usa fda cgmp quality systems regulation

fede

ral r

egiste

r

52601

MondayOctober 7, 1996

Part VII

Department ofHealth and HumanServicesFood and Drug Administration

21 CFR Parts 808, 812, and 820Medical Devices; Current GoodManufacturing Practice (CGMP); FinalRule

52602 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations

DEPARTMENT OF HEALTH ANDHUMAN SERVICES

Food and Drug Administration

21 CFR Parts 808, 812, and 820

[Docket No. 90N–0172]

RIN 0910–AA09

Medical Devices; Current GoodManufacturing Practice (CGMP) FinalRule; Quality System Regulation

AGENCY: Food and Drug Administration,HHS.ACTION: Final rule.

SUMMARY: The Food and DrugAdministration (FDA) is revising thecurrent good manufacturing practice(CGMP) requirements for medicaldevices and incorporating them into aquality system regulation. The qualitysystem regulation includes requirementsrelated to the methods used in, and thefacilities and controls used for,designing, manufacturing, packaging,labeling, storing, installing, andservicing of medical devices intendedfor human use. This action is necessaryto add preproduction design controlsand to achieve consistency with qualitysystem requirements worldwide. Thisregulation sets forth the framework fordevice manufacturers to follow andgives them greater flexibility inachieving quality requirements.DATES: The regulation is effective June1, 1997. For more information oncompliance with 21 CFR 820.30 seesection IV. of this document.

Written comments on the informationcollection requirements should besubmitted by December 6, 1996.ADDRESSES: Submit written commentson the information collectionrequirements to the DocketsManagement Branch (HFA–305), Foodand Drug Administration, 12420Parklawn Dr., rm. 1–23, Rockville, MD20857. All comments should beidentified with the docket numberfound in brackets in the heading of thisdocument.FOR FURTHER INFORMATION CONTACT:Kimberly A. Trautman, Center forDevices and Radiological Health (HFZ-341), Food and Drug Administration,2098 Gaither Rd., Rockville, MD 20850,301–594–4648.

SUPPLEMENTARY INFORMATION:

I. BackgroundManufacturers establish and follow

quality systems to help ensure that theirproducts consistently meet applicablerequirements and specifications. Thequality systems for FDA-regulated

products (food, drugs, biologics, anddevices) are known as CGMP’s. CGMPrequirements for devices in part 820 (21CFR part 820) were first authorized bysection 520(f) of the Federal Food, Drug,and Cosmetic Act (the act) (21 U.S.C.360j(f)), which was among theauthorities added to the act by theMedical Device Amendments of 1976(Pub. L. 94–295).

Under section 520(f) of the act, FDAissued a final rule in the FederalRegister of July 21, 1978 (43 FR 31 508),prescribing CGMP requirements for themethods used in, and the facilities andcontrols used for the manufacture,packing, storage, and installation ofmedical devices. This regulation becameeffective on December 18, 1978, and iscodified under part 820. Except foreditorial changes to updateorganizational references in theregulation and revisions to the list ofcritical devices that was included in thepreamble to the final regulation, thedevice CGMP requirements have notbeen revised since 1978. This final ruleis the result of an extensive effort begunin 1990 to revise this regulation.

The Safe Medical Devices Act of 1990(the SMDA) (Pub. L. 101–629), enactedon November 28, 1990, amended section520(f) of the act, providing FDA withthe authority to add preproductiondesign controls to the CGMP regulation.This change in law was based onfindings that a significant proportion ofdevice recalls were attributed to faultydesign of product. Specifically, inJanuary 1990, FDA published the resultsof an evaluation of device recalls thatoccurred from October 1983 throughSeptember 1989, in a report entitled‘‘Device Recalls: A Study of QualityProblems’’ (Ref. 1). (See 55 FR 21108,May 22, 1990, where FDA announcedthe availability of the report.) FDAfound that approximately 44 percent ofthe quality problems that led tovoluntary recall actions during this 6-year period were attributed to errors ordeficiencies that were designed intoparticular devices and may have beenprevented by adequate design controls.These design-related defects involvedboth noncritical devices (e.g., patientchair lifts, in vitro diagnostics, andadministration sets) and critical devices(e.g., pacemakers and ventilators). Alsoin 1990, the Department of Health andHuman Services’ Inspector Generalconducted a study entitled ‘‘FDAMedical Device Regulation FromPremarket Review to Recall’’ (Ref. 2),which reached similar conclusions.With respect to software used to operatemedical devices, the data were evenmore striking. A subsequent study ofsoftware-related recalls for the period of

fiscal year (FY) 1983 through FY 1991indicated that over 90 percent of allsoftware-related device failures weredue to design-related errors, generally,the failure to validate software prior toroutine production (Ref. 3).

The SMDA also added new section803 to the act (21 U.S.C. 383) which,among other things, encourages FDA towork with foreign countries towardmutual recognition of CGMPrequirements. FDA undertook therevision of the CGMP regulation to addthe design controls authorized by theSMDA to the CGMP regulation, as wellas because the agency believed that itwould be beneficial to the public andthe medical device industry for theCGMP regulation to be consistent, to theextent possible, with the requirementsfor quality systems contained inapplicable international standards,primarily, the InternationalOrganization for Standards (ISO)9001:1994 ‘‘Quality Systems—Model forQuality Assurance in Design,Development, Production, Installation,and Servicing’’ (Ref. 4), and the ISOcommittee draft (CD) revision of ISO/CD13485 ‘‘Quality Systems—MedicalDevices—Supplementary Requirementsto ISO 9001’’ (Ref. 5).

This action is being taken under thoseprovisions of the SMDA and in responseto the following: (1) Notices thatappeared in the Federal Register ofApril 25, 1990 (55 FR 17502), and in theFederal Register of April 17, 1991 (56FR 15626), that announced meetings ofthe agency’s Device GoodManufacturing Practice AdvisoryCommittee (GMP Advisory Committee),at which the need for revisions to theCGMP regulation was explored; (2) anadvance notice of proposed rulemaking(ANPRM) that appeared in the FederalRegister of June 15, 1990 (55 FR 24544),that announced the agency’s intent torevise the CGMP regulation; (3) a noticeof availability of a document thatappeared in the Federal Register ofNovember 30, 1990 (55 FR 49644),entitled ‘‘Medical Devices; CurrentGood Manufacturing Practices (CGMP)Regulations Document; SuggestedChanges; Availability’’ (Ref. 6) andcomments solicited from the publicabout the document; (4) a proposed rulein the Federal Register of November 23,1993 (58 FR 61952), (Ref. 7) andcomments solicited from the publicabout the proposal; (5) a notice ofavailability that appeared in the FederalRegister of July 24, 1995 (60 FR 37856),announcing the availability of the‘‘Working Draft of the Current GoodManufacturing Practice (CGMP) FinalRule’’ (hereinafter referred to as theWorking Draft) (Ref. 8) and comments

52603Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations

solicited from the public about theWorking Draft; (6) testimony at anAugust 23, 1995, open public meetingannounced in the Federal Register (60FR 37856); (7) and testimony andadvisory committee recommendationsfrom the September 13 and 14, 1995,meeting of the GMP AdvisoryCommittee announced in the FederalRegister of August 24, 1995 (60 FR44036). Thus, FDA’s decision to revisethe CGMP regulation is based onchanges in the law made by the SMDA,the agency’s discussions with othersincluding its GMP Advisory Committee,responses to the Federal Registernotices on this matter, FDA’s analysis ofrecall data, its experience with theregulatory application of the originalCGMP regulation, and its assessment ofinternational quality standards.

The agency’s final rule embraces thesame ‘‘umbrella’’ approach to the CGMPregulation that is the underpinning ofthe original CGMP regulation. Becausethis regulation must apply to so manydifferent types of devices, the regulationdoes not prescribe in detail how amanufacturer must produce a specificdevice. Rather, the regulation providesthe framework that all manufacturersmust follow by requiring thatmanufacturers develop and followprocedures and fill in the details thatare appropriate to a given deviceaccording to the current state-of-the-artmanufacturing for that specific device.FDA has made changes to the proposedregulation and the Working Draft, as thefinal rule evidences, to providemanufacturers with even greaterflexibility in achieving the qualityrequirements.

The Supreme Court recentlyaddressed the preemptive effect, undersection 521 of the act (21 U.S.C. 360k),of the original CGMP regulation andother FDA requirements for medicaldevices on State tort actions. InMedtronic, Inc. v. Lohr, 116 S. Ct. 2240(1996), the Supreme Court gavesubstantial deference to the agency’sinterpretation of section 521 of the actfound at § 808.1 (21 CFR 808.1). TheCourt noted that CGMP requirementsare general rather than ‘‘specificrequirements applicable to a particulardevice,’’ and that State common lawremedies are similarly general, and donot establish a ‘‘substantive requirementfor a specific device.’’ (Lohr at 2257; seealso § 808.1(d) and (d)(6)(ii).) Moreover,the Court drew a distinction betweenremedies and requirements, noting thatwhile common law tort actions mayprovide remedies different from thoseavailable under the act, no preemptionoccurs unless the substantiverequirements of the State law are

‘‘different from, or in addition to,’’ thoseimposed by the act. (See Lohr at 2255.)Under the Supreme Court’s analysis inLohr, the requirements imposed by theoriginal CGMP regulation would rarelyhave preemptive effect.

FDA believes that the reasoning ofMedtronic v. Lohr applies equally to thenew quality system regulation, which,as does the original CGMP regulation,prescribes requirements that apply tomedical devices in general, rather thanto any particular medical device.Therefore, FDA has concurrentlyamended part 808 (21 CFR part 808) tomake clear the new quality systemregulation does not preempt State tortand common law remedies.

II. Decision to Make a Working DraftAvailable for Comment

In the Federal Register of November23, 1993, the agency issued theproposed revisions to the CGMPregulation, entitled ‘‘Medical Devices;Current Good Manufacturing Practice(CGMP) Regulations; ProposedRevisions; Request for Comments,’’ andpublic comment was solicited. After theproposal issued, FDA met with theGlobal Harmonization Task Force (theGHTF) Study Group in early March1994, in Brussels, to compare theprovisions of the proposal with theprovisions of ISO 9001:1994 andEuropean National Standard (EN) 46001‘‘Quality Systems—Medical Devices—Particular Requirements for theApplication of EN 29001’’ (Ref. 9). ISO9001:1994 and EN 46001:1994 arewritten as voluntary standards, butwhen used to fulfill the requirements ofthe European Medical Device Directives,or other national regulations, thesestandards are mandatory requirementssimilar to the CGMP requirements. TheGHTF includes: Representatives of theCanadian Ministry of Health andWelfare, the Japanese Ministry of Healthand Welfare, FDA, and industrymembers from the European Union(EU), Australia, Canada, Japan, and theUnited States. The participants at theGHTF meeting favorably regarded FDA’seffort toward harmonization withinternational standards. The GHTFsubmitted comments, however, notingwhere FDA could more closelyharmonize to achieve consistency withquality system requirements worldwide.Since the proposal published, FDA hasalso attended numerous industry andprofessional association seminars andworkshops, including ISO TechnicalCommittee (TC) 210 ‘‘QualityManagement and CorrespondingGeneral Aspects for Medical Devices’’meetings, where the proposed revisionswere discussed.

The original period for comment onthe proposal closed on February 22,1994, and was extended until April 4,1994. Because of the heavy volume ofcomments and the desire to increasepublic participation in the developmentof the quality system regulation, FDAdecided to publish the notice ofavailability in the Federal Register toallow comment on the Working Draftbefore issuing a final regulation.

The Working Draft represented theagency’s views at the time on how itwould respond to the many commentsreceived, and on how the agencybelieved a final rule should be framed.FDA solicited public comment on theWorking Draft until October 23, 1995, todetermine if the agency had adequatelyaddressed the many comments receivedand whether the agency had framed afinal rule that achieved the publichealth goals to be gained fromimplementation of quality systems inthe most efficient manner.

III. Open Public Meeting and GMPAdvisory Committee Meeting

FDA held an open public meeting onthe quality system regulation on August23, 1995. The public meeting consistedof prepared presentations followed byan open discussion period. Both theagency and the participants found themeeting to be very productive infocusing attention on the few main areasof concern in the Working Draft. Themain issues were: The application of theregulation to component manufacturers;the application of the regulation to thirdparty servicers and refurbishers; and theimplementation timeframe of the finalrule. A transcript of the proceedings ofthe public meeting, as well as data andinformation submitted to FDA duringthe public meeting, are available fromthe Dockets Management Branch (HFA–305), Food and Drug Administration,12420 Parklawn Dr., rm. 1–23,Rockville, MD 20857, between 9 a.m.and 4 p.m., Monday through Friday.

There also was a meeting of the GMPAdvisory Committee on the WorkingDraft on September 13 and 14, 1995. Anotice of the meeting was published inthe Federal Register of August 24, 1995.FDA made a brief presentation to thecommittee on the changes from the 1993proposal to the 1995 Working Draft anddiscussed some changes that FDA wasrecommending as a result of the August1995 meeting. Two consultants alsomade presentations to the committee,one a representative from ISO TC 176(the TC that authored the ISO 9000series) and the other a representativefrom the European Committee forStandardization (CEN). The remainderof the meeting consisted of prepared


presentations from the public and thecommittee’s discussion on the mainissues.

The overwhelming majority of thecommittee members believed that theWorking Draft met the public healthneeds, gave manufacturers sufficientflexibility to comply with theregulation, and met the agency’s goal ofharmonizing the quality systemrequirements with those of othercountries. The GMP AdvisoryCommittee strongly supported FDA’srecommendation, in response to theAugust 1995 public meeting, to notinclude component manufacturersunder this final rule. However, the GMPAdvisory Committee was clearlydivided on several issues related to theproposed regulation of third partyservicers and refurbishers. A transcriptof the proceedings of the GMP AdvisoryCommittee meeting, as well as data andinformation submitted to FDA duringthe meeting, are available from theDockets Management Branch (addressabove).

After considering the writtencomments and the views expressed atmeetings with the GHTF, at the August1995 public meeting, and at theSeptember 1995 GMP AdvisoryCommittee meeting, FDA is publishingthis final rule. A summary of changesfrom the July 1995 Working Draft to thefinal rule is contained at the end of thispreamble.

IV. Implementation of the Final RuleFDA has decided, in response to the

many comments and concernsexpressed about the need for more timeto implement design controls, toimplement the final rule in two stages.Under stage one, on June 1, 1997,approximately 1 year after this rule ispublished in the Federal Register, allelements of the final rule becomeeffective. However, with respect to thedesign control requirements in § 820.30,as long as manufacturers are takingreasonable steps to come intocompliance, FDA will implement aspecial 1-year transition program, witha midcourse review, during whichofficial agency action will not beinitiated, including FDA Form 483observations, warning letters, orenforcement cases, based on failure tocomply with § 820.30. Under stage two,beginning June 1, 1998, FDA will treatnoncompliance with design controlrequirements in § 820.30 the same asnoncompliance with other provisions ofthe CGMP regulation.

To prepare for stage one of thisimplementation plan, FDA intends todevelop, by April of 1997, a strategy forinspecting the design control

requirements. Both industry and FDAfield investigators will then be trainedon this inspectional strategy for designcontrols during April and May 1997.Starting June 1, 1997, manufacturerswill be inspected for compliance withall the new quality system requirements,including design controls, in themanner described in the inspectionalstrategy. However, as part of thetransition program, from June 1, 1997,for a period of 1 year, although FDA willinspect firms for compliance with thedesign control requirements, the fieldwill issue any observations to themanufacturer on a separate designcontrol inspectional strategy report, noton FDA Form 483. The design controlinspectional strategy report will bemade a part of the manufacturer’sestablishment inspection report (EIR),but the observations relating to § 820.30will not be included in any warningletters or regulatory actions during thisinitial 1-year period. FDA notes that itcan, at any time, take action againstunsafe or adulterated medical devicesunder different regulatory or statutoryauthorities. FDA wants to emphasizethat manufacturers are required to takereasonable steps to come intocompliance with the design controlrequirements during the June 1, 1997, toJune 1, 1998, period.

FDA also emphasizes that thistransition period relates only to thedesign control requirements of § 820.30,and that beginning June 1, 1997, theagency will issue observations on FDAForm 483’s, issue warning letters, andtake any necessary regulatory action forviolations of all other provisions of theCGMP final rule. The time period fromJune 1, 1997, to June 1, 1998, isintended to allow both the industry andFDA field investigators time to becomefamiliar with the design controlrequirements and the enforcementaspects of this new area.

