’’  (hereinafter referred to as the Working Draft) (Ref. 8) and comments  [[Page 52603]]  solicited from the public about the Working Draft; (6) testimony at an  August 23, 1995, open public meeting announced in the Federal Register  (60 FR 37856); (7) and testimony and advisory committee recommendations  from the September 13 and 14, 1995, meeting of the GMP Advisory  Committee announced in the Federal Register of August 24, 1995 (60 FR  44036). Thus, FDA’s decision to revise the CGMP regulation is based on  changes in the law made by the SMDA, the agency’s discussions with  others including its GMP Advisory Committee, responses to the Federal  Register notices on this matter, FDA’s analysis of recall data, its  experience with the regulatory application of the original CGMP  regulation, and its assessment of international quality standards.

     The agency’s final rule embraces the same ``umbrella’’ approach to  the CGMP regulation that is the underpinning of the original CGMP  regulation. Because this regulation must apply to so many different  types of devices, the regulation does not prescribe in detail how a  manufacturer must produce a specific device. Rather, the regulation  provides the framework that all manufacturers must follow by requiring  that manufacturers develop and follow procedures and fill in the  details that are appropriate to a given device according to the current  state-of-the-art manufacturing for that specific device. FDA has made  changes to the proposed regulation and the Working Draft, as the final  rule evidences, to provide manufacturers with even greater flexibility  in achieving the quality requirements. 

 

    The Supreme Court recently addressed the preemptive effect, under  section 521 of the act (21 U.S.C. 360k), of the original CGMP  regulation and other FDA requirements for medical devices on State tort  actions. In Medtronic, Inc. v. Lohr, 116 S. Ct. 2240 (1996), the  Supreme Court gave substantial deference to the agency’s interpretation  of section 521 of the act found at Sec. 808.1 (21 CFR 808.1). The Court  noted that CGMP requirements are general rather than ``specific  requirements applicable to a particular device,’’ and that State common  law remedies are similarly general, and do not establish a  ``substantive requirement for a specific device.’’ (Lohr at 2257; see  also Sec. 808.1(d) and (d)(6)(ii).) Moreover, the Court drew a  distinction between remedies and requirements, noting that while common  law tort actions may provide remedies different from those available  under the act, no preemption occurs unless the substantive requirements  of the State law are ``different from, or in addition to,’’ those  imposed by the act. (See Lohr at 2255.) Under the Supreme Court’s  analysis in Lohr, the requirements imposed by the original CGMP  regulation would rarely have preemptive effect.     FDA believes that the reasoning of Medtronic v. Lohr applies  equally to the new quality system regulation, which, as does the  original CGMP regulation, prescribes requirements that apply to medical  devices in general, rather than to any particular medical device.  Therefore, FDA has concurrently amended part 808 (21 CFR part 808) to  make clear the new quality system regulation does not preempt State  tort and common law remedies.  II. Decision to Make a Working Draft Available for Comment

      In the Federal Register of November 23, 1993, the agency issued the  proposed revisions to the CGMP regulation, entitled ``Medical Devices;  Current Good Manufacturing Practice (CGMP) Regulations; Proposed  Revisions; Request for Comments,’’ and public comment was solicited.  After the proposal issued, FDA met with the Global Harmonization Task  Force (the GHTF) Study Group in early March 1994, in Brussels, to  compare the provisions of the proposal with the provisions of ISO  9001:1994 and European National Standard (EN) 46001 ``Quality Systems-- Medical Devices--Particular Requirements for the Application of EN  29001’’ (Ref. 9). ISO 9001:1994 and EN 46001:1994 are written as  voluntary standards, but when used to fulfill the requirements of the  European Medical Device Directives, or other national regulations,  these standards are mandatory requirements similar to the CGMP  requirements. The GHTF includes: Representatives of the Canadian  Ministry of Health and Welfare, the Japanese Ministry of Health and  Welfare, FDA, and industry members from the European Union (EU),  Australia, Canada, Japan, and the United States. The participants at  the GHTF meeting favorably regarded FDA’s effort toward harmonization  with international standards. The GHTF submitted comments, however,  noting where FDA could more closely harmonize to achieve consistency  with quality system requirements worldwide. Since the proposal  published, FDA has also attended numerous industry and professional  association seminars and workshops, including ISO Technical Committee  (TC) 210 ``Quality Management and Corresponding General Aspects for  Medical Devices’’ meetings, where the proposed revisions were  discussed.

     The original period for comment on the proposal closed on February  22, 1994, and was extended until April 4, 1994. Because of the heavy  volume of comments and the desire to increase public participation in  the development of the quality system regulation, FDA decided to  publish the notice of availability in the Federal Register to allow  comment on the Working Draft before issuing a final regulation.

 

     The Working Draft represented the agency’s views at the time on how  it would respond to the many comments received, and on how the agency  believed a final rule should be framed. FDA solicited public comment on  the Working Draft until October 23, 1995, to determine if the agency  had adequately addressed the many comments received and whether the  agency had framed a final rule that achieved the public health goals to  be gained from implementation of quality systems in the most efficient  manner.  III. Open Public Meeting and GMP Advisory Committee Meeting      FDA held an open public meeting on the quality system regulation on  August 23, 1995. The public meeting consisted of prepared presentations  followed by an open discussion period. Both the agency and the  participants found the meeting to be very productive in focusing  attention on the few main areas of concern in the Working Draft. The  main issues were: The application of the regulation to component  manufacturers; the application of the regulation to third party  servicers and refurbishers; and the implementation timeframe of the  final rule. A transcript of the proceedings of the public meeting, as  well as data and information submitted to FDA during the public  meeting, are available from the Dockets Management Branch (HFA-305),  Food and Drug Administration, 12420 Parklawn Dr., rm. 1-23, Rockville,  MD 20857, between 9 a.m. and 4 p.m., Monday through Friday.