Finally, as described elsewhere in thispreamble, FDA intends to conduct amidcourse review of the new designcontrol requirements during thetransition year (June 1997 to June 1998).Specifically, the results of the firstseveral months of design controlinspections will be reviewed by early1998. FDA will review all of thecompleted design control inspectionalstrategy reports that were given tomanufacturers from between June 1,1997, through December 1, 1997. Thecompleted strategy reports will bereviewed with particular attention paidto clarity of information obtained, theappropriateness of the informationcollected with respect to the designcontrol requirements, theappropriateness of the questions on the

inspectional strategy, the manner inwhich the investigators are writing outtheir observations, and anyrequirements that seem to be givingmanufacturers a problem or where theremight be misunderstandings as to whatthe regulation requires. FDA will thenhold an open public meeting in early1998 to discuss with industry thesefindings and to further explore anyconcerns industry might be having inimplementing the new design controlrequirements. As a result of themidcourse review and open publicmeeting, FDA might hold additionalworkshops, meetings, and/or trainingsessions.

Any midcourse adjustments to theinspectional strategy will be institutedand made public by the spring of 1998.Also during this midcourse review, FDAwill evaluate the information gatheredat that point and determine if the designcontrol requirements as written in thisfinal rule are appropriate to obtain thegoals expressed in this preamble. FDAwill consider minor or even majorchanges, based on experience to date.Any necessary adjustments or proposedrevisions will be published in theFederal Register and comments will besolicited as necessary during the springof 1998. This implementation strategy isresponsive to requests by industry forFDA to harmonize the quality systemregulation’s implementation with themandatory date for implementation ofthe EU’s Medical Device Directive,which is June 1998. However, if duringthe midcourse review of stage one it isdetermined that the industry and/orFDA needs more time to fullyimplement the design controlrequirements, FDA will publish anextension of the regulatoryimplementation date for design controlrequirements prior to June 1, 1998.

V. Response to Comments andRationale for Changes

Approximately 280 separateindividuals or groups commented onthe proposal published in the FederalRegister of November 23, 1993, andapproximately 175 separate individualsor groups commented on the WorkingDraft that was announced in a notice ofavailability published in the FederalRegister on July 24, 1995. FDA mademany changes in response to thecomments. Most of the changes weremade in response to specific comments,in response to comments for clarity,understanding, and readability, or tofurther harmonize FDA requirementswith international standards, as manycomments requested.

Numerous comments stated thatindustry was very pleased with FDA’s


Working Draft and the effort that wasmade to harmonize with ISO, as well asto engage industry in commenting onthe Working Draft through the openpublic meeting and the GMP AdvisoryCommittee meeting that were held inAugust and September 1995,respectively.

FDA’s responses to the commentsreceived on the proposal and theWorking Draft, as well as explanationsfor the changes made, follow.

A. General Provisions (Subpart A)

i. Scope (§ 820.1)1. The title of the regulation, as

reflected in this section, has beenchanged from the ‘‘Current GoodManufacturing Practices (CGMP)’’regulation to the ‘‘Quality System’’regulation. This revision follows thesuggestion underlying many commentson specific provisions that FDAgenerally harmonize the CGMPrequirements and terminology withinternational standards. ISO 9001:1994,ISO/CD 13485, and EN 46001 employthis terminology to describe the CGMPrequirements. In addition, this titleaccurately describes the sum of therequirements, which now include theCGMP requirements for design,purchasing, and servicing controls.CGMP requirements now cover a fullquality system.

FDA notes that the principlesembodied in this quality systemregulation have been acceptedworldwide as a means of ensuring thatacceptable products are produced.While the regulation has beenharmonized with the medical devicerequirements in Europe, Australia, andJapan, as well as the requirementsproposed by Canada, it is anticipatedthat other countries will adopt similarrequirements in the near future.

FDA, however, did not adopt ISO9001:1994 verbatim for two reasons.First, there were complications indealing with the issue of copyrights and,second, FDA along with health agenciesof other governments does not believethat for medical devices ISO 9001:1994alone is sufficient to adequately protectthe public health. Therefore, FDA hasworked closely with the GHTF and TC210 to develop a regulation which isconsistent with both ISO 9001:1994 andISO/CD 13485. FDA made severalsuggestions to TC 210 on the drafts ofthe ISO/CD 13485 document in order tominimize differences and move closer toharmonization. In some cases, FDA hasexplicitly stated requirements that manyexperts believe are inherent in ISO9001:1994. Through the many years ofexperience enforcing and evaluating

compliance with the original CGMPregulation, FDA has found that it isnecessary to clearly spell out itsexpectations. This difference inapproach does not represent anyfundamentally different requirementsthat would hinder global harmonization.In fact, numerous comments expressedtheir approval and satisfaction withFDA’s effort to harmonize the qualitysystem requirements with those of ISO9001:1994 and ISO/CD 13485.

2. One comment suggested that theterm ‘‘purchasing’’ in the scope bedeleted because it could be interpretedto mean the purchase of finishedmedical devices by health careinstitutions and medical professionals,instead of the purchase of componentsand manufacturing materials asintended.

FDA agrees and has deleted the term‘‘purchasing’’ throughout the regulationwhen used in this context.

3. Several comments suggested that§ 820.1(a)(1) should not state that theregulation establishes the ‘‘minimum’’requirements because it implies thatcompliance with the statedrequirements may be insufficient. Theyasked that FDA delete the word‘‘minimum,’’ to avoid having auditorssearch for additional requirements.

FDA does not believe that theprovision would have required thatmanufacturers meet additionalrequirements not mandated by theregulation but has modified the sectionto clarify its intent by stating that theregulation establishes the ‘‘basic’’requirements for manufacturing devices.The quality system regulation providesa framework of basic requirements foreach manufacturer to use in establishinga quality system appropriate to thedevices designed and manufactured andthe manufacturing processes employed.Manufacturers must adopt current andeffective methods and procedures foreach device they design andmanufacture to comply with andimplement the basic requirements. Theregulation provides the flexibilitynecessary to allow manufacturers toadopt advances in technology, as well asnew manufacturing and quality systemprocedures, as they become available.

During inspections, FDA will assesswhether a manufacturer has establishedprocedures and followed requirementsthat are appropriate to a given deviceunder the current state-of-the-artmanufacturing for that specific device.FDA investigators receive extensivetraining to ensure uniforminterpretation and application of theregulation to the medical deviceindustry. Thus, the agency does notbelieve that FDA investigators will cite

deviations from requirements notcontained in this part. However, asnoted above, FDA has altered thelanguage of the scope to make clear thatadditional, unstated requirements donot exist.

4. A few comments suggestedeliminating the distinction betweencritical and noncritical devices, thuseliminating the need for distinctrequirements for critical devices. Othercomments disagreed, asserting thateliminating the distinction wouldincrease the cost of production of low-risk devices without improving theirsafety and effectiveness.

FDA agrees in part with the commentsthat suggest eliminating the distinctionbetween critical and noncritical devicesand has eliminated the term ‘‘criticaldevice’’ from the scope, definitions, andregulation in §§ 820.65 Critical devices,traceability and 820.165 Criticaldevices, labeling. However, FDA hasretained the concept of distinguishingbetween devices for the traceabilityrequirements in § 820.65. As addressedin the discussion under that section,FDA believes that it is imperative thatmanufacturers be able to trace, bycontrol number, any device, or whereappropriate component of a device, thatis intended for surgical implant into thebody or to support or sustain life whosefailure to perform when properly usedin accordance with instructions for useprovided in the labeling can bereasonably expected to result in asignificant injury to the user.

The deletion of the terminology willbring the regulation in closer harmonywith ISO 9001:1994 and the qualitysystem standards or requirements ofother countries.

Finally, FDA notes that eliminatingthe term ‘‘critical device’’ and the list ofcritical devices does not result in theimposition of new requirements. In factthe new regulation is less prescriptiveand gives the manufacturer theflexibility to determine the controls thatare necessary commensurate with risk.The burden is on the manufacturer,however, to describe the types anddegree of controls and how thosecontrols were decided upon. Suchdeterminations are made in accordancewith standard operating procedures(SOP’s) established by the manufacturer.

5. In response to numerouscomments, FDA has added the sentence‘‘If a person engages in only someoperations subject to the requirementsin this part, and not in others, thatperson need only comply with thoserequirements applicable to theoperations in which he or she isengaged.’’ This sentence was added toclarify the scope of the regulation and


the responsibility of those who fallunder this regulation. The wording isthe same as that used in the drug CGMP.

6. Several comments recommendedthat the short list of class I devicessubject to design control requirementsbe deleted from the regulation and beplaced in the preamble, to allowadditions or deletions without requiringa change to the entire regulation. Otherscommented that the list of class Idevices should be entirely eliminated toharmonize with Europe and Japan.

FDA disagrees that the list of devicessubject to design control requirementsshould be deleted from the regulation.FDA has experienced problems or hasconcerns with the class I devices listedand has determined that design controlsare needed for the listed devices.Further, placing the list in theregulation establishes the requirementsrelated to those devices, and isconvenient for use by persons who arenot familiar with, or who do not haveaccess to, the preamble. Further, FDAnotes that individual sections of aregulation may be revised independentof the remainder of the regulation.

7. Numerous written comments andpersons who testified at the August andSeptember 1995 meetings stated thatapplication of the regulation tocomponent manufacturers wouldincrease product cost, with questionablevalue added to device safety andeffectiveness, and that many componentsuppliers would refuse to supplycomponents or services to the medicaldevice industry. This would beespecially likely to occur, it wassuggested, where medical devicemanufacturers account for a smallfraction of the supplier’s sales.

FDA believes that because of thecomplexity of many components usedin medical devices, their adequacycannot always be assured throughinspection and testing at the finisheddevice manufacturer. This is especiallytrue of software and software-relatedcomponents, such as microprocessorsand microcircuits. Quality must bedesigned and built into componentsthrough the application of properquality systems.

However, FDA notes that the qualitysystem regulation now explicitlyrequires that the finished devicemanufacturer assess the capability ofsuppliers, contractors, and consultantsto provide quality products pursuant to§ 820.50 Purchasing controls. Theserequirements supplement theacceptance requirements under§ 820.80. Manufacturers must complywith both sections for any incomingcomponent or subassembly or service,regardless of the finished device

manufacturer’s financial or businessaffiliation with the person providingsuch products or services. FDA believesthat these purchasing controls aresufficient to provide the neededassurance that suppliers, contractors,and consultants have adequate controlsto produce acceptable components.

Therefore, balancing the manyconcerns of the medical device industryand the agency’s public health andsafety concerns, FDA has decided toremove the provision making the CGMPregulation applicable to componentmanufacturers and return to thelanguage in the original CGMPregulation. This approach wasunanimously endorsed by the membersof the GMP Advisory Committee at theSeptember 1995 meeting. FDA willcontinue to focus its inspections onfinished device manufacturers andexpects that such manufacturers willproperly ensure that the componentsthey purchase are safe and effective.Finished device manufacturers who failto comply with §§ 820.50 and 820.80will be subject to enforcement action.FDA notes that the legal authority existsto cover component manufacturersunder the CGMP regulation should theneed arise.

8. One comment stated that proposed§ 820.1(a)(2) should be revised toinclude the District of Columbia and theCommonwealth of Puerto Rico, as in theoriginal CGMP regulation.

FDA agrees with the comment. Theselocalities were inadvertently omittedand have been added to the regulation.

9. FDA added § 820.1(a)(3) on how tointerpret the phrase ‘‘whereappropriate’’ in the regulation, asrecommended by the GMP AdvisoryCommittee. This section is consistentwith the statement in ISO/CD 13485.

10. Some comments on proposed§ 820.1(c) recommended that the sectionbe deleted as it already appears in theact. Others stated that the provisionimplies that FDA will subject devices orpersons to legal action, regardless of thelevel of noncompliance. Still otherssuggested that only intentionalviolations of the regulation should giverise to regulatory action.

FDA disagrees with these comments.The consequences of the failure tocomply, and the legal authority underwhich regulatory action may be taken,are included in the regulation so thatthe public may be fully apprised of thepossible consequences ofnoncompliance and understand theimportance of compliance. FDA notesthat the agency exercises discretionwhen deciding whether to pursue aregulatory action and does not takeenforcement action for every violation it

encounters. Further, FDA generallyprovides manufacturers with warningprior to initiating regulatory action andencourages voluntary compliance. Theagency also notes, however, thatviolations of this regulation need not beintentional to place the public at seriousrisk or for FDA to take regulatory actionfor such violations.

In response to the concerns regardingthe tone of the section, however, thetitle has been changed. FDA has alsodeleted the specific provisionsreferenced in the proposed section withwhich the failure to comply wouldrender the devices adulterated. The term‘‘part’’ includes all of the regulation’srequirements.

11. A few comments on proposed§ 820.1(c)(2), now § 820.1(d), requestedthat the agency clarify what is meant byrequiring that foreign manufacturers‘‘schedule’’ an inspection. A fewcomments stated that FDA was addingnew requirements for foreignmanufacturers in this section. Othersstated that the proposed language wouldprohibit global harmonization because itwould limit third party audits in placeof FDA inspections.

FDA has moved the provision relatedto foreign manufacturers into a separatesection and has modified the language.The language in the regulation reflectsthe language in section 801(a) of the act(21 U.S.C. 381(a)). FDA disagrees that itis adding new requirements for foreignmanufacturers in § 820.1(d) because thesection recites the current requirementand standard used, and is consistentwith current agency policy. The agencybelieves that it is imperative that foreignfacilities be inspected for compliancewith this regulation and that they beheld to the same high standards towhich U.S. manufacturers are held.Otherwise, the U.S. public will not besufficiently protected from potentiallydangerous devices, and the U.S. medicaldevice industry will be at a competitivedisadvantage.

FDA intends to continue schedulinginspections of foreign manufacturers inadvance to assure their availability andavoid conflicts with holidays and shutdown periods. However, the languagepertaining to the ‘‘scheduling’’ of suchinspections has been deleted to allowflexibility in scheduling methods.

FDA disagrees that, as written, thelanguage would prohibit inspections bythird parties. FDA may use third partyinspections, as it uses other complianceinformation, in setting its priorities andutilizing its resources related to foreigninspections. In this regard, FDA looksforward to entering into agreementswith foreign countries related to CGMP


inspections that would provide FDAwith reliable inspectional information.

12. Two comments stated that thesection on ‘‘Exemptions or variances,’’now § 820.1(e), should require that FDAprovide a decision on petitions within60 days of receipt and state that theagency will take no enforcement actionwith respect to the subject of thepetition until a decision is rendered.The comments said that the petitionprocess is long, arduous, and notpractical.

FDA disagrees with the comments.Currently, FDA is required by section520(f)(2)(B) of the act to respond within60 days of receipt of the petition, unlessthe petition is referred to an advisorycommittee. When the 1978 CGMPregulation was published, there was aprediction that FDA would beoverwhelmed with petitions forexemption and variance from theregulation. Over the past 18 years, sincethe CGMP regulation first becameeffective, FDA has only receivedapproximately 75 petitions. It is FDA’sopinion that few petitions have beenreceived because of the flexible natureof the CGMP regulation. FDA hasattempted to write the currentregulation with at least the same degreeof flexibility, if not more, to allowmanufacturers to design a qualitysystem that is appropriate for theirdevices and operations and that is notoverly burdensome.

Guidelines for the submission ofpetitions for exemption or variance areavailable from the Division of SmallManufacturers Assistance (the DSMA).The petition guidelines state that FDAwill not process a petition forexemption or variance while an FDAinspection of a manufacturer is ongoing.Until FDA has approved a petition foran exemption or variance, amanufacturer should not deviate fromthe requirements of this regulation. FDAmust first have the opportunity toensure that the manufacturer hasestablished that an exemption orvariance is warranted, to carry out itsobligation of ensuring that devices aresafe and effective.

13. Several comments stated that theproposed requirements are notnecessary for all manufacturers,particularly small manufacturers withfew employees and low-risk devices.Other comments stated that thedocumentation requirements areexcessive.

FDA generally disagrees with thesecomments. The regulation provides the‘‘basic’’ requirements for the design andmanufacture of medical devices. And, asnoted in the previous response, therequirements are written in general

terms to allow manufacturers toestablish procedures appropriate fortheir devices and operations. Also, asdiscussed above, a manufacturer needonly comply with those requirementsapplicable to the operations in which heor she is engaged. However, because theregulation requirements are basic, theywill apply in total to mostmanufacturers subject to the regulation.The extent of the documentationnecessary to meet the regulationrequirements may vary with thecomplexity of the design andmanufacturing operations, the size ofthe firm, the importance of a process,and the risk associated with the failureof the device, among other factors.Small manufacturers may designacceptable quality systems that requirea minimum of documentation and,where possible, may automatedocumentation. In many situations,documentation may be kept at aminimum by combining many of therecordkeeping requirements of theregulation, for example, the productionSOP’s, handling, and storageprocedures. When manufacturersbelieve that the requirements are notnecessary for their operations, they maypetition for an exemption or variancefrom all or part of the regulationpursuant to section 520(f)(2) of the act.