     There also was a meeting of the GMP Advisory Committee on the  Working Draft on September 13 and 14, 1995. A notice of the meeting was  published in the Federal Register of August 24, 1995. FDA made a brief  presentation to the committee on the changes from the 1993 proposal to  the 1995 Working Draft and discussed some changes that FDA was  recommending as a result of the August 1995 meeting. Two consultants  also made presentations to the committee, one a representative from ISO  TC 176 (the TC that authored the ISO 9000 series) and the other a  representative from the European Committee for Standardization (CEN).  The remainder of the meeting consisted of prepared  [[Page 52604]]  presentations from the public and the committee’s discussion on the  main issues.
 

    The overwhelming majority of the committee members believed that  the Working Draft met the public health needs, gave manufacturers  sufficient flexibility to comply with the regulation, and met the  agency’s goal of harmonizing the quality system requirements with those  of other countries. The GMP Advisory Committee strongly supported FDA’s  recommendation, in response to the August 1995 public meeting, to not  include component manufacturers under this final rule. However, the GMP  Advisory Committee was clearly divided on several issues related to the  proposed regulation of third party servicers and refurbishers. A  transcript of the proceedings of the GMP Advisory Committee meeting, as  well as data and information submitted to FDA during the meeting, are  available from the Dockets Management Branch (address above).     After considering the written comments and the views expressed at  meetings with the GHTF, at the August 1995 public meeting, and at the  September 1995 GMP Advisory Committee meeting, FDA is publishing this  final rule. A summary of changes from the July 1995 Working Draft to  the final rule is contained at the end of this preamble.  IV. Implementation of the Final Rule

      FDA has decided, in response to the many comments and concerns  expressed about the need for more time to implement design controls, to  implement the final rule in two stages. Under stage one, on June 1,  1997, approximately 1 year after this rule is published in the Federal  Register, all elements of the final rule become effective. However,  with respect to the design control requirements in Sec. 820.30, as long  as manufacturers are taking reasonable steps to come into compliance,  FDA will implement a special 1-year transition program, with a  midcourse review, during which official agency action will not be  initiated, including FDA Form 483 observations, warning letters, or  enforcement cases, based on failure to comply with Sec. 820.30. Under  stage two, beginning June 1, 1998, FDA will treat noncompliance with  design control requirements in Sec. 820.30 the same as noncompliance  with other provisions of the CGMP regulation. 

 

    To prepare for stage one of this implementation plan, FDA intends  to develop, by April of 1997, a strategy for inspecting the design  control requirements. Both industry and FDA field investigators will  then be trained on this inspectional strategy for design controls  during April and May 1997. Starting June 1, 1997, manufacturers will be  inspected for compliance with all the new quality system requirements,  including design controls, in the manner described in the inspectional  strategy. However, as part of the transition program, from June 1,  1997, for a period of 1 year, although FDA will inspect firms for  compliance with the design control requirements, the field will issue  any observations to the manufacturer on a separate design control  inspectional strategy report, not on FDA Form 483. The design control  inspectional strategy report will be made a part of the manufacturer’s  establishment inspection report (EIR), but the observations relating to  Sec. 820.30 will not be included in any warning letters or regulatory  actions during this initial 1-year period. FDA notes that it can, at  any time, take action against unsafe or adulterated medical devices  under different regulatory or statutory authorities. FDA wants to  emphasize that manufacturers are required to take reasonable steps to  come into compliance with the design control requirements during the  June 1, 1997, to June 1, 1998, period.     FDA also emphasizes that this transition period relates only to the  design control requirements of Sec. 820.30, and that beginning June 1,  1997, the agency will issue observations on FDA Form 483’s, issue  warning letters, and take any necessary regulatory action for  violations of all other provisions of the CGMP final rule. The time  period from June 1, 1997, to June 1, 1998, is intended to allow both  the industry and FDA field investigators time to become familiar with  the design control requirements and the enforcement aspects of this new  area.

     Finally, as described elsewhere in this preamble, FDA intends to  conduct a midcourse review of the new design control requirements  during the transition year (June 1997 to June 1998). Specifically, the  results of the first several months of design control inspections will  be reviewed by early 1998. FDA will review all of the completed design  control inspectional strategy reports that were given to manufacturers  from between June 1, 1997, through December 1, 1997. The completed  strategy reports will be reviewed with particular attention paid to  clarity of information obtained, the appropriateness of the information  collected with respect to the design control requirements, the  appropriateness of the questions on the inspectional strategy, the  manner in which the investigators are writing out their observations,  and any requirements that seem to be giving manufacturers a problem or  where there might be misunderstandings as to what the regulation  requires. FDA will then hold an open public meeting in early 1998 to  discuss with industry these findings and to further explore any  concerns industry might be having in implementing the new design  control requirements. As a result of the midcourse review and open  public meeting, FDA might hold additional workshops, meetings, and/or  training sessions.     Any midcourse adjustments to the inspectional strategy will be  instituted and made public by the spring of 1998. Also during this  midcourse review, FDA will evaluate the information gathered at that  point and determine if the design control requirements as written in  this final rule are appropriate to obtain the goals expressed in this  preamble. FDA will consider minor or even major changes, based on  experience to date. Any necessary adjustments or proposed revisions  will be published in the Federal Register and comments will be  solicited as necessary during the spring of 1998. This implementation  strategy is responsive to requests by industry for FDA to harmonize the  quality system regulation’s implementation with the mandatory date for  implementation of the EU’s Medical Device Directive, which is June  1998. However, if during the midcourse review of stage one it is  determined that the industry and/or FDA needs more time to fully  implement the design control requirements, FDA will publish an  extension of the regulatory implementation date for design control  requirements prior to June 1, 1998.  V. Response to Comments and Rationale for Changes      Approximately 280 separate individuals or groups commented on the  proposal published in the Federal Register of November 23, 1993, and  approximately 175 separate individuals or groups commented on the  Working Draft that was announced in a notice of availability published  in the Federal Register on July 24, 1995. FDA made many changes in  response to the comments. Most of the changes were made in response to  specific comments, in response to comments for clarity, understanding,  and readability, or to further harmonize FDA requirements with  international standards, as many comments requested.

     Numerous comments stated that industry was very pleased with FDA’s  [[Page 52605]]  Working Draft and the effort that was made to harmonize with ISO, as  well as to engage industry in commenting on the Working Draft through  the open public meeting and the GMP Advisory Committee meeting that  were held in August and September 1995, respectively.

     FDA’s responses to the comments received on the proposal and the  Working Draft, as well as explanations for the changes made, follow.  A. General Provisions (Subpart A)  i. Scope (Sec. 820.1)

    1. The title of the regulation, as reflected in this section, has  been changed from the ``Current Good Manufacturing Practices (CGMP)’’  regulation to the ``Quality System’’ regulation. This revision follows  the suggestion underlying many comments on specific provisions that FDA  generally harmonize the CGMP requirements and terminology with  international standards. ISO 9001:1994, ISO/CD 13485, and EN 46001  employ this terminology to describe the CGMP requirements. In addition,  this title accurately describes the sum of the requirements, which now  include the CGMP requirements for design, purchasing, and servicing  controls. CGMP requirements now cover a full quality system.

     FDA notes that the principles embodied in this quality system  regulation have been accepted worldwide as a means of ensuring that  acceptable products are produced. While the regulation has been  harmonized with the medical device requirements in Europe, Australia,  and Japan, as well as the requirements proposed by Canada, it is  anticipated that other countries will adopt similar requirements in the  near future.

     FDA, however, did not adopt ISO 9001:1994 verbatim for two reasons.  First, there were complications in dealing with the issue of copyrights  and, second, FDA along with health agencies of other governments does  not believe that for medical devices ISO 9001:1994 alone is sufficient  to adequately protect the public health. Therefore, FDA has worked  closely with the GHTF and TC 210 to develop a regulation which is  consistent with both ISO 9001:1994 and ISO/CD 13485. FDA made several  suggestions to TC 210 on the drafts of the ISO/CD 13485 document in  order to minimize differences and move closer to harmonization. In some  cases, FDA has explicitly stated requirements that many experts believe  are inherent in ISO 9001:1994. Through the many years of experience  enforcing and evaluating compliance with the original CGMP regulation,  FDA has found that it is necessary to clearly spell out its  expectations. This difference in approach does not represent any  fundamentally different requirements that would hinder global  harmonization. In fact, numerous comments expressed their approval and  satisfaction with FDA’s effort to harmonize the quality system  requirements with those of ISO 9001:1994 and ISO/CD 13485.     2. One comment suggested that the term `purchasing’’ in the scope  be deleted because it could be interpreted to mean the purchase of  finished medical devices by health care institutions and medical  professionals, instead of the purchase of components and manufacturing  materials as intended.

 

     FDA agrees and has deleted the term ``purchasing’’ throughout the  regulation when used in this context.

     3. Several comments suggested that Sec. 820.1(a)(1) should not  state that the regulation establishes the ``minimum’’ requirements  because it implies that compliance with the stated requirements may be  insufficient. They asked that FDA delete the word ``minimum,’’ to avoid  having auditors search for additional requirements.

     FDA does not believe that the provision would have required that  manufacturers meet additional requirements not mandated by the  regulation but has modified the section to clarify its intent by  stating that the regulation establishes the ``basic’’ requirements for  manufacturing devices. The quality system regulation provides a  framework of basic requirements for each manufacturer to use in  establishing a quality system appropriate to the devices designed and  manufactured and the manufacturing processes employed. Manufacturers  must adopt current and effective methods and procedures for each device  they design and manufacture to comply with and implement the basic  requirements. The regulation provides the flexibility necessary to  allow manufacturers to adopt advances in technology, as well as new  manufacturing and quality system procedures, as they become available.

     During inspections, FDA will assess whether a manufacturer has  established procedures and followed requirements that are appropriate  to a given device under the current state-of-the-art manufacturing for  that specific device. FDA investigators receive extensive training to  ensure uniform interpretation and application of the regulation to the  medical device industry. Thus, the agency does not believe that FDA  investigators will cite deviations from requirements not contained in  this part. However, as noted above, FDA has altered the language of the  scope to make clear that additional, unstated requirements do not  exist.