In addition, FDA has added a varianceprovision in § 820.1(e)(2) under whichthe agency can initiate a variance whenit is in the best interest of the publichealth. Under this provision, forinstance, the agency may initiate andgrant a variance to manufacturers ofdevices during times of productshortages, where the devices are neededby the public and may not otherwise bemade available, if such manufacturerscan adequately assure that the resultingdevices are safe and effective. Theagency envisions this provision as abridge, providing a manufacturer withthe time necessary to fulfill therequirements in the regulation whileproviding important and needed devicesto the public. Thus, the variance wouldonly be granted for a short period oftime, and only while the devicesremained necessary and in short supply.Under this provision, FDA will requirea manufacturer to submit a plandetailing the action it is taking to assurethe safety and effectiveness of thedevices it manufactures and to meet therequirements of the regulation.

This agency initiated varianceprovision is in accordance with section520(f) of the act which permits, but doesnot require, FDA to promulgateregulations governing the goodmanufacturing practices for devices andsection 701(a) of the act (21 U.S.C.

371(a)), which permits FDA topromulgate regulations for the efficientenforcement of the act. Because thestatute does not mandate that the agencyestablish any requirements for deviceCGMP’s, the agency has the authority todetermine that the manufacturers ofcertain devices need not follow everyrequirement of the regulation.

Further, the agency initiated varianceprovision is in keeping with the intentof Congress that FDA prevent hazardousdevices from reaching the marketplace,H. Rept. 853, 94th Cong., 2d sess. 25–26 (1976), and the general intent of theact that the agency undertake to protectthe public health. The agency will onlyinitiate such a variance where thedevices are needed and may nototherwise be made available, and themanufacturer can assure the agency thatits procedures are likely to be adequateand that it is actively pursuing fullcompliance. The variances will only bein effect for a limited time.

Section 820.1(e) has been modified toinclude the above addition, to reflect thetitle change of the regulation, and toprovide the most current address for theDSMA.

ii. Definitions (§ 820.3)14. Several comments were received

regarding the definition of ‘‘complaint.’’Comments generally believed that thedefinition was unclear and could beinterpreted to include routine servicerequests, communications fromcustomers unrelated to the quality,safety, or effectiveness of the device,and internal communications.

FDA agrees with the comments in partand has modified the definition to makeclear that a communication would beconsidered a ‘‘complaint’’ only if thecommunication alleged some deficiencyrelated to the identity, quality,durability, reliability, safety,effectiveness, or performance of thedevice after it is released fordistribution. The definition is now verysimilar to the definition used in ISO/CD13485.

The regulation addresses servicerequests and in-house indications ofdissatisfaction under § 820.100Corrective and preventive action. Thissection requires manufacturers toestablish procedures to identify qualityproblems and process the informationreceived to detect and correct qualityproblems. Information generated in-house relating to quality problemsshould be documented and processed aspart of this corrective and preventiveaction program.

With respect to service requests,§ 820.200 Servicing states that a servicereport that represents an event which


must be reported to the FDA under part803 or 804 (21 CFR part 803 or 804)shall automatically be considered acomplaint. All other service reportsmust be analyzed for trends or systemicproblems and when found, these trendsor systemic problems must beinvestigated according to the provisionsof § 820.100 Corrective and preventiveaction.

15. One comment suggested that theagency delete the phrase ‘‘used duringdevice manufacturing’’ in the definitionof ‘‘component’’ because it wasconfusing and may cause problems withcertain aspects of distributor operations.

FDA agrees and has deleted the words‘‘used during device manufacturing’’from the definition because it was notintended to differentiate betweendistributors and manufacturers. Further,FDA deleted the term ‘‘packaging’’ toclarify that every piece of packaging isnot necessarily a component. Only thematerials that are part of the ‘‘finished,packaged, and labeled device’’ areconsidered to be components.

16. Several comments stated that theterm ‘‘complete history’’ in thedefinition of ‘‘control number’’ shouldbe clarified or deleted because it isunclear what a complete productionhistory is, and the term could beconstrued to require full traceability forall component lots of any productcontaining a control number.

FDA agrees in part with thecomments. The control number is themeans by which the history of thedevice, from purchase of componentsand materials through distribution, maybe traced, where traceability is required.The definition does not require that amanufacturer be able to trace the devicewhenever control numbers are used. Infact, the definition itself does notestablish any requirements. The agencynotes, however, that the manufacturer’straceability procedures should ensurethat a complete history of the device,including environmental conditionswhich could cause the device to fail toconform to its specified requirements,can be traced and should facilitateinvestigation of quality problems andcorrective action. FDA notes, however,that the level of detail required for thishistory is dependent on the nature ofthe device, its intended use, and itscomplexity. Therefore, FDA hasremoved the term ‘‘complete’’ in thedefinition for clarity and flexibility.

FDA has also amended the definitionfor added flexibility, to state thatsymbols may be used and has includedthe term ‘‘unit’’ for any device that isnot manufactured as a lot or batch.

17. The definition of ‘‘critical device’’has been deleted for the reasonsdiscussed above.

18. Several comments stated that theterm ‘‘design history record’’ should bechanged because the acronym for theterm is the same as that for devicehistory record (the DHR). Othercomments said the ‘‘design historyrecord’’ should not need to containdocumentation of a ‘‘complete’’ designhistory. One comment stated that thedefinition should allow reference torecords containing the design history ofthe device. A few comments stated thatthe term should be deleted altogetherbecause it is redundant with thedefinition of device master record (theDMR).

FDA agrees in part with thesecomments and has changed the term‘‘design history record’’ to ‘‘designhistory file.’’ In addition, FDA hasamended the provisions to require thatthe file describe the design history, as itmay not be necessary to maintain arecord of every step in the design phase,although the ‘‘entire history’’ should beapparent from the document. Section820.30(j) further delineates what shouldbe in the design history file (the DHF),specifically records sufficient to verifythat the design was developed inaccordance with the design anddevelopment plan and other applicabledesign requirements of the regulation.

FDA does not agree that thedefinitions of the DHF and the DMR areredundant. The DHF for each type ofdevice should include, for example, thedesign and development plan, designreview results, design verificationresults, and design validation results, aswell as any other data necessary toestablish compliance with the designrequirements. The DMR should containall of the procedures related to eachtype of device as required by this partand the most current manufacturingspecifications of the device, once thedesign specifications have beentransferred into production.

19. One comment on ‘‘design input’’stated it was confused by the term‘‘requirements’’ and wanted to knowwhose requirements are encompassed inthis definition.

The term ‘‘requirement’’ is meant inthe broadest sense, to encompass anyinternally or externally imposedrequirements such as safety, customer-related, and regulatory requirements.All of these requirements must beconsidered as design inputs. How theserequirements are handled and dealtwith is up to the manufacturer.

20. Two comments stated that thedefinition of ‘‘design output’’ should berevised because it is not necessary, and

would be burdensome, to keep recordsof and review the ‘‘results of a designeffort at each design phase and at theend.’’ Other comments suggested thatthe design output definition should berestricted to physical characteristics ofthe device.

FDA agrees in part, but has notdeleted the phrase ‘‘results of a designeffort at each design phase and at theend’’ from the definition. The intent wasnot to dictate when design phaseswould occur. Such phases will bedefined in the design and developmentplan. For example, a manufacturer mayonly have a few design phases for a newtype of syringe. Thus, design outputwould be the results of those few efforts.The results of each design phaseconstitute the total design output. Thedefinition has been amended, however,to clarify that the finished design outputis the basis for the DMR.

FDA disagrees with the commentsthat suggest that the design outputshould be restricted to physicalcharacteristics of the device. Designoutput is more than just the devicespecifications. Design output includes,among other things, the specificationsfor the manufacturing process, thequality assurance testing, and the devicelabeling and packaging. It is importantto note that the design effort should notonly control the design aspects of thedevice during the original developmentphase, but also all subsequent designand development activities includingany redesign or design changes after theoriginal design is transferred toproduction.

21. A few comments on the definitionof ‘‘design review’’ stated that proposingsolutions to problems is not part of thedesign review activity. Two othercomments expressed concern that thedefinition would require that eachdesign review be ‘‘comprehensive.’’

In response to the comments on theproper role of design review, FDAagrees that the design reviewparticipants are typically notresponsible for establishing solutions,although they may do so in many smalloperations. The definition has beenamended, but FDA wants to make clearthat although the design reviewparticipants need not propose solutions,they should ensure that solutions to anyidentified problems are adequate andimplemented appropriately.

Regarding the scope of design review,each design review need not be‘‘comprehensive’’ for the entire designprocess but must be ‘‘comprehensive’’for the design phase being reviewed.However, at the end of the designprocess when the design is transferred


to production, all aspects of the designprocess should have been reviewed.

A few other changes were made toharmonize with the definition in ISO8402:1994 ‘‘Quality—Vocabulary.’’

22. Comments on the definition of‘‘device master record’’ pointed out thatthe definition is not consistent with therequirements of § 820.181 Device masterrecord. Other comments stated that thedefinition should allow reference torecords. One comment stated that ‘‘all’’procedures related to a specific finisheddevice need not be included in theDMR, such as the procedures for thedesign and development, since theymay be in the DHF.

FDA agrees in part with the commentsthat found the DMR definition andrequirements to be inconsistent and hasamended the definition to be consistentwith the requirements set forth in§ 820.181. FDA does not believe,however, that it is necessary to modifythe definition to include the referencingof records because the DMRrequirements in § 820.181 state that theDMR ‘‘shall include or refer to thelocation of’’ the required information.FDA agrees that the term ‘‘all’’ is notnecessary and has deleted it in order togive manufacturers the necessaryflexibility.

23. The definition for the term ‘‘end-of-life’’ was added to the Working Draftbecause this term was used in thedefinitions for ‘‘refurbisher’’ and‘‘servicing’’ to help distinguish theactivities of refurbishing from those ofservicing. FDA determined that such adistinction was necessary, due tocomments and ongoing confusionregarding the difference between thetwo functions, and the differentrequirements applicable to thefunctions.

Many written comments and personswho testified at the August andSeptember 1995 meetings stated that theterm was confusing, unnecessary, andintroduced many new legal and liabilityissues. FDA agrees with these commentsand has deleted the term throughout theregulation. FDA has also deleteddefinitions for ‘‘refurbisher’’ and‘‘servicing’’ for the reasons discussedbelow.

24. The few comments received onthe definition of ‘‘establish’’ indicated aconcern that the regulation requires toomuch documentation and is moreonerous than ISO 9001 requirements.

FDA disagrees with the comments.The term ‘‘establish’’ is only used wheredocumentation is necessary. FDA alsonotes that the quality system regulationis premised on the theory that adequatewritten procedures, which areimplemented appropriately, will likely

ensure the safety and effectiveness ofthe device. ISO 9001:1994 relies on thesame premise. The 1994 version of ISO9001 broadly requires the manufacturerto ‘‘establish, document, and maintain aquality system,’’ which includesdocumenting procedures to meet therequirements.

The definition has been amended,however, in response to generalcomments received, to clarify that a‘‘document’’ may be in writing or onelectronic media, to allow flexibility forany type of recorded media.

25. FDA received commentsquestioning the inclusion of a devicethat is intended to be sterile, but that isnot yet sterile, in the definition of‘‘finished device.’’ A few commentsstated that ‘‘capable of functioning’’ isambiguous, and ‘‘suitable for use’’ is notnecessary. Another comment requestedthat the term ‘‘accessory’’ be defined.

FDA disagrees with the comments,but has amended the definition forclarification. Since the 1978 CGMPregulation was promulgated, FDA hasbeen repeatedly asked whether devicesintended to be sold as sterile areconsidered subject to the CGMPrequirements, even though they havenot yet been sterilized. The agency hadintended the new definition to makeexplicit the application of the regulationto the manufacture of sterile devicesthat have yet to be sterilized. AlthoughFDA believes it should be obvious thatsuch devices are subject to CGMPrequirements, some manufacturers havetaken the position that the regulationdoes not apply because the device is not‘‘finished’’ or ‘‘suitable for use’’ until ithas been sterilized.

To better clarify its intent, FDA hasamended the definition to add that alldevices that are capable of functioning,including those devices that could beused even though they are not yet intheir final form, are ‘‘finished devices.’’For example, devices that have beenmanufactured or assembled, and needonly to be sterilized, polished, inspectedand tested, or packaged or labeled by apurchaser/manufacturer are clearly notcomponents, but are now in a conditionin which they could be used, thereforemeeting the definition of ‘‘finisheddevice.’’

The distinction between‘‘components’’ and ‘‘finished devices’’was not intended to permitmanufacturers to manufacture deviceswithout complying with CGMPrequirements by claiming that otherfunctions, such as sterilization,incoming inspection (where sold forsubsequent minor polishing,sterilization, or packaging), or insertionof software, will take place. The public

would not be adequately protected insuch cases if a manufacturer couldclaim that a device was not a ‘‘finished’’device subject to the CGMP regulationbecause it was not in its ‘‘final’’ form.

The phrase ‘‘for commercialdistribution’’ was deleted from theproposed definition of ‘‘finisheddevice’’ because it is not necessary fora device to be in commercialdistribution to be considered a finisheddevice. Further, FDA notes that the term‘‘accessory’’ is described in§ 807.20(a)(5) (21 CFR 807.20(a)(5)).

26. Two comments on the definitionof ‘‘lot or batch’’ requested that thedefinition be clarified: One to reflectthat single units may be produced fordistribution, the other to indicate thatwhat constitutes a lot or a batch mayvary depending on the context.

In response to the comments, FDA hasmodified the definition to make clearthat a lot or batch may, depending oncircumstances, be comprised of onefinished device. Whether for inspectionor for distribution, a lot or batch isdetermined by the factors set forth inthe definition; of course, a manufacturermay determine the size of the lot orbatch, as appropriate.

27. Several comments received on thedefinition of ‘‘executive management’’objected that the definition isinconsistent with ISO 9001. Othersthought that FDA should better definethe level of management the term wasintended to describe.

FDA agrees with both concerns andhas modified the definition by deletingthe second half, which appeared tobring executive authority andresponsibility too far down theorganization chart. The term wasintended to apply only to managementthat has the authority to bring aboutchange in the quality system and themanagement of the quality system.Although such management wouldclearly have authority over, for example,distribution, those who may havedelegated management authority overdistribution would not necessarily haveauthority over the quality system andquality policy. Accordingly, thedefinition has been modified to includeonly those who have the authority andresponsibility to establish and makechanges to the quality policy andquality system. It is the responsibility oftop management to establish andcommunicate the quality policy. Inaddition, the term ‘‘executivemanagement’’ has been changed to‘‘management with executiveresponsibility,’’ to harmonize with ISO9001:1994.

28. Several comments in response tothe proposed definition of


‘‘manufacturer’’ stated that refurbishersand servicers should be added to thedefinition of a ‘‘manufacturer.’’ Othercomments recommended adding theterm ‘‘remanufacturer.’’ Othercomments requested deletion of contractsterilizers, installers, specificationdevelopers, repackagers, relabelers, andinitial distributors from the definition.One comment stated that the phrase‘‘processes a finished device’’ should beexplained in the definition ofmanufacturer.

FDA’s Compliance Policy Guide(CPG) 7124.28 contains the agency’spolicy regarding the provisions of theact and regulations with which personswho recondition or rebuild used devicesare expected to comply. This CPG is inthe process of being revised in light ofFDA’s experience in this area. FDA isnot including the terms ‘‘servicer’’ or‘‘refurbisher,’’ as they relate to entitiesoutside the control of the originalequipment manufacturer, in this finalregulation, even though it believes thatpersons who perform such functionsmeet the definition of manufacturer.Because of a number of competitive andother issues, including sharply dividedviews by members of the GMP AdvisoryCommittee at the September 1995meeting, FDA has elected to addressapplication of the CGMP requirementsto persons who perform servicing andrefurbishing functions outside thecontrol of the original manufacturer ina separate rulemaking later this year,with another opportunity for publiccomment.

FDA agrees that the term‘‘remanufacturing’’ should be added tothe definition of ‘‘manufacturer’’ andhas separately defined the term. Aremanufacturer is defined as ‘‘anyperson who processes, conditions,renovates, repackages, restores, or doesany other act to a finished device thatsignificantly changes the finisheddevice’s performance or safetyspecifications, or intended use.’’