     4. A few comments suggested eliminating the distinction between  critical and noncritical devices, thus eliminating the need for  distinct requirements for critical devices. Other comments disagreed,  asserting that eliminating the distinction would increase the cost of  production of low-risk devices without improving their safety and  effectiveness.

     FDA agrees in part with the comments that suggest eliminating the  distinction between critical and noncritical devices and has eliminated  the term ``critical device’’ from the scope, definitions, and  regulation in Secs. 820.65 Critical devices, traceability and 820.165  Critical devices, labeling. However, FDA has retained the concept of  distinguishing between devices for the traceability requirements in  Sec. 820.65. As addressed in the discussion under that section, FDA  believes that it is imperative that manufacturers be able to trace, by  control number, any device, or where appropriate component of a device,  that is intended for surgical implant into the body or to support or  sustain life whose failure to perform when properly used in accordance  with instructions for use provided in the labeling can be reasonably  expected to result in a significant injury to the user.

     The deletion of the terminology will bring the regulation in closer  harmony with ISO 9001:1994 and the quality system standards or  requirements of other countries.

     Finally, FDA notes that eliminating the term ``critical device’’  and the list of critical devices does not result in the imposition of  new requirements. In fact the new regulation is less prescriptive and  gives the manufacturer the flexibility to determine the controls that  are necessary commensurate with risk. The burden is on the  manufacturer, however, to describe the types and degree of controls and  how those controls were decided upon. Such determinations are made in  accordance with standard operating procedures (SOP’s) established by  the manufacturer.

     5. In response to numerous comments, FDA has added the sentence  ``If a person engages in only some operations subject to the  requirements in this part, and not in others, that person need only  comply with those requirements applicable to the operations in which he  or she is engaged.’’ This sentence was added to clarify the scope of  the regulation and  [[Page 52606]]  the responsibility of those who fall under this regulation. The wording  is the same as that used in the drug CGMP.

    6. Several comments recommended that the short list of class I  devices subject to design control requirements be deleted from the  regulation and be placed in the preamble, to allow additions or  deletions without requiring a change to the entire regulation. Others  commented that the list of class I devices should be entirely  eliminated to harmonize with Europe and Japan.

     FDA disagrees that the list of devices subject to design control  requirements should be deleted from the regulation. FDA has experienced  problems or has concerns with the class I devices listed and has  determined that design controls are needed for the listed devices.  Further, placing the list in the regulation establishes the  requirements related to those devices, and is convenient for use by  persons who are not familiar with, or who do not have access to, the  preamble. Further, FDA notes that individual sections of a regulation  may be revised independent of the remainder of the regulation.

    7. Numerous written comments and persons who testified at the  August and September 1995 meetings stated that application of the  regulation to component manufacturers would increase product cost, with  questionable value added to device safety and effectiveness, and that  many component suppliers would refuse to supply components or services  to the medical device industry. This would be especially likely to  occur, it was suggested, where medical device manufacturers account for  a small fraction of the supplier’s sales.

     FDA believes that because of the complexity of many components used  in medical devices, their adequacy cannot always be assured through  inspection and testing at the finished device manufacturer. This is  especially true of software and software-related components, such as  microprocessors and microcircuits. Quality must be designed and built  into components through the application of proper quality systems.

    However, FDA notes that the quality system regulation now  explicitly requires that the finished device manufacturer assess the  capability of suppliers, contractors, and consultants to provide  quality products pursuant to Sec. 820.50 Purchasing controls. These  requirements supplement the acceptance requirements under Sec. 820.80.  Manufacturers must comply with both sections for any incoming component  or subassembly or service, regardless of the finished device  manufacturer’s financial or business affiliation with the person  providing such products or services. FDA believes that these purchasing  controls are sufficient to provide the needed assurance that suppliers,  contractors, and consultants have adequate controls to produce  acceptable components.

     Therefore, balancing the many concerns of the medical device  industry and the agency’s public health and safety concerns, FDA has  decided to remove the provision making the CGMP regulation applicable  to component manufacturers and return to the language in the original  CGMP regulation. This approach was unanimously endorsed by the members  of the GMP Advisory Committee at the September 1995 meeting. FDA will  continue to focus its inspections on finished device manufacturers and  expects that such manufacturers will properly ensure that the  components they purchase are safe and effective. Finished device  manufacturers who fail to comply with Secs. 820.50 and 820.80 will be  subject to enforcement action. FDA notes that the legal authority  exists to cover component manufacturers under the CGMP regulation  should the need arise.

     8. One comment stated that proposed Sec. 820.1(a)(2) should be  revised to include the District of Columbia and the Commonwealth of  Puerto Rico, as in the original CGMP regulation.     FDA agrees with the comment. These localities were inadvertently  omitted and have been added to the regulation.

     9. FDA added Sec. 820.1(a)(3) on how to interpret the phrase  ``where appropriate’’ in the regulation, as recommended by the GMP  Advisory Committee. This section is consistent with the statement in  ISO/CD 13485.

     10. Some comments on proposed Sec. 820.1(c) recommended that the  section be deleted as it already appears in the act. Others stated that  the provision implies that FDA will subject devices or persons to legal  action, regardless of the level of noncompliance. Still others  suggested that only intentional violations of the regulation should  give rise to regulatory action.