However, FDA disagrees that contractsterilizers, installers, specificationdevelopers, repackagers, relabelers, andinitial distributors should be deletedfrom the definition, primarily becauseall such persons may have a significanteffect on the safety and effectiveness ofa device and on the public health. Allpersons who perform these functionsmeet the definition of manufacturer, andtherefore should be inspected to ensurethat they are complying with theapplicable provisions. For example, aspecification developer initiates thedesign requirements for a device that ismanufactured by a second party forsubsequent commercial distribution.Such a developer is subject to design

controls. Further, those that perform thefunctions of contract sterilization,installation, relabeling,remanufacturing, and repacking haveroutinely been considered to bemanufacturers under the original CGMPdefinition, and the agency has treatedthem as such by inspecting them toensure that they comply with theappropriate portions of the originalCGMP. By explicitly including them inthe definition of ‘‘manufacturer’’ theagency has simply codified itslongstanding policy and interpretationof the original regulation.

The phrase ‘‘processes a finisheddevice’’ applies to a finished deviceafter distribution. Again, this phrase hasbeen part of the CGMP regulationdefinition of ‘‘manufacturer’’ for 18years.

29. A number of comments on thedefinition of ‘‘manufacturing material,’’and on other parts of the proposalcontaining requirements for‘‘manufacturing material,’’ stated thatwhile the control of manufacturingmaterial is important, it need not be asextensive as required throughout theregulation. Other comments stated thatthe meaning of the phrase ‘‘or otherbyproducts of the manufacturingprocess’’ is unclear, and should bedeleted. One comment suggested thatthe definition be modified to separatethe definition from the examples.

FDA agrees that, depending on themanufacturing material and the device,the degree of control that is needed willvary. FDA believes that manufacturingmaterials must be assessed, foundacceptable for use, and controlled.Therefore, the regulation requiresmanufacturers to assess, assureacceptability of, and controlmanufacturing materials to the degreenecessary to meet the specifiedrequirements. The agency notes thatinternational standards such as ISO8402:1994 include manufacturingmaterial in their definition of‘‘product,’’ to which all requirementsapply, and notes that FDA has addedthe same definition in § 820.3(r) in itseffort toward harmonization.

FDA amended the definition ofmanufacturing material to read ‘‘aconcomitant constituent, or a byproductconstituent produced during themanufacturing process’’ to help clarifythis definition. These terms refer tothose materials or substances thatnaturally occur as a part of the materialor during the manufacturing processwhich are intended to be removed orreduced in the finished device. Forexample, some components, such asnatural rubber latex, contain allergenicproteins that must be reduced or

removed from the finished devices. Thedefinition has been modified to include‘‘concomitant constituents’’ to clarifythe meaning.

In addition to clarifying thedefinition, FDA has deleted the specificexamples. Therefore, FDA notes thatcleaning agents, mold release agents,lubricating oils, latex proteins, andsterilant residues are just someexamples of manufacturing materials.

30. The comments received on thedefinition for ‘‘nonconforming’’conveyed a general sense that thedefinition was confusing, with variouscomments suggesting that different partsof the definition should be deleted andone suggesting that the definition bedeleted altogether.

In response to these comments, thedefinition of ‘‘nonconforming’’ has beendeleted. However, the definition fromISO 8402:1994 for ‘‘nonconformity’’ wasadded to ensure that the requirements inthe regulation, especially those in§§ 820.90 Nonconforming product and820.100 Corrective and preventiveaction are understood. FDA emphasizesthat a ‘‘nonconformity’’ may not alwaysrise to the level of a product defect orfailure, but a product defect or failurewill typically constitute anonconformity.

31. Several comments requestedvarious revisions to the definition of‘‘production’’ to make it more clear, andone thought that it was a common termand should be deleted.

In response, FDA has deleted thedefinition for ‘‘production’’ because itshould be commonly understood.

As noted in response to comments onthe definition of manufacturingmaterial, FDA has added a definition of‘‘product’’ to conform to the definitionin ISO 8402:1994 and to avoid thenecessity of repeating the individualterms throughout the regulation.Whenever a requirement is notapplicable to all types of product, theregulation specifically states theproduct(s) to which the requirement isapplicable.

It should be noted that the regulationhas acceptance requirements forincoming ‘‘product’’ and otherrequirements for ‘‘product,’’ which bydefinition includes manufacturingmaterials. Manufacturing materialsshould be controlled in a manner that iscommensurate with their risk asdiscussed above. However, formanufacturing materials that are‘‘concomitant constituents,’’ FDArealizes that incoming acceptance,identification, etc., may not be feasible.The important control measure for‘‘concomitant constituents’’ is the


reduction or removal requirement foundin § 820.70(h).

32. A few comments stated that thedefinition of ‘‘quality’’ should bechanged to be identical to ISO 8402.Others stated that the terminologyadopted from ISO 8402, ‘‘that bear on,’’is too broad and could cover everypotential and imaginable factor. Stillothers wanted to add the phrase, ‘‘asdefined by the manufacturer’’ to the endof the sentence.

FDA disagrees with the commentsand believes that the definition isclosely harmonized to that in ISO8402:1994. FDA believes that thedefinition appropriately defines qualityin the context of a medical device andbelieves that the phrase from ISO8402:1994, ‘‘stated and implied needs,’’has the same meaning as the phrase‘‘fitness-for-use, including safety andperformance’’ in the context of theQuality System regulation. Further,‘‘quality’’ is not just ‘‘defined by themanufacturer’’ but is also defined bycustomer need and expectation.

33. Many comments received on the‘‘quality audit’’ definition suggested thatthe definition should not state that it isan examination of the ‘‘entire’’ qualitysystem because that would require thatevery audit include the ‘‘entire’’ qualitysystem. Other comments on ‘‘qualityaudit’’ stated that it is unclear what ismeant by the last sentence of theproposed definition, namely, that‘‘ ‘[q]uality audit’ is different from * * *other quality system activities requiredby or under this part.’’

FDA agrees that while the qualityaudit is an audit of the ‘‘entire’’ qualitysystem, audits may be conducted inphases, with some areas requiring morefrequent audits than other areas, andthat each audit need not review thewhole system. The frequency of internalquality audits should be commensuratewith, among other things, theimportance of the activity, the difficultyof the activity to perform, and theproblems found. To avoid anymisunderstanding, the word ‘‘entire’’before quality system has been deleted.

FDA emphasizes that if conductedproperly, internal quality audits canprevent major problems fromdeveloping and provide a foundation forthe management review required by§ 820.20(c), ‘‘Management review.’’

In response to the confusion about thelast sentence of the proposed definition,FDA has deleted the last sentence. Thepurpose of the sentence was to clarifythat the internal audit requirement isdifferent from, and in addition to, therequirements for establishing qualityassurance procedures and recordingresults. On occasion, manufacturers

have attempted to prevent FDAinvestigators from reviewing suchquality assurance procedures andresults (for example, trend analysisresults) by stating that they are part ofthe internal quality audit report and notsubject to review during a CGMPinspection. FDA disagrees with thisposition. To clarify which records areexempt from routine FDA inspection,FDA has added § 820.180(c).

34. One comment said that the word‘‘executive’’ should be deleted from thedefinition of ‘‘quality policy’’ becausequality policy should be supported byall personnel, not just those in executivemanagement. A few comments statedthat ‘‘formally expressed’’ should bedeleted because it is incompatible withthe requirements in § 820.20(a) and (c)which require that the quality policy be‘‘established.’’ Other comments statedthat the ‘‘quality’’ before ‘‘intentions’’was tautological.

FDA agrees that all companypersonnel must follow the qualitypolicy. However, the definition isintended to make clear that the qualitypolicy must be established by topmanagement. Therefore it has beenretained. The term ‘‘executivemanagement’’ has been modified to‘‘management with executiveresponsibility’’ to be consistent with therevised ISO 9001:1994. FDA agrees withthe remaining comments and haschanged ‘‘formally expressed’’ to‘‘established’’ for consistency and hasdeleted the ‘‘quality’’ before‘‘intentions.’’

35. A few comments suggested usingthe definition of ‘‘quality systems’’ fromISO 8402 and 9001. Other comments onthe definition of ‘‘quality system’’ saidthat the term ‘‘quality management’’should be defined.

FDA agrees in part with thecomments. The term ‘‘specifications’’has been deleted to harmonize thedefinition with ISO 8402:1994. FDAdoes not agree that the term ‘‘qualitymanagement’’ must be defined. Adefinition can be found in ISO8402:1994 that is consistent with FDA’suse of the term.

36. Many comments on the definitionof ‘‘record’’ were received. Somethought the term was too broad, givingFDA access to all documents andexceeding FDA’s inspection authority.Others thought that the definition of‘‘record’’ would tremendously increasethe recordkeeping burden. Severalcomments recommended that FDAadopt the ISO definition.

The definition of ‘‘record’’ wasdeleted because it seemed to add moreconfusion than clarity. The definitionwas intended to clarify that ‘‘records’’

may include more than the traditionalhardcopy procedures and SOP’s, forexample, plans, notes, forms, data, etc.FDA was trying to clarify that ‘‘records’’could be written, electronic, optical,etc., as long as they could be stored andcontrolled. FDA could not adopt the ISO8402:1994 definition because of how theterm ‘‘record’’ is used in the act, whichis broader than the ISO definition.Therefore, FDA will allow the act andcase law to continue to define the term.

37. The definition in the WorkingDraft of ‘‘refurbisher’’ was deleted andwill be addressed in the separaterulemaking described above.

38. FDA added the definition of‘‘remanufacturer’’ to codify FDA’slongstanding policy and interpretationof the original CGMP. The language isconsistent with the 510(k) provisionsand the premarket approvalamendment/supplement requirements,because FDA has always consideredremanufacturers in fact to bemanufacturers of a new device.

39. Several comments on thedefinition of ‘‘reprocessing’’ requestedclarification of the difference betweenthat term and ‘‘refurbishing.’’ Severalother comments on the definition of‘‘reprocessing’’ stated that FDA shouldclarify that ‘‘reprocessing’’ is an activityperformed before a device is distributed.Others commented that the term‘‘rework’’ should be used instead of theterm ‘‘reprocessing,’’ to be consistentwith ISO terminology.

FDA agrees with the comments andhas changed the term to ‘‘rework,’’adopted the ISO 8402:1994 definition,and added that ‘‘rework’’ is performedaccording to specified DMRrequirements before the device isreleased for distribution.

40. A few comments stated thatincluding the term ‘‘maintenance’’ inthe proposed definition of ‘‘servicing’’implies that preventative maintenancewould be subject to the regulation.Other comments said that it may not bedesirable to return old devices ordevices that have received fieldmodifications to the originalspecifications. Therefore, the commentssuggested deleting the last part of thedefinition that states that ‘‘servicing’’ isreturning a device to its specifications.

FDA has deleted the definition of‘‘servicing’’ and has not added adefinition of ‘‘servicer’’ because thiswill be covered in the separaterulemaking discussed above. FDA notes,however, that servicing performed bymanufacturers and remanufacturers issubject to the requirements in § 820.200Servicing. These requirements are acodification of longstandinginterpretations of the original CGMP,


§ 820.20(a)(3), and current agencypolicy.

41. Several comments were receivedon the proposed definition of ‘‘specialprocess.’’ Many asked for clarification oradoption of the ISO definition. Somestated that it is impossible to completelyverify processes in every instance.

FDA has deleted the definitionbecause the term ‘‘special process’’ is nolonger used in ISO 9001:1994, except ina note. FDA has, however, modified therequirements of the regulation to reflectthat, in many cases, testing andinspecting alone may be insufficient toprove the adequacy of a process. One ofthe principles on which the qualitysystems regulation is based is that allprocesses require some degree ofqualification, verification, or validation,and manufacturers should not relysolely on inspection and testing toensure processes are adequate for theirintended uses.

42. Several comments on thedefinition of ‘‘specification’’ suggestedthat the term should not apply to qualitysystem requirements. One commentsuggested that the phrase ‘‘otheractivity’’ be deleted because it is toobroad. Another comment noted that thedefinition in ISO 9001 pertains torequirements, not only documents.

In response, FDA has amended thedefinition to make clear that it appliesto the requirements for a product,process, service, or other activity. Thereference to the quality system has beendeleted. FDA disagrees that thedefinition is too broad and has notdeleted the term ‘‘other activity’’because a specification can bedeveloped for anything themanufacturer chooses. FDA notes,however, that ISO 9001:1994 does notcontain a definition for ‘‘specification’’but uses the definition found in ISO8402:1994.

43. Numerous comments werereceived on the definitions of‘‘validation’’ and ‘‘verification.’’ Almostall stated that the two definitionsoverlapped and that there was a need torewrite the definitions to preventconfusion. Many suggested that the ISOdefinitions be adopted. Others statedthat there was a need to distinguishbetween design validation and processvalidation.

FDA agrees with the comments andhas rewritten the two definitions tobetter reflect the agency’s intent. FDAhas adopted the ISO 8402:1994definition of validation. ‘‘Validation’’ isa step beyond verification to ensure theuser needs and intended uses can befulfilled on a consistent basis. FDA hasfurther distinguished ‘‘processvalidation’’ from ‘‘design validation’’ to

help clarify these two types of‘‘validation.’’ The ‘‘process validation’’definition follows from FDA’s‘‘Guidelines on General Principles ofProcess Validation’’ (Ref. 10). Thedefinition for ‘‘design validation’’ isconsistent with the requirementscontained in § 820.30 Design controls.

The ISO 8402:1994 definition of‘‘verification’’ has been adopted.‘‘Verification’’ is confirmation byexamination and provision of objectiveevidence that specified requirements fora particular device or activity at handhave been met.

iii. Quality System (§ 820.5)

44. Several comments suggested thatthe requirement should be more general,in that the requirement that devices besafe and effective is covered elsewherein the regulation. The commentsrecommended that the quality systemrequirements be harmonized withinternational standards and focus onrequiring that a system be establishedthat is appropriate to the specific deviceand that meets the requirements of theregulation.

FDA agrees in part with the commentsand has modified the language asgenerally suggested by severalcomments to require that the qualitysystem be ‘‘appropriate for the specificmedical device(s) designed ormanufactured, and [] meet[] therequirements of this part.’’ This isessentially the requirement of theoriginal CGMP regulation with theadded reference to design control.

The requirements that effectivequality system instructions andprocedures be established andeffectively maintained are retained;however, they were moved to§ 820.20(b)(3)(i). As previously noted,the quality system regulation ispremised on the theory that thedevelopment, implementation, andmaintenance of procedures designed tocarry out the requirements will assurethe safety and effectiveness of devices.Thus, the broad requirements in § 820.5are in a sense the foundation on whichthe remaining quality systemrequirements are built.

B. Quality System Requirements(Subpart B)

i. Management Responsibility (§ 820.20)

45. Several comments on § 820.20(a),‘‘Quality policy,’’ related to the use ofthe term ‘‘executive management.’’ Afew comments stated that quality systemdevelopment and implementation arethe responsibility of the chief executiveofficer, but how he or she chooses todischarge the responsibility should be

left to the discretion of themanufacturer. Other comments statedthat the requirement that executivemanagement ensure that the qualitypolicy is understood is impossible andshould be deleted or rewritten.

FDA agrees in part with thecomments. In response to thecomments, FDA has deleted the term‘‘executive management’’ and replacedit with ‘‘management with executiveresponsibility,’’ which is consistentwith ISO 9001:1994. Management withexecutive responsibility is that level ofmanagement that has the authority toestablish and make changes to thecompany quality policy. Theestablishment of quality objectives, thetranslation of such objectives into actualmethods and procedures, and theimplementation of the quality systemmay be delegated. The regulation doesnot prohibit the delegation. However, itis the responsibility of the highest levelof management to establish the qualitypolicy and to ensure that it is followed.(See United States v. Dotterweich, 320U.S. 277 (1943), and United States v.Park, 421 U.S. 658 (1975).)

For this reason, FDA disagrees thatthe requirement that managementensure that the quality policy isunderstood should be deleted. It iswithout question management’sresponsibility to undertake appropriateactions to ensure that employeesunderstand management’s policies andobjectives. Understanding is a learningprocess achieved through training andreinforcement. Management reinforcesunderstanding of policies and objectivesby demonstrating a commitment to thequality system visibly and actively on acontinuous basis. Such commitment canbe demonstrated by providing adequateresources and training to supportquality system development andimplementation. In the interest ofharmonization, the regulation has beenamended to be very similar to ISO9001:1994.