     FDA disagrees with these comments. The consequences of the failure  to comply, and the legal authority under which regulatory action may be  taken, are included in the regulation so that the public may be fully  apprised of the possible consequences of noncompliance and understand  the importance of compliance. FDA notes that the agency exercises  discretion when deciding whether to pursue a regulatory action and does  not take enforcement action for every violation it encounters. Further,  FDA generally provides manufacturers with warning prior to initiating  regulatory action and encourages voluntary compliance. The agency also  notes, however, that violations of this regulation need not be  intentional to place the public at serious risk or for FDA to take  regulatory action for such violations.

     In response to the concerns regarding the tone of the section,  however, the title has been changed. FDA has also deleted the specific  provisions referenced in the proposed section with which the failure to  comply would render the devices adulterated. The term ``part’’ includes  all of the regulation’s requirements.

     11. A few comments on proposed Sec. 820.1(c)(2), now Sec. 820.1(d),  requested that the agency clarify what is meant by requiring that  foreign manufacturers ``schedule’’ an inspection. A few comments stated  that FDA was adding new requirements for foreign manufacturers in this  section. Others stated that the proposed language would prohibit global  harmonization because it would limit third party audits in place of FDA  inspections.

     FDA has moved the provision related to foreign manufacturers into a  separate section and has modified the language. The language in the  regulation reflects the language in section 801(a) of the act (21  U.S.C. 381(a)). FDA disagrees that it is adding new requirements for  foreign manufacturers in Sec. 820.1(d) because the section recites the  current requirement and standard used, and is consistent with current  agency policy. The agency believes that it is imperative that foreign  facilities be inspected for compliance with this regulation and that  they be held to the same high standards to which U.S. manufacturers are  held. Otherwise, the U.S. public will not be sufficiently protected  from potentially dangerous devices, and the U.S. medical device  industry will be at a competitive disadvantage.

     FDA intends to continue scheduling inspections of foreign  manufacturers in advance to assure their availability and avoid  conflicts with holidays and shut down periods. However, the language  pertaining to the ``scheduling’’ of such inspections has been deleted  to allow flexibility in scheduling methods.

     FDA disagrees that, as written, the language would prohibit  inspections by third parties. FDA may use third party inspections, as  it uses other compliance information, in setting its priorities and  utilizing its resources related to foreign inspections. In this regard,  FDA looks forward to entering into agreements with foreign countries  related to CGMP  [[Page 52607]]  inspections that would provide FDA with reliable inspectional  information.  

 

   12. Two comments stated that the section on ``Exemptions or  variances,’’ now Sec. 820.1(e), should require that FDA provide a  decision on petitions within 60 days of receipt and state that the  agency will take no enforcement action with respect to the subject of  the petition until a decision is rendered. The comments said that the  petition process is long, arduous, and not practical.

     FDA disagrees with the comments. Currently, FDA is required by  section 520(f)(2)(B) of the act to respond within 60 days of receipt of  the petition, unless the petition is referred to an advisory committee.  When the 1978 CGMP regulation was published, there was a prediction  that FDA would be overwhelmed with petitions for exemption and variance  from the regulation. Over the past 18 years, since the CGMP regulation  first became effective, FDA has only received approximately 75  petitions. It is FDA’s opinion that few petitions have been received  because of the flexible nature of the CGMP regulation. FDA has  attempted to write the current regulation with at least the same degree  of flexibility, if not more, to allow manufacturers to design a quality  system that is appropriate for their devices and operations and that is  not overly burdensome.

 

     Guidelines for the submission of petitions for exemption or  variance are available from the Division of Small Manufacturers  Assistance (the DSMA). The petition guidelines state that FDA will not  process a petition for exemption or variance while an FDA inspection of  a manufacturer is ongoing. Until FDA has approved a petition for an  exemption or variance, a manufacturer should not deviate from the  requirements of this regulation. FDA must first have the opportunity to  ensure that the manufacturer has established that an exemption or  variance is warranted, to carry out its obligation of ensuring that  devices are safe and effective.

 

     13. Several comments stated that the proposed requirements are not  necessary for all manufacturers, particularly small manufacturers with  few employees and low-risk devices. Other comments stated that the  documentation requirements are excessive.

     FDA generally disagrees with these comments. The regulation  provides the ``basic’’ requirements for the design and manufacture of  medical devices. And, as noted in the previous response, the  requirements are written in general terms to allow manufacturers to  establish procedures appropriate for their devices and operations.  Also, as discussed above, a manufacturer need only comply with those  requirements applicable to the operations in which he or she is  engaged. However, because the regulation requirements are basic, they  will apply in total to most manufacturers subject to the regulation.  The extent of the documentation necessary to meet the regulation  requirements may vary with the complexity of the design and  manufacturing operations, the size of the firm, the importance of a  process, and the risk associated with the failure of the device, among  other factors. Small manufacturers may design acceptable quality  systems that require a minimum of documentation and, where possible,  may automate documentation. In many situations, documentation may be  kept at a minimum by combining many of the recordkeeping requirements  of the regulation, for example, the production SOP’s, handling, and  storage procedures. When manufacturers believe that the requirements  are not necessary for their operations, they may petition for an  exemption or variance from all or part of the regulation pursuant to  section 520(f)(2) of the act.

    In addition, FDA has added a variance provision in Sec. 820.1(e)(2)  under which the agency can initiate a variance when it is in the best  interest of the public health. Under this provision, for instance, the  agency may initiate and grant a variance to manufacturers of devices  during times of product shortages, where the devices are needed by the  public and may not otherwise be made available, if such manufacturers  can adequately assure that the resulting devices are safe and  effective. The agency envisions this provision as a bridge, providing a  manufacturer with the time necessary to fulfill the requirements in the  regulation while providing important and needed devices to the public.  Thus, the variance would only be granted for a short period of time,  and only while the devices remained necessary and in short supply.  Under this provision, FDA will require a manufacturer to submit a plan  detailing the action it is taking to assure the safety and  effectiveness of the devices it manufactures and to meet the  requirements of the regulation.

    This agency initiated variance provision is in accordance with  section 520(f) of the act which permits, but does not require, FDA to  promulgate regulations governing the good manufacturing practices for  devices and section 701(a) of the act (21 U.S.C. 371(a)), which permits  FDA to promulgate regulations for the efficient enforcement of the act.  Because the statute does not mandate that the agency establish any  requirements for device CGMP’s, the agency has the authority to  determine that the manufacturers of certain devices need not follow  every requirement of the regulation.

    Further, the agency initiated variance provision is in keeping with  the intent of Congress that FDA prevent hazardous devices from reaching  the marketplace, H. Rept. 853, 94th Cong., 2d sess. 25-26 (1976), and  the general intent of the act that the agency undertake to protect the  public health. The agency will only initiate such a variance where the  devices are needed and may not otherwise be made available, and the  manufacturer can assure the agency that its procedures are likely to be adequate  and that it is actively pursuing full compliance. The  variances will only be in effect for a limited time.

    Section 820.1(e) has been modified to include the above addition,  to reflect the title change of the regulation, and to provide the most  current address for the DSMA. ii. Definitions (Sec. 820.3)

    14. Several comments were received regarding the definition of  "complaint.’’ Comments generally believed that the definition was  unclear and could be interpreted to include routine service requests,  communications from customers unrelated to the quality, safety, or  effectiveness of the device, and internal communications.
    FDA agrees with the comments in part and has modified the  definition to make clear that a communication would be considered a  "complaint’’ only if the communication alleged some deficiency related  to the identity, quality, durability, reliability, safety,  effectiveness, or performance of the device after it is released for  distribution. The definition is now very similar to the definition used  in ISO/CD 13485.

    The regulation addresses service requests and in-house indications  of dissatisfaction under Sec. 820.100 Corrective and preventive action.  This section requires manufacturers to establish procedures to identify  quality problems and process the information received to detect and  correct quality problems. Information generated in-house relating to  quality problems should be documented and processed as part of this  corrective and preventive action program.

    With respect to service requests, Sec. 820.200 Servicing states  that a service report that represents an event which    [[Page 52608]]   must be reported to the FDA under part 803 or 804 (21 CFR part 803 or  804) shall automatically be considered a complaint. All other service  reports must be analyzed for trends or systemic problems and when  found, these trends or systemic problems must be investigated according  to the provisions of Sec. 820.100 Corrective and preventive action.

    15. One comment suggested that the agency delete the phrase ``used  during device manufacturing’’ in the definition of ``component’’  because it was confusing and may cause problems with certain aspects of  distributor operations.

    FDA agrees and has deleted the words ``used during device  manufacturing’’ from the definition because it was not intended to  differentiate between distributors and manufacturers. Further, FDA  deleted the term ``packaging’’ to clarify that every piece of packaging  is not necessarily a component. Only the materials that are part of the  "finished, packaged, and labeled device’’ are considered to be  components.

    16. Several comments stated that the term ``complete history’’ in  the definition of ``control number’’ should be clarified or deleted  because it is unclear what a complete production history is, and the  term could be construed to require full traceability for all component  lots of any product containing a control number.

    FDA agrees in part with the comments. The control number is the  means by which the history of the device, from purchase of components  and materials through distribution, may be traced, where traceability  is required. The definition does not require that a manufacturer be  able to trace the device whenever control numbers are used. In fact,  the definition itself does not establish any requirements. The agency  notes, however, that the manufacturer’s traceability procedures should  ensure that a complete history of the device, including environmental  conditions which could cause the device to fail to conform to its  specified requirements, can be traced and should facilitate  investigation of quality problems and corrective action. FDA notes,  however, that the level of detail required for this history is  dependent on the nature of the device, its intended use, and its  complexity. Therefore, FDA has removed the term ``complete’’ in the  definition for clarity and flexibility.

    FDA has also amended the definition for added flexibility, to state  that symbols may be used and has included the term ``unit’’ for any  device that is not manufactured as a lot or batch.

    17. The definition of ``critical device’’ has been deleted for the  reasons discussed above.

    18. Several comments stated that the term ``design history record’’  should be changed because the acronym for the term is the same as that  for device history record (the DHR). Other comments said the ``design  history record’’ should not need to contain documentation of a  ``complete’’ design history. One comment stated that the definition  should allow reference to records containing the design history of the  device. A few comments stated that the term should be deleted  altogether because it is redundant with the definition of device master  record (the DMR).

    FDA agrees in part with these comments and has changed the term  ``design history record’’ to ``design history file.’’ In addition, FDA  has amended the provisions to require that the file describe the design  history, as it may not be necessary to maintain a record of every step  in the design phase, although the ``entire history’’ should be apparent  from the document. Section 820.30(j) further delineates what should be  in the design history file (the DHF), specifically records sufficient  to verify that the design was developed in accordance with the design  and development plan and other applicable design requirements of the  regulation.