46. A few comments stated that thewords ‘‘adequate’’ and ‘‘sufficient’’should be deleted from § 820.20(b)‘‘Organization,’’ as they are subjectiveand too difficult to define. Onecomment thought that the generalrequirements in the paragraphs areaddressed by § 820.25 Personnel.Another comment stated that‘‘designed’’ should be added prior to‘‘produced’’ for consistency with thescope.

FDA agrees that the requirement for‘‘sufficient personnel’’ is covered in§§ 820.20(b)(2), ‘‘Resources,’’ and 820.25Personnel, both of which requiremanufacturers to employ sufficientpersonnel with the training and


experience necessary to carry out theirassigned activities properly. The phraseis, therefore, deleted. However, FDA hasretained the requirement forestablishing an ‘‘adequate organizationalstructure’’ to ensure compliance withthe regulation, because such anorganizational structure is fundamentalto a manufacturer’s ability to producesafe and effective devices. Theorganizational structure should ensurethat the technical, administrative, andhuman factors functions affecting thequality of the device will be controlled,whether these functions involvehardware, software, processed materials,or services. All such control should beoriented towards the reduction,elimination, or ideally, prevention ofquality nonconformities. Further, theagency does not believe that the term isambiguous. The organizational structureestablished will be determined in partby the type of device produced, themanufacturer’s organizational goals, andthe expectations and needs ofcustomers. What may be an ‘‘adequate’’organizational structure formanufacturing a relatively simpledevice may not be ‘‘adequate’’ for theproduction of a more complex device,such as a defibrillator. FDA has alsoadded ‘‘designed’’ prior to ‘‘produced’’to be consistent with the scope of theregulation.

47. A number of comments onproposed § 820.20 (b)(1)(i) through(b)(1)(v), ‘‘Responsibility andauthority,’’ objected to the section,stating that it was too detailed andconfusing and that the wording wasredundant with other sections of theproposal.

FDA agrees generally with thecomments in that the proposedparagraphs set forth examples ofsituations in which independence andauthority are important. Therefore, theexamples provided in § 820.20 (b)(1)(i)through (b)(1)(v) are deleted. However,FDA has retained the broad requirementthat the necessary independence andauthority be provided as appropriate toevery function affecting quality. FDAemphasizes that it is crucial to thesuccess of the quality system for themanufacturer to ensure thatresponsibility, authority, andorganizational freedom (orindependence) is provided to those whoinitiate action to preventnonconformities, identify and documentquality problems, initiate, recommend,provide, and verify solutions to qualityproblems, and direct or control furtherprocessing, delivery, or installation ofnonconforming product. Organizationalfreedom or independence does notnecessarily require a stand-alone group,

but responsibility, authority, andindependence should be sufficient toattain the assigned quality objectiveswith the desired efficiency.

48. Several comments on proposed§ 820.20(b)(2), ‘‘Verification resourcesand personnel,’’ stated that requiring‘‘adequately’’ trained personnel wassubjective and that the section was notconsistent with ISO 9001.

FDA agrees that the section is notconsistent with ISO 9001, and hasadopted the language used in ISO9001:1994, section 4.1.2.2, ‘‘Resources,’’and has renamed the section‘‘Resources.’’ The provision is now abroad requirement that themanufacturer provide adequateresources for the quality system and isnot restricted to the verificationfunction. FDA acknowledges that§ 820.25(a), ‘‘General,’’ requires thatsufficiently trained personnel beemployed. However, § 820.20(b)(2),‘‘Resources,’’ emphasizes that allresource needs must be provided for,including monetary, supplies, etc., aswell as personnel resources. In contrast,§ 820.25(a) specifically addresseseducation, background, training, andexperience requirements for personnel.

49. Comments on § 820.20(b)(3),‘‘Management representative,’’ statedthat the management representativeshould not be limited to ‘‘executive’’management. A few comments statedthat the appointment should bedocumented. In addition, a fewcomments from proposed § 820.5 statedthat the terms ‘‘effective’’ and‘‘effectively’’ should be defined.

The agency agrees that theresponsibility need not be assigned to‘‘executive’’ management and hasmodified the requirement to allowmanagement with executiveresponsibility to appoint a member ofmanagement. When a member ofmanagement is appointed to thisfunction, potential conflicts of interestshould be examined to ensure that theeffectiveness of the quality system is notcompromised. In addition, in responseto many comments, the requirement wasamended to make clear that theappointment of this person must bedocumented, moving the requirementup from § 820.20(b)(3)(ii). The amendedlanguage is consistent with ISO9001:1994. Further, FDA has amendedthis section to change ‘‘executivemanagement’’ to ‘‘management withexecutive responsibility’’ forconsistency with the definition.

The terms ‘‘effective’’ and‘‘effectively’’ are no longer used in§ 820.5 but ‘‘effectively’’ is found in§ 820.20(b)(3)(i). FDA does not believethat these terms require a definition.

Instructions and procedures must bedefined, documented, implemented,and maintained in such a way that therequirements of this part are met. If theyare, they will be ‘‘effective.’’

50. A few comments stated that theimprovement of the quality system isnot a requirement under the act and thereference to such improvement in§ 820.20(b)(3)(ii) should, therefore, bedeleted.

FDA agrees in part with the commentsand has deleted the requirement that theperson appointed under this sectionprovide information for improving thequality system. The provision impliedthat the manufacturer must go beyondthe requirements of the regulation. FDAnotes, however, that informationcollected in complying with§§ 820.20(b)(3)(ii) and 820.100Corrective and preventive action, shouldbe used not only for detectingdeficiencies and for subsequentcorrection of the deficiencies but also toimprove the device and quality system.

51. Many comments stated that thereport required by § 820.20(c),‘‘Management review,’’ should not besubject to FDA review, due to the sameliability and self-incrimination concernsrelated to the internal audit.

FDA agrees in part with thecomments. The proposed regulation didnot state FDA’s intentions with respectto inspectional review of the results ofthe required management review. Aftercareful consideration of the comments,FDA agrees that it will not request toinspect and copy the reports of reviewsrequired by § 820.20(c) whenconducting routine inspections todetermine compliance with this part.FDA believes that refraining fromroutinely reviewing these reports mayhelp ensure that the audits are completeand candid and of maximum use to themanufacturer. However, FDA believesthat it is important that the dates andresults of quality system reviews bedocumented, and FDA may require thatmanagement with executiveresponsibility certify in writing that themanufacturer has complied with therequirements of § 820.20(c). FDA willalso review the written proceduresrequired by § 820.20(c), as well as allother records required under § 820.20.

52. A few comments stated that themanagement review should not bedictated by established reviewprocedures because management levelemployees should be fully capable ofreviewing documents without a writtenprocedure.

As noted above, FDA has retained therequirement for establishing proceduresto conduct the required managementreview in § 820.20(c). FDA believes that


a manufacturer can establish proceduresflexible enough for management to varythe way in which a review is conducted,as appropriate. Procedures shouldrequire that the review be conducted atappropriate intervals and should bedesigned to ensure that all parts of thequality system are adequately reviewed.A manufacturer may, of course, developprocedures that permit review ofdifferent areas at different times, so longas such reviews are sufficient to carryout the objectives of this section. If thereare known problems, for example, a‘‘sufficient frequency’’ may be fairlyfrequent. Further, because FDA will notbe reviewing the results of such reviews,FDA must be assured that this functionwill occur in a consistent manner.

53. A few comments stated that§ 820.20(c) should be deleted because itduplicates the quality audit required by§ 820.22.

FDA disagrees that § 820.20(c)duplicates the requirements in § 820.22.The purpose of the management reviewsrequired by § 820.20(c) is to determineif the manufacturer’s quality policy andquality objectives are being met, and toensure the continued suitability andeffectiveness of the quality system. Anevaluation of the findings of internaland supplier audits should be includedin the § 820.20(c) evaluation. Themanagement review may include areview of the following: (1) Theorganizational structure, including theadequacy of staffing and resources; (2)the quality of the finished device inrelation to the quality objectives; (3)combined information based onpurchaser feedback, internal feedback(such as results of internal audits),process performance, product(including servicing) performance,among other things; and (4) internalaudit results and corrective andpreventive actions taken. Managementreviews should include considerationsfor updating the quality system inrelation to changes brought about bynew technologies, quality concepts,market strategies, and other social orenvironmental conditions. Managementshould also review periodically theappropriateness of the reviewfrequency, based on the findings ofprevious reviews. The quality systemreview process in § 820.20(c), and thereasons for the review, should beunderstood by the organization.

The requirements under § 820.22Quality audit are for an internal auditand review of the quality system toverify compliance with the qualitysystem regulation. The review andevaluations under § 820.22 are veryfocused. During the internal qualityaudit, the manufacturer should review

all procedures to ensure adequacy andcompliance with the regulation, anddetermine whether the procedures arebeing effectively implemented at alltimes. In contrast, as noted above, themanagement review under § 820.20(c) isa broader review of the organization asa whole to ensure that the quality policyis implemented and the qualityobjectives are met. The reviews of thequality policy and objectives(§ 820.20(c)) should be carried out bytop management, and the review ofsupporting activities (§ 820.22) shouldbe carried out by management withexecutive responsibility for quality andother appropriate members ofmanagement, utilizing competentpersonnel as decided on by themanagement.

54. Some comments suggested thatthe requirements in § 820.186(a) and (d)be moved to § 820.20 for clarity and tobetter align with the structure of ISO9001:1994 and ISO/CD 13485.

FDA agrees and has moved thespecific requirements from § 820.186and rewritten them into new § 820.20(d) and (e) for clarity, betterorganization, and closer harmonization.Therefore, § 820.20(d) is consistent withISO 9001:1994, section 4.2.3, ‘‘Qualityplanning,’’ and § 820.20(e) is consistentwith ISO 9001:1994, sections 4.2.1,‘‘General,’’ and 4.2.2, ‘‘Quality-systemprocedures.’’ Section 820.20(e)discusses ‘‘[a]n outline of the structureof the documentation used in thequality system.’’ FDA believes thatoutlining the structure of thedocumentation is beneficial and, attimes, may be critical to the effectiveoperation of the quality system. FDArecognizes, however, that it may not benecessary to create an outline in allcases. For example, it may not benecessary for smaller manufacturers andmanufacturers of less complicateddevices. Thus, the outline is onlyrequired where appropriate.

ii. Quality Audit (§ 820.22)55. A few comments suggested that

FDA delete the requirement that personsconducting the audit be ‘‘appropriatelytrained’’ from the second sentence ofproposed § 820.22(a), because it issubjective and not consistent with ISO9001.

FDA has deleted the requirement from§ 820.22(a) because § 820.25 Personnelrequires that such individuals beappropriately trained. Further, FDA hasattempted to better harmonize with ISO9001:1994, which does not explicitlystate personnel qualifications in eachprovision. Similarly, in response togeneral comments suggesting betterharmonization, FDA has added the

requirement that the audit ‘‘determinethe effectiveness of the quality system’’as required by ISO 9001:1994. Thisrequirement underscores that thequality audit must not only determinewhether the manufacturer’srequirements are being carried out, butwhether the requirements themselvesare adequate.

56. Some comments stated thatrequiring ‘‘individuals who do not havedirect responsibility for the mattersbeing audited’’ to conduct the audits isimpractical and burdensome,particularly for small manufacturers.

FDA disagrees with the comments.Both small and large manufacturershave been subject to the identicalrequirement since 1978 and FDA knowsof no hardship, on small or largemanufacturers, as a result. Smallmanufacturers must generally establishindependence, even if it means hiringoutside auditors, because the failure tohave an independent auditor couldresult in an ineffective audit.

Manufacturers must realize thatconducting effective quality audits iscrucial. Without the feedback providedby the quality audit and otherinformation sources, such as complaintsand service records, manufacturersoperate in an open loop system with noassurance that the process used todesign and produce devices is operatingin a state of control. ISO 9001:1994 hasthe same requirement for independencefrom the activity being audited.

57. Several comments claimed thatthe last sentence in proposed§ 820.22(a), which required thatfollowup corrective action bedocumented in the audit report, madeno sense. The comments said thatcorrective action would be the subject ofa followup report.

It was the agency’s intent that theprovision require that where correctiveaction was necessary, it would be takenand documented in a reaudit report. Theprovision has been rewritten to makethat clear. New § 824.22 also clarifiesthat a reaudit is not always required, butwhere it is indicated, it must beconducted. The report should verify thatcorrective action was implemented andeffective. Because FDA does not reviewthese reports, the date on which theaudit and reaudit were performed mustbe documented and will be subject toFDA review. The revised reauditprovision is consistent with ISO9001:1994.

58. Many comments were received onproposed § 820.22(b) regarding thereports exempt from FDA review. Mostof the comments objected to FDAreviewing evaluations of suppliers. FDAhas decided not to review such


evaluations at this time and will revisitthis decision after the agency gainssufficient experience with the newrequirement to determine itseffectiveness. A thorough response tothe comments is found with theagency’s response to other commentsreceived on § 820.50 Purchasingcontrols. FDA has moved the sectionregarding which reports the agency willrefrain from reviewing from § 820.22(b)to new § 820.180(c), ‘‘Exemptions,’’under the related records requirements.FDA believes this organization is easierto follow.

iii. Personnel (§ 820.25)59. A few comments stated that the

requirement in § 820.25 Personnel forthe manufacturer to employ ‘‘sufficient’’personnel should be deleted, becausewhether there are ‘‘sufficient’’ personnelis a subjective determination, and it isunnecessary to require it since themanufacturer will know how best tostaff the organization. A few othercomments stated that the provisionshould not base the personnelrequirements on ensuring that therequirements of the regulation are‘‘correctly’’ performed, because nomanufacturer can ensure that allactivities are performed correctly.Another comment stated that the term‘‘employ’’ should be changed becausepersonnel may include qualifiedtemporaries, contractors, and otherswho may not typically be considered‘‘employees.’’

FDA disagrees with the suggestionsthat the terms ‘‘sufficient’’ and‘‘correctly’’ be deleted. Whether‘‘sufficient’’ personnel are employedwill be determined by the requirementsof the quality system, which must bedesigned to ensure that therequirements of the regulation areproperly implemented. In makingstaffing decisions, a manufacturer mustensure that persons assigned toparticular functions are properlyequipped and possess the necessaryeducation, background, training, andexperience to perform their functionscorrectly. However, FDA changed‘‘ensure’’ to ‘‘assure’’ to address theconcerns that people do make mistakesand management cannot guarantee thatwork is correctly performed all of thetime. Further, FDA agrees that themanufacturer must determine for itselfwhat constitutes ‘‘sufficient’’ personnelwith proper qualification in the firstinstance. However, if the manufacturerdoes not employ sufficient personnel, orpersonnel with the necessaryqualifications to carry out theirfunctions, the manufacturer will be inviolation of the regulation. FDA has

often found that the failure to complywith this requirement leads to othersignificant regulatory violations. FDAagrees with the comment that the term‘‘employ’’ should be deleted so that therequirement covers all personnel whowork at a firm.

60. In § 820.25(b), ‘‘Training,’’ FDAdeleted the requirement that employeesbe trained ‘‘by qualified individuals,’’because § 820.25(a) requires this.Several comments stated that FDAshould add the requirement that thetraining procedure include theidentification of training needs, to beconsistent with the requirements in ISO9001:1994 and ISO/CD 13485. Othercomments stated that personnel neednot be trained to the extent that they canquote chapter and verse of theregulation as long as they canadequately perform their assignedresponsibilities. Several commentssuggested deleting the requirements inthe last two sentences in favor of abroad, general requirement thatpersonnel be trained. A few commentsstated that the last two sentences shouldbe retained because they are crucial andsound requirements but that validationactivities should be included withverification activities.

FDA amended the requirement so thatthe training procedure includes theidentification of training needs. FDAdeleted the requirement onunderstanding the CGMP requirementsapplicable to job functions to avoid theperception that personnel would needto know ‘‘chapter and verse of theregulation.’’ FDA notes, however, that atraining program to ensure personneladequately perform their assignedresponsibilities should includeinformation about the CGMPrequirements and how particular jobfunctions relate to the overall qualitysystem. FDA further believes that it isimperative that training cover theconsequences of improper performanceso that personnel will be apprised ofdefects that they should look for, as wellas be aware of the effect their actionscan have on the safety and effectivenessof the device. In addition, FDAdisagrees with comments that suggestedthat only ‘‘personnel affecting quality’’should be required to be adequatelytrained. In order for the full qualitysystem to function as intended, allpersonnel should be properly trained.Each function in the manufacture of amedical device must be viewed asintegral to all other functions. FDA hasreorganized the last two sentences,however, to place the requirementsunder § 820.25(b), ‘‘Training,’’ and hasadded validation activities as suggestedby the comments.