    FDA does not agree that the definitions of the DHF and the DMR are  redundant. The DHF for each type of device should include, for example,  the design and development plan, design review results, design  verification results, and design validation results, as well as any  other data necessary to establish compliance with the design  requirements. The DMR should contain all of the procedures related to  each type of device as required by this part and the most current  manufacturing specifications of the device, once the design  specifications have been transferred into production.

    19. One comment on ``design input’’ stated it was confused by the  term "requirements’’ and wanted to know whose requirements are  encompassed in this definition.

    The term "requirement’’ is meant in the broadest sense, to  encompass any internally or externally imposed requirements such as  safety, customer-related, and regulatory requirements. All of these  requirements must be considered as design inputs. How these  requirements are handled and dealt with is up to the manufacturer.
    20. Two comments stated that the definition of "design output’’  should be revised because it is not necessary, and would be burdensome,  to keep records of and review the "results of a design effort at each  design phase and at the end.’’ Other comments suggested that the design  output definition should be restricted to physical characteristics of  the device.

    FDA agrees in part, but has not deleted the phrase ``results of a  design effort at each design phase and at the end’’ from the  definition. The intent was not to dictate when design phases would  occur. Such phases will be defined in the design and development plan.  For example, a manufacturer may only have a few design phases for a new  type of syringe. Thus, design output would be the results of those few  efforts. The results of each design phase constitute the total design  output. The definition has been amended, however, to clarify that the  finished design output is the basis for the DMR.

    FDA disagrees with the comments that suggest that the design output  should be restricted to physical characteristics of the device. Design  output is more than just the device specifications. Design output  includes, among other things, the specifications for the manufacturing  process, the quality assurance testing, and the device labeling and  packaging. It is important to note that the design effort should not  only control the design aspects of the device during the original  development phase, but also all subsequent design and development  activities including any redesign or design changes after the original  design is transferred to production.

    21. A few comments on the definition of ``design review’’ stated  that proposing solutions to problems is not part of the design review  activity. Two other comments expressed concern that the definition  would require that each design review be ``comprehensive.’’

    In response to the comments on the proper role of design review,  FDA agrees that the design review participants are typically not  responsible for establishing solutions, although they may do so in many  small operations. The definition has been amended, but FDA wants to  make clear that although the design review participants need not  propose solutions, they should ensure that solutions to any identified  problems are adequate and implemented appropriately.

    Regarding the scope of design review, each design review need not  be ``comprehensive’’ for the entire design process but must be  ``comprehensive’’ for the design phase being reviewed. However, at the  end of the design process when the design is transferred  [[Page 52609]]  to production, all aspects of the design process should have been  reviewed.

    A few other changes were made to harmonize with the definition in  ISO 8402:1994 ``Quality--Vocabulary.’’

    22. Comments on the definition of ``device master record’’ pointed  out that the definition is not consistent with the requirements of  Sec. 820.181 Device master record. Other comments stated that the  definition should allow reference to records. One comment stated that  ``all’’ procedures related to a specific finished device need not be  included in the DMR, such as the procedures for the design and  development, since they may be in the DHF.

    FDA agrees in part with the comments that found the DMR definition  and requirements to be inconsistent and has amended the definition to  be consistent with the requirements set forth in Sec. 820.181. FDA does  not believe, however, that it is necessary to modify the definition to  include the referencing of records because the DMR requirements in  Sec. 820.181 state that the DMR ``shall include or refer to the  location of’’ the required information. FDA agrees that the term  ``all’’ is not necessary and has deleted it in order to give  manufacturers the necessary flexibility.

    23. The definition for the term ``end-of-life’’ was added to the  Working Draft because this term was used in the definitions for  ``refurbisher’’ and ``servicing’’ to help distinguish the activities of  refurbishing from those of servicing. FDA determined that such a  distinction was necessary, due to comments and ongoing confusion  regarding the difference between the two functions, and the different  requirements applicable to the functions.

    Many written comments and persons who testified at the August and  September 1995 meetings stated that the term was confusing,  unnecessary, and introduced many new legal and liability issues. FDA  agrees with these comments and has deleted the term throughout the  regulation. FDA has also deleted definitions for ``refurbisher’’ and  ``servicing’’ for the reasons discussed below.

    24. The few comments received on the definition of ``establish’’  indicated a concern that the regulation requires too much documentation  and is more onerous than ISO 9001 requirements. 

    FDA disagrees with the comments. The term ``establish’’ is only  used where documentation is necessary. FDA also notes that the quality  system regulation is premised on the theory that adequate written  procedures, which are implemented appropriately, will likely ensure the  safety and effectiveness of the device. ISO 9001:1994 relies on the  same premise. The 1994 version of ISO 9001 broadly requires the  manufacturer to ``establish, document, and maintain a quality system,’’  which includes documenting procedures to meet the requirements.       The definition has been amended, however, in response to general  comments received, to clarify that a ``document’’ may be in writing or  on electronic media, to allow flexibility for any type of recorded  media.

    25. FDA received comments questioning the inclusion of a device  that is intended to be sterile, but that is not yet sterile, in the  definition of ``finished device.’’ A few comments stated that ``capable  of functioning’’ is ambiguous, and ``suitable for use’’ is not  necessary. Another comment requested that the term ``accessory’’ be  defined.

    FDA disagrees with the comments, but has amended the definition for  clarification. Since the 1978 CGMP regulation was promulgated, FDA has  been repeatedly asked whether devices intended to be sold as sterile  are considered subject to the CGMP requirements, even though they have  not yet been sterilized. The agency had intended the new definition to  make explicit the application of the regulation to the manufacture of  sterile devices that have yet to be sterilized. Although FDA believes  it should be obvious that such devices are subject to CGMP  requirements, some manufacturers have taken the position that the  regulation does not apply because the device is not ``finished’’ or  ``suitable for use’’ until it has been sterilized.      