61. Many comments objected to theproposed requirements of § 820.25(c),‘‘Consultants,’’ stating that requiring amanufacturer to chose consultants thathave sufficient qualifications and tokeep records subject to FDA review ofall consultants used, along with copiesof their resumes and lists of previousjobs, would unreasonably interfere withthe manufacturer’s business activitiesand restrict the right of a manufacturerto hire consultants on any basis itchooses. Other comments said that amanufacturer’s employment of aconsultant has the same potentialimpact on the safety and effectiveness ofmedical devices as employment of anyother contractor for services, and thatconsultants should, therefore, becovered by § 820.50 Purchasingcontrols.

FDA agrees in part with thesecomments. Although employing aconsultant is a business decision, whena manufacturer hires consultants whodo not have appropriate credentials, andmanufacturing decisions are made basedon erroneous or ill-conceived advice,the public suffers. Of course, themanufacturer is still ultimatelyresponsible for following the CGMPrequirements and will bear theconsequences of a failure to comply.FDA notes that the use of unqualifiedconsultants has led to regulatory actionfor the failure to comply with the CGMPregulation in the past. Thus, because ofthe significant impact a consultant canhave on the safety and effectiveness ofa device, FDA believes that some degreeof control is required in the regulation.

The requirements are revisedsomewhat in response to comments,however, to reflect that it is not FDA’sgoal to dictate whom a manufacturermay use as a consultant, but instead torequire that a manufacturer determinewhat it needs to adequately carry outthe requirements of the regulation andto assess whether the consultant canadequately meet those needs. Therequirements related to consultants havebeen added in § 820.50 Purchasingcontrols because a consultant is asupplier of a service.

C. Design Controls (Subpart C)Since early 1984, FDA has identified

lack of design controls as one of themajor causes of device recalls. Theintrinsic quality of devices, includingtheir safety and effectiveness, isestablished during the design phase.Thus, FDA believes that unlessappropriate design controls are observedduring preproduction stages ofdevelopment, a finished device may beneither safe nor effective for its intendeduse. The SMDA provided FDA with the


authority to add preproduction designcontrols to the device CGMP regulation.Based on its experience withadministering the original CGMPregulation, which did not includepreproduction design controls, theagency was concerned that the originalregulation provided less than anadequate level of assurance that deviceswould be safe and effective. Therefore,FDA has added general requirements fordesign controls to the device CGMPregulation for all class III and II devicesand certain class I devices. FDA is notsubjecting the majority of class I devicesto design controls because FDA does notbelieve that such controls are necessaryto ensure that such devices are safe andeffective and otherwise in compliancewith the act. However, all devices,including class I devices exempt fromdesign controls, must be properlytransferred to production in order tocomply with § 820.181, as well as otherapplicable requirements. For most classI devices, FDA believes that theproduction and other controls in thenew quality system regulation and othergeneral controls of the act will besufficient, as they have been in the past,to ensure safety and effectiveness.

62. Many comments were submittedin response to the addition of designcontrol requirements in general, manyquestioning how these newrequirements would be implementedand enforced. For instance, severalcomments stated that the design controlrequirements do not reflect how medicaldevices are actually developed, becausethe concept of a design rarely originateswith the manufacturer, who may notbecome involved until relatively late inthe design evolution. Others expressedconcern that FDA investigators willsecond-guess design issues in whichthey are not educated or trained, andstated that investigators should notdebate whether medical device designsare ‘‘safe and effective.’’

FDA agrees in part with thecomments. The design controlrequirements are not intended to applyto the development of concepts andfeasibility studies. However, once it isdecided that a design will be developed,a plan must be established to determinethe adequacy of the design requirementsand to ensure that the design that willeventually be released to productionmeets the approved requirements.

Those who design medical devicesmust be aware of the design controlrequirements in the regulation andcomply with them. Unsafe andineffective devices are often the result ofinformal development that does notensure the proper establishment andassessment of design requirements

which are necessary to develop amedical device that is safe and effectivefor the intended use of the device andthat meets the needs of the user.

However, FDA investigators will notinspect a device under the designcontrol requirements to determinewhether the design is appropriate or‘‘safe and effective.’’ Section 520(f)(1)(a)of the act precludes FDA fromevaluating the ‘‘safety or effectiveness ofa device’’ through preproduction designcontrol procedures. FDA investigatorswill evaluate the process, the methods,and the procedures that a manufacturerhas established to implement therequirements for design controls. If,based on any information gained duringan inspection, an investigator believesthat distributed devices are unsafe orineffective, the investigator has anobligation to report the observations tothe Center for Devices and RadiologicalHealth (CDRH).

63. Several comments expressedconcern that the application of designcontrols would severely restrict thecreativity and innovation of the designprocess and suggested that designcontrols should not apply too early inthe design development process.

FDA disagrees with the comments. Itis not the intent of FDA to interfere withcreativity and innovation, and it is notthe intent of FDA to apply the designcontrol requirements to the researchphase. Instead, the regulation requiresthe establishment of procedures toensure that whatever design isultimately transferred to production is,in fact, a design that will translate intoa device that properly performsaccording to its intended use and userneeds.

To assist FDA in applying theregulation, manufacturers shoulddocument the flow of the design processso that it is clear to the FDA investigatorwhere research is ending anddevelopment of the design is beginning.

64. A few comments stated thatdesign controls should not beretroactive and that ongoing designdevelopment should be exempted.

FDA agrees in part with thecomments. FDA did not intend thedesign requirements to be retroactive,and § 820.30 Design controls will notrequire the manufacturer to apply suchrequirements to already distributeddevices. When the regulation becomeseffective on June 1, 1997, it will applyto designs that are in the design anddevelopment phase, and manufacturerswill be expected to have the design anddevelopment plan established. Themanufacturer should identify what stagea design is in for each device and willbe expected to comply with the

established design and developmentplan and the applicable paragraphs of§ 820.30 from that point forward tocompletion. If a manufacturer had adesign in the development stage beforeJune 1, 1997, and cannot comply withany particular paragraph of § 820.30, themanufacturer must provide a detailedjustification as to why such complianceis not possible. However, designs willnot have to be recycled throughprevious phases that have beencompleted. Manufacturers will beexpected to comply in full by June 1,1998. As stated earlier, FDA wants toemphasize that it expects manufacturersto be in a reasonable state ofcompliance with the design controlrequirements from June 1, 1997, to June1, 1998, because extra time was given tothe industry for implementing designcontrols before the final regulationbecame effective.

When changes are made to new orexisting designs, the design controls of§ 820.30 must be followed to ensure thatthe changes are appropriate and that thedevice will continue to perform asintended. FDA notes that the originalCGMP regulation containedrequirements for specification controlsand controls for specification or designchanges under § 820.100(a).

65. One comment asked how theproposed design controls would applyto investigational device exemption(IDE) devices, since devices underapproved IDE’s have been exempt fromthe CGMP regulation. Some commentssuggested that any changes to the IDEregulation should be done in a separaterulemaking. Other comments stated thatany change to the IDE regulation shouldbe worded so that all of § 820.30 appliessince the IDE process is supplyinginformation in support of the designvalidation requirements but that alldesign requirements need not becompleted prior to the start of the IDEbecause the clinical evaluation processoften brings valuable information to thedesign project which may need to beincorporated into the design beforedesign transfer.

The IDE regulation was published in1976 and last updated in 1978, and hasbeen in effect since that time. Devicesbeing evaluated under IDE’s wereexempted from the original CGMPregulation because it was believed thatit was not reasonable to expect sponsorsof clinical investigations to ensurecompliance with CGMP’s for devicesthat may never be approved forcommercial distribution. However,sponsors of IDE studies were required toensure that investigational devices weremanufactured under a state of control.


With respect to the new regulation,FDA believes that it is reasonable toexpect manufacturers who designmedical devices to develop the designsin conformance with design controlrequirements and that adhering to suchrequirements is necessary to adequatelyprotect the public from potentiallyharmful devices. The design controlrequirements are basic controls neededto ensure that the device being designedwill perform as intended whenproduced for commercial distribution.Clinical evaluation is an importantaspect of the design verification andvalidation process during the designand development of the device. Becausesome of the device design occurs duringthe IDE stage, it is logical thatmanufacturers who intend tocommercially produce the device followdesign control procedures. Were amanufacturer to wait until all the IDEstudies were complete, it would be toolate to take advantage of the designcontrol process, and the manufacturerwould not be able to fulfill therequirements of the quality systemregulation for that device.

Therefore, FDA has concurrentlyamended the IDE regulation,

812.1 Scope to state:

(a) * * * An IDE approved under § 812.30or considered approved under § 812.2(b)exempts a device from the requirements ofthe following sections of the Federal Food,Drug, and Cosmetic Act (the act) andregulations issued thereunder: * * * goodmanufacturing practice requirements undersection 520(f) except for the requirementsfound in § 820.30, if applicable (unless thesponsor states an intention to comply withthese requirements under § 812.20(b)(3) or§ 812.140(b)(4)(v)) and color additiverequirements under section 721. (Emphasisadded.)

FDA does not expect any newinformation in IDE applications as aresult of this amendment, nor will FDAinspect design controls duringbioresearch monitoring inspections.FDA is simply making a conformingamendment to the IDE regulation tomake clear that design controls must befollowed when design functions areundertaken by manufacturers, includingdesign activity which occurs under anapproved IDE. FDA will evaluate theadequacy of manufacturers’ compliancewith design control requirements inroutine CGMP inspections, includingpreapproval inspections for premarketapproval applications (PMA’s).

66. Many written comments and oralcomments at the August and September1995 meetings recommended that,because design controls are a majoraddition to the regulation, the effective

date for design controls should bedelayed until 18 months afterpublication of the final rule.

FDA has addressed these commentsby extending the effective date of theregulation until June 1, 1997, and by theinspectional strategy described earlier.

67. A couple of comments suggestedthat FDA lacked the authority toestablish the design controlrequirements.

FDA disagrees with the comments.The act and its legislative history makeclear that FDA has the authority toimpose those controls necessary toensure that devices are safe andeffective. The SMDA gave FDA explicitauthority to promulgate design controls,including a process to assess theperformance of a device (see section520(f)(1)(A) of the act). The legislativehistory of the SMDA supports a‘‘comprehensive device designvalidation regulation.’’ H. Rept. 808,101st Cong., 2d sess. 23 (emphasisadded). Congress stated that theamendment to the statute was necessarybecause almost half of all device recallsover a 5-year period were ‘‘related to aproblem with product design.’’ Id. Thereis a thorough discussion on theevolution of and need for the designcontrols in the preamble to theNovember 23, 1993 (58 FR 61952),proposal.

68. A few comments objected to FDArequiring design controls for any class Idevices in § 820.30(a).

FDA believes that, for the class Idevices listed, design controls arenecessary and has retained therequirements. Those relatively fewdevices, while class I, require closecontrol of the design process to ensurethat the devices perform as intended,given the serious consequences thatcould occur if their designs were flawedand the devices were to fail to meettheir intended uses. In fact, some of thedevices included on the list haveexperienced failures due to designrelated problems that have resulted inhealth hazards, injuries, or death.Further, verification, or even validation,cannot provide the assurance of properdesign for some devices, especiallythose containing extensive software.Thus, all automated devices must bedeveloped under the design controlrequirements.

69. Several comments stated that FDAhas underestimated the complexity of adesign project in requiring that theplans identify ‘‘persons responsible foreach activity’’ in proposed § 820.30(b).One comment stated that ‘‘defineresponsibility for implementation’’ and‘‘activities shall be assigned’’ werebasically redundant requirements. A

few other comments stated that ISO9001:1994 does not call for the designplans to be ‘‘approved’’ and that thisrequirement should be deleted becauseit would be burdensome.

FDA agrees in part with the commentsand has revised § 820.30(b) to requirethe plan to describe or reference designactivities and define responsibility forimplementing the activities, rather thanrequiring that the plan identify eachperson responsible for carrying out eachactivity. In making this change, FDAnotes that § 820.20(b)(1) requiresmanufacturers to establish theappropriate responsibility for activitiesaffecting quality, and emphasizes thatthe assignment of specific responsibilityis important to the success of the designcontrol program and to achievingcompliance with the regulation. Also,the design and development activitiesshould be assigned to qualifiedpersonnel equipped with adequateresources as required under§ 820.20(b)(2). The requirements under§ 820.30(b) were rewritten to be verysimilar to the requirements in ISO9001:1994, sections 4.4.2 and 4.4.3. FDAdoes not agree that the design planshould not be ‘‘approved.’’ ISO9001:1994, section 4.4.2 requires thatthe plan be ‘‘updated,’’ and section 4.4.3requires that the plan be ‘‘regularlyreviewed.’’ Therefore, the approval isconsistent with ISO 9001:1994 andwould not be unduly burdensome sincethe FDA does not dictate how or bywhom the plan must be approved. Theregulation gives the manufacturer thenecessary flexibility to have the sameperson(s) who is responsible for thereview also be responsible for theapproval of the plan if appropriate.

70. A few comments stated that theproposed requirement to describe ‘‘anyinteraction between or among differentorganizational and technical groups’’ in§ 820.30(b) for the design anddevelopment plan should be deletedbecause it is overly broad, unnecessary,and burdensome. One comment saidthat the communication expectedbetween these groups should beclarified.

In response, FDA has amended therequirement as suggested by onecomment so that the plan shall identifyand describe the interfaces withdifferent groups or activities thatprovide, or result in, input to the designprocess. Many organization functions,both inside and outside the designgroup, may contribute to the designprocess. For example, interfaces withmarketing, purchasing, regulatoryaffairs, manufacturing, service groups,or information systems may benecessary during the design


development phase. To functioneffectively, the design plan mustestablish the roles of these groups in thedesign process and describe theinformation that should be received andtransmitted.

71. One comment stated that therequirement in § 820.30(b) thatmanufacturers establish a design plancompletely ignores the creative anddynamic process of designing byrequiring a plan to have completedesign and testing criteria established,with specifications, before the designprocess is started.

FDA disagrees with the comment.Section 820.30(b) does not requiremanufacturers to complete design andtesting criteria before the design processbegins. This section has been revised tostate that ‘‘plans shall be reviewed,updated, and approved as design anddevelopment evolves,’’ indicating thatchanges to the design plan are expected.A design plan typically includes at leastproposed quality practices, assessmentmethodology, recordkeeping anddocumentation requirements, andresources, as well as a sequence ofevents related to a particular design ordesign category. These may be modifiedand refined as the design evolves.However, the design process canbecome a lengthy and costly process ifthe design activity is not properlydefined and planned. The morespecifically the activities are defined upfront, the less need there will be forchanges as the design evolves.

72. One comment stated that thelanguage contained in proposed§ 820.30(c) should more closely matchthat of ISO 9001. Many other commentsstated that the provision should notrequire the input requirements to‘‘completely’’ address the intended useof the device because inputs couldnever ‘‘completely’’ address theintended use. Several comments statedthat the requirement of ISO 9001 that‘‘incomplete, ambiguous or conflictingrequirements shall be resolved withthose responsible for imposing theserequirements’’ should be added to§ 820.30(c), ‘‘Design input,’’ because it isimportant that the regulation identifythe method of resolving conflictinginformation.

FDA agrees with the harmonizationcomment and has revised the languageto incorporate the requirement ofsection 4.4.4, ‘‘Design input,’’ of ISO9001:1994. FDA does not believe that itis necessary to have identical languageto harmonize quality systemrequirements. ISO 9001:1994, section4.4.1, ‘‘General,’’ requires that themanufacturer ‘‘establish and maintaindocumented procedures to control and

verify the design of the product in orderto ensure that the specifiedrequirements are met.’’ FDA’sregulation, under § 820.30(a), imposesthe same requirements.

Regarding the comments that inputrequirements cannot completely addressthe intended use of the device, FDArecognizes that the provision could beinterpreted to impose a burden that maynot always be possible to meet and hasdeleted the word ‘‘completely.’’ FDAdid not intend the provision to suggestthat a manufacturer must foresee everypossible event.

FDA emphasizes, however, that thesection requires the manufacturer toensure that the design inputrequirements are appropriate so thedevice will perform to meet its intendeduse and the needs of the user. In doingthis, the manufacturer must define theperformance characteristics, safety andreliability requirements, environmentalrequirements and limitations, physicalcharacteristics, applicable standards andregulatory requirements, and labelingand packaging requirements, amongother things, and refine the designrequirements as verification andvalidation results are established. Forexample, when designing a device, themanufacturer should conductappropriate human factors studies,analyses, and tests from the early stagesof the design process until that point indevelopment at which the interfaceswith the medical professional and thepatient are fixed. The human interfaceincludes both the hardware andsoftware characteristics that affectdevice use, and good design is crucialto logical, straightforward, and safedevice operation. The human factorsmethods used (for instance, task/function analyses, user studies,prototype tests, mock-up reviews, etc.)should ensure that the characteristics ofthe user population and operatingenvironment are considered. Inaddition, the compatibility of systemcomponents should be assessed. Finally,labeling (e.g., instructions for use)should be tested for usability.

FDA agrees with the comments, inthat it is important that incomplete,ambiguous, or conflicting requirementsbe resolved with those responsible forimposing these requirements. Therefore,FDA has added the requirement that theprocedures shall include a mechanismfor addressing incomplete, ambiguous,or conflicting requirements. FDA notesthat this must be done to ‘‘ensure thatthe design requirements are appropriateand address the intended use of thedevice,’’ as required under § 820.30(c).

73. A few other comments stated thatISO 9001:1994 does not call for the

design input to be ‘‘approved’’ andtherefore, this requirement should bedeleted because it would beburdensome.

FDA does not agree that the‘‘approval’’ of design inputrequirements should be deleted, nor thatthe requirement is inconsistent withISO. ISO 9001:1994, section 4.4.4,‘‘Design Input,’’ requires that the designinput requirements be ‘‘reviewed by thesupplier for adequacy.’’ Therefore, theapproval would not add any additionalburden because FDA does not dictatehow or by whom the design inputrequirements must be approved, thusgiving the manufacturer the necessaryflexibility to have the same person(s)who is responsible for the ‘‘review foradequacy’’ also be responsible for theapproval, if appropriate. Further, it isimportant that the design input beassessed as early as possible in thedevelopment process, making this anideal time in the device’s designdevelopment to have a design review to‘‘approve’’ the design input.

74. A few comments stated that theproposed requirement under § 820.30(c)that ‘‘design input shall be reviewedand approved by a designated qualifiedindividual’’ should be deleted as itimplies that one person must bedesignated to review and approve adesign, and that there may not be oneperson who is qualified to assess all ofthe design input requirements.Addressing the same point, severalcomments suggested that the provisionbe revised to allow for more than oneperson to review and approve thedesign. One comment said that theFDA’s requirement appears to be at oddswith the team approach.

FDA agrees with the concernexpressed by the comments and hasmodified the requirement to allow morethan one individual to review andapprove the design input. FDA endorsesthe team approach and believes thatdesigns should be reviewed andevaluated by all disciplines necessary toensure the design input requirementsare appropriate.

75. Two comments stated thatproposed § 820.30(c) should bereworded to focus on systems forassuring adequate design input, not onthe input itself. One additionalcomment on this section said that thedesign input requirements shouldinclude not only the device’s intendeduse and needs of the user, but theenvironmental limits of where it will beused.

FDA agrees that procedures forensuring appropriate design controls areof the utmost importance and hasmodified the section to clarify that the


manufacturer must establish andmaintain procedures to ensure that thedesign requirements are properlyaddressed. FDA made this change to theother paragraphs as well, but notes that§ 820.30(a), ‘‘General,’’ requires themanufacturer to establish and maintainprocedures to control the design of thedevice in order to ensure that specifieddesign requirements are met. Thesections that follow set forth some of therequirements for which proceduresmust be established. It should beemphasized that the input itself mustalso be appropriate; the requirement isfor the procedures to be defined,documented, and implemented. Thus, ifthe input requirements related to adevice fail to address the intended useof the device, for example, themanufacturer has failed to comply withthe provision.

FDA also agrees with the additionalcomment but believes that identifyingand establishing the environmentallimits for safe and effective deviceoperation is inherent in therequirements for ensuring that a deviceis appropriate for its intended use. Somefactors that must be considered whenestablishing inputs include, whereapplicable, a determination of energy(e.g., electrical, heat, andelectromagnetic fields), biologicaleffects (e.g., toxicity andbiocompatibility) and environmentaleffects (e.g., electromagneticinterference and electrostatic discharge).

76. Several comments stated thatproposed § 820.30(f), ‘‘Design output,’’should be rewritten or deleted becausemany of the requirements were alreadystated in proposed §§ 820.30(d), ‘‘Designverification,’’ and 820.30(e), ‘‘Designreview,’’ and, if retained, should bereordered similar to ISO 9001.

FDA agrees in part with the commentsand has rewritten the requirements ofdesign output to be consistent with ISO9001:1994, section 4.4.5, ‘‘Designoutput,’’ and reordered the sections tobe consistent with ISO 9001:1994. FDAretained the provision, however,because it does not agree that thesection is redundant with the sectionson design verification, designvalidation, or design review. Designoutput are the design specificationswhich should meet design inputrequirements, as confirmed duringdesign verification and validation andensured during design review. Theoutput includes the device, its labelingand packaging, associated specificationsand drawings, and production andquality assurance specifications andprocedures. These documents are thebasis for the DMR. The total finished

design output consists of the device, itslabeling and packaging, and the DMR.

77. One comment stated that thesentence ‘‘Design output proceduresshall ensure that design output meetsthe design input requirements’’ isredundant with the requirement underdesign verification. Another commentasked what is meant by ‘‘release.’’

FDA agrees with the first commentand has deleted that sentence in§ 820.30(d) but notes that the designoutput must be documented andexpressed in terms that can be verifiedagainst the design input requirements.

Design output can be ‘‘released’’ ortransferred to the next design phase atvarious stages in the design process, asdefined in the design and developmentplan. The design output is reviewed andapproved before release or transfer tothe next design phase or production.The design output requirements areintended to apply to all such stages ofthe design process.

78. One small manufacturercommented that the problems that§ 820.30(e), ‘‘Design review,’’ is meantto reveal involve coordination,cooperation, or communicationdifficulties among the members of anorganization and that these difficultiesdo not exist in a small company.Therefore, the comment stated that thedesign review requirements should notapply to small manufacturers.

The purpose of conducting designreviews during the design phase is toensure that the design satisfies thedesign input requirements for theintended use of the device and theneeds of the user. Design reviewincludes the review of designverification data to determine whetherthe design outputs meet functional andoperational requirements, the design iscompatible with components and otheraccessories, the safety requirements areachieved, the reliability andmaintenance requirements are met, thelabeling and other regulatoryrequirements are met, and themanufacturing, installation, andservicing requirements are compatiblewith the design specifications. Designreviews should be conducted at majordecision points during the design phase.

For a large manufacturer, designreview provides an opportunity for allthose who may have an impact on thequality of the device to provide input,including manufacturing, qualityassurance, purchasing, sales, andservicing divisions. While smallmanufacturers may not have the broadrange of disciplines found in a largecompany, and the need to coordinateand control technical interfaces may belessened, the principles of design

review still apply. The requirementsunder § 820.30(e) allow smallmanufacturers to tailor a design reviewthat is appropriate to their individualneeds.

79. One comment stated that thewording of proposed § 820.30(e) impliesthat only one design review is expected,and that design review should beconducted at several stages of productdevelopment. Several comments statedthat to demand that every design reviewbe conducted by individuals who do nothave direct responsibility for designdevelopment is impractical, especiallyfor small companies.

FDA agrees with the first commentand has rewritten the requirement tomake clear that design reviews must beconducted at appropriate stages ofdesign development, which must bedefined in the established design anddevelopment plan. The number ofdesign reviews will depend on the planand the complexity of the device. FDAalso amended the requirements so thatthe results of a design review includeidentification of the design, the date,and the individual(s) performing thereview. Thus, multiple reviews canoccur and the manufacturer mustdocument what is being reviewed,when, and by whom.

FDA never intended to mandate thatan individual without designresponsibility conduct the designreviews and, to clarify its position, hasrewritten the requirement. Therequirement now states that theprocedures shall ensure that each designreview includes an individual(s) whodoes not have direct responsibility forthe design stage being reviewed. Thisrequirement will provide an ‘‘objectiveview’’ from someone not workingdirectly on that particular part of thedesign project, to ensure that therequirements are met. In making thischange, FDA also notes that it was notFDA’s intention to prohibit thosedirectly responsible for the design fromparticipating in the design review.

80. One comment stated that as partof the systematic review of the adequacyof the device design, it is occasionallynecessary to produce a prototype deviceand have it evaluated by a physicianwho is an expert in the area of thedevice’s intended use. Thus, thecomment stated that the regulationshould be revised to allow a means fora manufacturer to ship a prototypedevice to a physician for evaluation.One comment questioned whetherdesign verification and validation canbe conducted using prototypes ormachine shop models.

FDA regulations do not prohibit theshipment of prototypes for clinical or


other studies. Prototypes used inclinical studies involving humans maybe shipped in accordance with the IDEprovisions in part 812 (21 CFR part812).

FDA understands that it is not alwayspractical to conduct clinical studies onfinished production units and,therefore, the use of prototypes inclinical studies is acceptable. Whenprototype devices are used on humansthey must be verified as safe to themaximum extent feasible. Final designvalidation, however, cannot be done onprototypes because the actual devicesproduced and distributed are seldomthe same as the research anddevelopment prototypes. The finalverification and validation, therefore,must include the testing of actualproduction devices under actual orsimulated use conditions.

81. A few comments stated that§ 820.30(d), ‘‘Design verification,’’should be rewritten and reorderedsimilar to ISO 9001.

FDA agrees with the comments andhas rewritten and reordered this sectionto be consistent with ISO 9001:1994.The language in revised § 820.30(f) and(g) incorporates the requirement of ISO9001:1994, sections 4.4.7, ‘‘Designverification,’’ and 4.4.8, ‘‘Designvalidation,’’ respectively.

Under the revised provisions, thedesign must be verified and validated. Itis important to note that designvalidation follows successful designverification. Certain aspects of designvalidation can be accomplished duringthe design verification, but designverification is not a substitute for designvalidation. Design validation should beperformed under defined operatingconditions and on the initial productionunits, lots, or batches, or theirequivalents to ensure proper overalldesign control and proper designtransfer. When equivalent devices areused in the final design validation, themanufacturer must document in detailhow the device was manufactured andhow the manufacturing is similar to andpossibly different from initialproduction. Where there are differences,the manufacturer must justify whydesign validation results are valid forthe production units, lots, or batches.Manufacturers should not useprototypes developed in the laboratoryor machine shop as test units to meetthese requirements. Prototypes maydiffer from the finished productiondevices. During research anddevelopment, conditions for buildingprototypes are typically bettercontrolled and personnel moreknowledgeable about what needs to bedone and how to do it than are regular

production personnel. When going fromlaboratory to scale-up production,standards, methods, and proceduresmay not be properly transferred, oradditional manufacturing processes maybe added. Often, changes not reflectedin the prototype are made in the deviceto facilitate the manufacturing process,and these may adversely affect devicefunctioning and user interfacecharacteristics. Proper testing of devicesthat are produced using the samemethods and procedures as those to beused in routine production will preventthe distribution and subsequent recall ofmany unacceptable medical devices.

In addition, finished devices must betested for performance under actualconditions of use or simulated useconditions in the actual or simulatedenvironment in which the device isexpected to be used. The simulated usetesting provision no longer requires thatthe testing be performed on the firstthree production runs. However,samples must be taken from units, lots,or batches that were produced using thesame specifications, production andquality system methods, procedures,and equipment that will be used forroutine production. FDA considers thisa critical element of the designvalidation. The requirement to conductsimulated use testing of finished devicesis found in the original CGMP in§ 820.160, as part of finished deviceinspection. This requirement has beenmoved to § 820.30(g) because FDAbelieves that simulated use testing atthis point is more effective in ensuringthat only safe and effective devices areproduced. Manufacturers must alsoconduct such tests when they makechanges in the device design or themanufacturing process that could affectsafety or effectiveness as required in theoriginal CGMP in § 820.100(a)(2). Theextent of testing conducted should begoverned by the risk(s) the device willpresent if it fails. FDA considers theseactivities essential for ensuring that themanufacturing process does notadversely affect the device.

Design validation may also benecessary in earlier stages, prior toproduct completion, and multiplevalidations may need to be performed ifthere are different intended uses. Properdesign validation cannot occur withoutfollowing all the requirements set forthin the design control section of theregulation.

82. Several comments stated thatadequate controls for verification ofdesign output are contained in proposed§ 820.30(d), ‘‘Design verification,’’ andrepeated in proposed § 820.30(f),‘‘Design output.’’ One comment statedthat this section will place undue

burden on designers and requireadditional documentation which willadd little value to a device’s safety andeffectiveness.

FDA disagrees with the comments.Revised § 820.30(f), ‘‘Designverification,’’ and § 820.30(g), ‘‘Designvalidation,’’ require verification andvalidation of the design output. Section820.30(d), ‘‘Design output,’’ requiresthat the output be documented in afashion that will allow for verificationand validation. These sections thuscontain different requirements that arebasic to establishing that the designoutput meets the approved designrequirements or inputs, including userneeds and intended uses. All therequirements are essential to assuringthe safety and effectiveness of devices.FDA does not believe that theserequirements place undue burden ondesigners or require additionaldocumentation with no value added.These basic requirements are necessaryto assure the proper deviceperformance, and, therefore, theproduction of safe and effective devices,and are acknowledged and accepted assuch throughout the world.

83. Several comments stated that theterm ‘‘hazard analysis’’ should bedefined in reference to designverification. A couple of commentsstated that the proposed requirement fordesign verification, to include softwarevalidation and hazard analysis, whereapplicable, was ambiguous, and maylead an FDA investigator to requiresoftware validation and hazard analysisfor devices in cases where it is notneeded. One comment stated that FDAshould provide additional guidanceregarding software validation andhazard analysis and what investigatorswill expect to see. Another commentstated that by explicitly mentioningonly software validation and hazardanalysis, FDA was missing theopportunity to introduce manufacturersto some powerful and beneficial toolsfor better device designs and problemavoidance.

FDA has deleted the term ‘‘hazardanalysis’’ and replaced it with the term‘‘risk analysis.’’ FDA’s involvement withthe ISO TC 210 made it clear that ‘‘riskanalysis’’ is the comprehensive andappropriate term. When conducting arisk analysis, manufacturers areexpected to identify possible hazardsassociated with the design in bothnormal and fault conditions. The risksassociated with the hazards, includingthose resulting from user error, shouldthen be calculated in both normal andfault conditions. If any risk is judgedunacceptable, it should be reduced toacceptable levels by the appropriate


means, for example, by redesign orwarnings. An important part of riskanalysis is ensuring that changes madeto eliminate or minimize hazards do notintroduce new hazards. Tools forconducting such analyses includeFailure Mode Effect Analysis and FaultTree Analysis, among others.

FDA disagrees with the commentsthat state the requirement is ambiguous.Software must be validated when it is apart of the finished device. FDAbelieves that this control is alwaysneeded, given the unique nature ofsoftware, to assure that software willperform as intended and will notimpede safe operation by the user. Riskanalysis must be conducted for themajority of devices subject to designcontrols and is considered to be anessential requirement for medicaldevices under this regulation, as well asunder ISO/CD 13485 and EN 46001.FDA has replaced the phrase ‘‘whereapplicable’’ with ‘‘where appropriate’’for consistency with the rest of theregulation.

FDA believes that sufficient domesticand international guidelines areavailable to provide assistance tomanufacturers for the validation ofsoftware and risk analysis. For example,‘‘Reviewer Guidance for ComputerControlled Medical Devices Undergoing510(k) Review,’’ August 1991; ‘‘ATechnical Report, SoftwareDevelopment Activities,’’ July 1987; andISO–9000–3 contain computervalidation guidance. Further, FDA ispreparing a new ‘‘CDRH Guidance forthe Scientific Review of Pre-MarketMedical Device Software Submissions.’’Regarding guidance on ‘‘risk analysis,’’manufacturers can reference the draftEN (prEN) 1441, ‘‘Medical Devices—Risk Analysis’’ standard and the workresulting from ISO TC 210 workinggroup No. 4 to include ISO/CD 14971,‘‘Medical Devices—Risk Management—Application of Risk Analysis to MedicalDevices.’’

FDA disagrees that it is missing theopportunity to introduce manufacturersto some powerful and beneficial toolsfor better device designs and problemavoidance because the manufacturermust apply current methods andprocedures that are appropriate for thedevice, to verify and validate the devicedesign under the regulation. Therefore,FDA need not list all known methodsfor meeting the requirements. A toolthat may be required to adequatelyverify and validate one design may beunnecessary to verify and validateanother design.

84. One comment stated that for somedesign elements it may be moreappropriate to reference data from

another prior experimentation ratherthan conduct new testing, and that therequirement to list verification methodsshould be modified.

FDA agrees in part with the comment.The revised language of § 820.30(f) willpermit the use of data from priorexperimentation when applicable.When using data from previousexperimentation, manufacturers mustensure that it is adequate for the currentapplication.