    To better clarify its intent, FDA has amended the definition to add  that all devices that are capable of functioning, including those  devices that could be used even though they are not yet in their final  form, are ``finished devices.’’ For example, devices that have been  manufactured or assembled, and need only to be sterilized, polished,  inspected and tested, or packaged or labeled by a purchaser/ manufacturer are clearly not components, but are now in a condition in  which they could be used, therefore meeting the definition of  ``finished device.’’      

    The distinction between ``components’’ and ``finished devices’’ was  not intended to permit manufacturers to manufacture devices without  complying with CGMP requirements by claiming that other functions, such  as sterilization, incoming inspection (where sold for subsequent minor  polishing, sterilization, or packaging), or insertion of software, will  take place. The public would not be adequately protected in such cases  if a manufacturer could claim that a device was not a ``finished’’  device subject to the CGMP regulation because it was not in its  ``final’’ form.      

    The phrase ``for commercial distribution’’ was deleted from the  proposed definition of ``finished device’’ because it is not necessary  for a device to be in commercial distribution to be considered a  finished device. Further, FDA notes that the term ``accessory’’ is  described in Sec. 807.20(a)(5) (21 CFR 807.20(a)(5)).   

    26. Two comments on the definition of ``lot or batch’’ requested  that the definition be clarified: One to reflect that single units may  be produced for distribution, the other to indicate that what  constitutes a lot or a batch may vary depending on the context.     

    In response to the comments, FDA has modified the definition to  make clear that a lot or batch may, depending on circumstances, be  comprised of one finished device. Whether for inspection or for  distribution, a lot or batch is determined by the factors set forth in  the definition; of course, a manufacturer may determine the size of the  lot or batch, as appropriate.      

    27. Several comments received on the definition of ``executive  management’’ objected that the definition is inconsistent with ISO  9001. Others thought that FDA should better define the level of  management the term was intended to describe.      

    FDA agrees with both concerns and has modified the definition by  deleting the second half, which appeared to bring executive authority  and responsibility too far down the organization chart. The term was  intended to apply only to management that has the authority to bring  about change in the quality system and the management of the quality  system. Although such management would clearly have authority over, for  example, distribution, those who may have delegated management  authority over distribution would not necessarily have authority over  the quality system and quality policy. Accordingly, the definition has  been modified to include only those who have the authority and  responsibility to establish and make changes to the quality policy and  quality system. It is the responsibility of top management to establish  and communicate the quality policy. In addition, the term ``executive  management’’ has been changed to ``management with executive  responsibility,’’ to harmonize with ISO 9001:1994.    

   
    28. Several comments in response to the proposed definition of  [[Page 52610]]    ``manufacturer’’ stated that refurbishers and servicers should be added  to the definition of a ``manufacturer.’’ Other comments recommended  adding the term ``remanufacturer.’’ Other comments requested deletion  of contract sterilizers, installers, specification developers,  repackagers, relabelers, and initial distributors from the definition.  One comment stated that the phrase ``processes a finished device’’  should be explained in the definition of manufacturer.      

    FDA’s Compliance Policy Guide (CPG) 7124.28 contains the agency’s  policy regarding the provisions of the act and regulations with which  persons who recondition or rebuild used devices are expected to comply.  This CPG is in the process of being revised in light of FDA’s  experience in this area. FDA is not including the terms ``servicer’’ or  ``refurbisher,’’ as they relate to entities outside the control of the  original equipment manufacturer, in this final regulation, even though  it believes that persons who perform such functions meet the definition  of manufacturer. Because of a number of competitive and other issues,  including sharply divided views by members of the GMP Advisory  Committee at the September 1995 meeting, FDA has elected to address  application of the CGMP requirements to persons who perform servicing  and refurbishing functions outside the control of the original  manufacturer in a separate rulemaking later this year, with another  opportunity for public comment.   

    
    FDA agrees that the term ``remanufacturing’’ should be added to the  definition of ``manufacturer’’ and has separately defined the term. A  remanufacturer is defined as ``any person who processes, conditions,  renovates, repackages, restores, or does any other act to a finished  device that significantly changes the finished device’s performance or  safety specifications, or intended use.’’      

    However, FDA disagrees that contract sterilizers, installers,  specification developers, repackagers, relabelers, and initial  distributors should be deleted from the definition, primarily because  all such persons may have a significant effect on the safety and  effectiveness of a device and on the public health. All persons who  perform these functions meet the definition of manufacturer, and  therefore should be inspected to ensure that they are complying with  the applicable provisions. For example, a specification developer  initiates the design requirements for a device that is manufactured by  a second party for subsequent commercial distribution. Such a developer  is subject to design controls. Further, those that perform the  functions of contract sterilization, installation, relabeling,  remanufacturing, and repacking have routinely been considered to be  manufacturers under the original CGMP definition, and the agency has  treated them as such by inspecting them to ensure that they comply with  the appropriate portions of the original CGMP. By explicitly including  them in the definition of ``manufacturer’’ the agency has simply  codified its longstanding policy and interpretation of the original  regulation.      

    The phrase ``processes a finished device’’ applies to a finished  device after distribution. Again, this phrase has been