85. ‘‘Design transfer,’’ now§ 820.30(h), has been revised inresponse to the many commentsobjecting to the requirements in theproposed section on ‘‘Design transfer.’’Specifically, the proposed requirementfor testing production units under actualor simulated use conditions wasrewritten and moved to current§ 820.30(g), ‘‘Design validation.’’

FDA again emphasizes that testingproduction units under actual orsimulated use conditions prior todistribution is crucial for ensuring thatonly safe and effective devices aredistributed and FDA has thereforeretained the requirement. ISO 9001:1994discusses this concept in notes 12 and13. As noted above, it is not alwayspossible to determine the adequacy ofthe design by successfully building andtesting prototypes or models producedin a laboratory setting.

The requirement for testing from thefirst three production lots or batches hasbeen deleted. While FDA believes thatthree production runs during processvalidation (process validation may beinitiated before or during designtransfer) is the accepted standard, FDArecognizes that all processes may not bedefined in terms of lots or batches. Thenumber three is, however, currentlyconsidered to be the acceptablestandard. Therefore, although thenumber requirement is deleted, FDAexpects validation to be carried outproperly in accordance with acceptedstandards, and will inspect forcompliance accordingly.

Revised § 820.30(h) now contains ageneral requirement for theestablishment of procedures to ensurethat the design basis for the device iscorrectly translated into productionmethods and procedures. This is thesame requirement that is contained in§ 820.100(a) of the original CGMPregulation.

86. A few comments stated that theproposed requirements for ‘‘Designrelease’’ would prohibit the release ofcomponents, partial designs, andproduction methods before the designwas final because the requirementsmandate a review of all drawings,analysis, and production methods

before allowing the product to go intoproduction. Several comments statedthat the proposed section on ‘‘Designrelease’’ was a duplication ofrequirements in other paragraphs of§ 820.30 and should be deleted.

FDA did not intend the requirementsfor ‘‘Design release’’ to prohibitmanufacturers from beginning theproduction process until all designactivities were completed. The intent ofthe requirement was to ensure that alldesign specifications released toproduction have been approved,verified, and validated before they areimplemented as part of the productionprocess. This requirement is nowexplicitly contained in § 820.30(d).

FDA agrees in part with the secondset of comments and has moved therequirement that design output bereviewed and approved to current§ 820.30(d), ‘‘Design output.’’ Theremainder of the requirements havebeen deleted.

87. Several comments on § 820.30(i),‘‘Design changes,’’ stated that it isunnecessary to control all designchanges and to do so would inhibitchange and innovation.

FDA disagrees with the comments.Manufacturers are not expected tomaintain records of all changesproposed during the very early stages ofthe design process. However, all designchanges made after the design reviewthat approves the initial design inputsfor incorporation into the design, andthose changes made to correct designdeficiencies once the design has beenreleased to production, must bedocumented. The records of thesechanges create a history of the evolutionof the design, which can be invaluablefor failure investigation and forfacilitating the design of future similarproducts. Such records can prevent therepetition of errors and the developmentof unsafe or ineffective designs. Theevaluation and documentation shouldbe in direct proportion to thesignificance of the change. Proceduresmust ensure that after the designrequirements are established andapproved, changes to the design, bothpre- production and post-production arealso reviewed, validated (or verifiedwhere appropriate), and approved.Otherwise, a device may be renderedunable to properly perform, and unsafeand ineffective. ISO 9001:1994, section4.4.9, similarly provides that ‘‘all designchanges and modifications shall beidentified, documented, reviewed, andapproved by authorized personnelbefore their implementation.’’

Note that when a change is made toa specification, method, or procedure,each manufacturer should evaluate the


change in accordance with anestablished procedure to determine ifthe submission of a premarketnotification (510(k)) under § 807.81(a)(3)(21 CFR 807.81(a)(3)), or the submissionof a supplement to a PMA under§ 814.39(a) (21 CFR 814.39) is required.Records of this evaluation and its resultsshould be maintained.

88. Several comments recommendedthat only changes after design validationand design transfer to full-scaleproduction need to be documented.

FDA disagrees with the comments.The safety and effectiveness of devicescannot be proven by final inspection ortesting. Product development isinherently an evolutionary process.While change is a healthy and necessarypart of product development, qualitycan be ensured only if change iscontrolled and documented in thedevelopment process, as well as theproduction process. Again,manufacturers are not expected tomaintain records of changes madeduring the very early stages of productdevelopment; only those design changesmade after the approval of the designinputs need be documented. Eachmanufacturer must establish criteria forevaluating changes to ensure that thechanges are appropriate for its designs.

89. One comment on proposed§ 820.30(i), ‘‘Design changes,’’ statedthat validation of design changes is notalways necessary and the regulationshould provide for other methods to beused. FDA agrees with the commentsand has amended the requirement topermit verification where appropriate.For example, a change in thesterilization process of a catheter willrequire validation of the new process,but the addition of more chromium toa stainless steel surgical instrument mayonly require verification throughchemical analysis. Where a designchange cannot be verified by subsequentinspection and test, it must be validated.

90. Many comments noted that theacronym for proposed design historyrecord (DHR) was the same as that of‘‘device history record’’ (DHR), andsuggested that the name of the ‘‘designhistory record’’ be changed. Severalcomments stated that the requirementsof the ‘‘design history record’’ should bedeleted because they were redundantwith the requirements of the ‘‘devicemaster record.’’

FDA agrees with the first set ofcomments and has changed the name to‘‘design history file.’’

FDA disagrees with the second set ofcomments. The DMR contains thedocumentation necessary to produce adevice. The final design output from thedesign phase, which is maintained or

referenced in the DHF, will form thebasis or starting point for the DMR.Thus, those outputs must be referred toor placed in the DMR. The total finisheddesign output includes the final device,its labeling and packaging, and the DMRthat includes device specifications anddrawings, as well as all instructions andprocedures for production, installation,maintenance, and servicing. The DHF,in contrast, contains or references all therecords necessary to establishcompliance with the design plan andthe regulation, including the designcontrol procedures. The DHF illustratesthe history of the design, and isnecessary so that manufacturers canexercise control over and be accountablefor the design process, therebymaximizing the probability that thefinished design conforms to the designspecifications.

91. A few comments stated that theproposed requirements in § 820.30(j) forthe design history record should allowa single design history record for eachdevice family or group having commondesign characteristics.

FDA agrees with the comments. Theintent of the DHF is to document, orreference the documentation of, theactivities carried out to meet the designplan and requirements of § 820.30. ADHF is, therefore, necessary for eachtype of device developed. The DHFmust provide documentation showingthe actions taken with regard to eachtype of device designed, not genericallylink devices together with differentdesign characteristics and give a generaloverview of how the output wasreached.

92. Some comments stated that therequirement that the DHF contain ‘‘all’’records necessary to demonstrate thatthe requirements are met should bedeleted because not ‘‘all’’ efforts needdocumentation.

FDA received similar comments onalmost every section of the regulationthat had the word ‘‘all.’’ The proposedrequirement does not state that allrecords must be contained in the DHF,but that all records necessary todemonstrate that the requirements weremet must be contained in the file. FDAhas deleted the word ‘‘all’’ but cautionsmanufacturers that the complete historyof the design process should bedocumented in the DHF. Such recordsare necessary to ensure that the finaldesign conforms to the designspecifications. Depending on the design,that may be relatively few records.Manufacturers who do not document alltheir efforts may lose the informationand experience of those efforts, therebypossibly requiring activities to beduplicated.

D. Document Controls (Subpart D)93. One comment stated that subpart

D of part 820 should be titled‘‘Document Controls,’’ instead of theproposed ‘‘Document and RecordControls’’ because the ‘‘record’’requirements are addressed in subpartM. One comment stated that removal ofobsolete or unneeded documents shouldbe performed to maintain the integrityof the product configuration and thequality system. The comment suggestedadding a requirement for a verificationstep for document distribution andremoval to ensure this importantelement of a quality system is performedcorrectly. A few comments stated thatproposed § 820.40 should be rewrittento be similar to ISO 9001 and to deletethe requirement that documents be‘‘accurate’’ because the comments fearedthat typographical errors would beconsidered violations.

FDA agrees with the first commentand has changed the title accordingly.FDA agrees in part with the secondcomment. The verification of documentdistribution and removal is veryimportant and can directly affect thequality of a product. Section 820.40,which requires that the manufacturerestablish and maintain procedures tocontrol all documents, including thosethat are obsolete and/or to be removed,requires that the removal (or preventionof use) of obsolete documents beverified. FDA agrees in part with the lastset of comments and has rewritten thesection, following ISO 9001:1994, to bea general requirement for procedures tocontrol documents that are requiredunder the regulation. The proceduresestablished must, among other things,ensure control of the accuracy and usageof current versions of the documentsand the removal or prevention from useof obsolete documents, as well as ensurethat the documentation developed isadequate to fulfill its intended purposeor requirement. FDA retained therequirement that the procedures ensurethat documents meet the requirementsof the regulation because that is thepurpose of controlling the documents.FDA deleted the term ‘‘accurate’’ butnotes that a typographical error canchange the meaning of a document andhave undesirable consequences.

94. Several comments on proposed§ 820.40(a), ‘‘Document approval andissue,’’ as well as other sectionsthroughout the regulation, suggestedthat the term ‘‘signature’’ be replaced bythe term ‘‘identification.’’ Such a changewould allow for electronic orcomputerized identification in lieu offormal written signatures. Othercomments stated that ‘‘or stamps’’


should be added after ‘‘signature’’ sincethey are legally recognized in someforeign countries.

FDA is aware that manydocumentation systems are nowmaintained electronically, and is in theprocess of developing an agency-widepolicy that will be implemented throughrulemaking on the use of electronicsignatures. The agency identifiedseveral important issues related to theuse of such signatures, including how toensure that the identification is in factthe user’s ‘‘signature.’’ These issues arediscussed in FDA’s ANPRM on the useof electronic signatures, published inthe Federal Register on July 21, 1992(57 FR 32185), and the proposedregulation published in the FederalRegister on August 31, 1994 (59 FR45160). Therefore, FDA has not revisedthe regulation to use the term‘‘identification,’’ but notes that thequality system regulation’s use of theterm ‘‘signature’’ will permit the use ofwhatever electronic means the agencydetermines is the equivalent of ahandwritten signature. FDArecommends that manufacturers use thetwo Federal Register documents asguidance until the regulation isfinalized. FDA has not added the term‘‘or stamps’’ to the regulation; however,stamps could be acceptable if themanufacturer has a formal procedure onhow stamps are used in place ofhandwritten signatures. The procedurewould have to address many of the sameissues addressed in the electronicsignature Federal Register documents,most importantly how the stamps wouldbe controlled and how the manufacturerwould ensure that the stamp was in factthe user’s ‘‘signature.’’

95. Several comments stated thatproposed § 820.40(b), ‘‘Documentdistribution,’’ should be rewritten to beconsistent with ISO 9001.

In response, FDA has deleted thesection. The requirements for makingdocuments available at all appropriatelocations (ISO 9001:1994, section4.5.2(a)) and the requirements forpromptly removing obsolete documents(ISO 9001:1994, section 4.5.2(b)) havebeen moved, in revised form, to§ 820.40(a). In response to comments,FDA has added that obsoletedocuments, in lieu of being promptlyremoved from points of use, may be‘‘otherwise prevented from unintendeduse.’’

96. Several comments suggested majorchanges to proposed § 820.40(c),‘‘Documentation changes.’’ Some statedthat the requirements should be revisedto be consistent with ISO 9001. Othersstated that the requirements related tovalidation should be rewritten and

moved to another section under thispart, because § 820.40(c) should onlyaddress document changes, not devicechanges. Several comments stated thatthe reference to determining whether a510(k) or PMA supplement is requiredafter making changes to a device shouldbe deleted because it is covered underdifferent parts of the act and regulations.One comment stated that therequirement in § 820.40(c) for changesto be ‘‘approved by individuals in thesame functions/organizations thatperformed the original review andapproval, unless specifically designatedotherwise’’ is unrealistic and does notreflect the way things are done in reallife.

FDA agrees with many of thecomments and has substantiallyrewritten § 820.40(c), now designated as§ 820.40(b), to relate specifically tochanges to a document. Therequirements are now very similar to theISO 9001:1994 requirements in section4.5.3. FDA has retained the requirementthat the approved changes must becommunicated in a timely manner toappropriate personnel. FDA has hadmany experiences where manufacturersmade corrections to documents, but thechanges were not communicated in atimely manner to the personnel utilizingthe documents. The result of theseuntimely communications was theproduction of defective devices.

In addition, FDA has moved therequirement for validating productionand process changes to § 820.70(b),‘‘Production and process changes,’’ andnotes that changes to the designspecifications, at any time during thelifetime of the design of the device,must conform to the requirements in§ 820.30(i), ‘‘Design changes.’’

FDA has also deleted the sentencereferencing 510(k)’s and PMAsupplements because FDA believes thisis covered elsewhere, but notes that thissentence is in the preamble above for§ 820.30(i).

FDA disagrees that the requirementfor changes to be ‘‘approved by anindividual(s) in the same function ororganization that performed the originalreview and approval, unless specificallydesignated otherwise’’ should bedeleted and notes that this is arequirement of ISO 9001:1994 as well.The intent of the requirement is toensure that those who originallyapproved the document have anopportunity to review any changesbecause these individuals typically havethe best insight on the impact of thechanges. The requirement is flexible,however, because it permits themanufacturer to specifically designateindividuals who did not perform the

original review and approval to reviewand approve the changes. To designatesuch individuals, the manufacturer willneed to determine who would be bestsuited to perform the function, thusensuring adequate control over thechanges. In this way, review andapproval will not be haphazard.

97. One comment on proposed§ 820.40(d), ‘‘Documentation changerecord,’’ stated that this section shouldbe deleted because the other paragraphsof § 820.40 adequately cover theproposed requirements. Two commentssuggested replacing the section with therequirements of section 4.5.2 of ISO9001.

FDA has deleted § 820.40(d) andplaced the revised requirements inparagraphs (a) and (b) of this section.The general requirement of § 820.40now requires the manufacturer toestablish adequate procedures to controlall documents required by part 820. Theprocedures must cover the requirementslisted in § 820.40 (a) and (b). Thus, themanufacturer must establish aprocedure for ensuring that only thecurrent and approved version of adocument is used, achieving theobjective of the ‘‘Master list orequivalent document controlprocedure,’’ required in ISO 9001:1994,section 4.5.2.

The other requirement in § 820.40(d),‘‘Document change record,’’ was tomaintain a record of changes, to includea description of the changes, amongother things. FDA has retained thisrequirement and has moved it into§ 820.40(b), ‘‘Document changes,’’because the agency believes thisinformation to be important and usefulwhen investigating and performingcorrective or preventive actions.

FDA believes § 820.40 on Documentcontrols now adequately harmonizeswith ISO 9001:1994, sections 4.5.1,4.5.2, and 4.5.3.

E. Purchasing Controls (Subpart E)98. One comment stated that the

proposed CGMP regulation omits anydiscussion of contract reviews, such asthat contained in ISO 9001, section 4.3.Rather than leaving these procedures tothe interpretations of individualmanufacturers and investigators, thecomment stated that FDA shouldexplicitly state its general policyregarding contract reviews in theregulation.

FDA agrees with the conceptsunderlying the contract reviewrequirements of ISO 9001:1994, butbelieves these principles are alreadyreflected in requirements in theregulation, such as §§ 820.50 Purchasingcontrols and 820.160 Distribution.


Therefore, the agency has not added aseparate section on contract review.

99. One comment stated that therequirements in § 820.50 amount tooverregulation. The comment stated thatcomponents are purchased by providinga specification sheet. They are theninspected upon receipt, and defectivecomponents are returned. According tothe comment, under § 820.50, themanufacturer would be required tospend more time on paperwork, andproduct would still have to be inspectedupon receipt. Another comment statedthat the cost of the quality assurancedocumentation program is going to besignificantly higher for a company thatruns a Just In Time (JIT) program thanwhat FDA estimated.

FDA disagrees with the comments.The failure to implement adequatepurchasing controls has resulted in asignificant number of recalls due tocomponent failures. Most of these weredue to unacceptable componentsprovided by suppliers. Since FDA is notregulating component suppliers, FDAbelieves that the explicit addition toCGMP requirements of the purchasingcontrols of ISO 9001:1994 is necessaryto provide the additional assurance thatonly acceptable components are used.To ensure purchased or otherwisereceived product or services conform tospecifications, purchasing must becarried out under adequate controls,including the assessment and selectionof suppliers, contractors, andconsultants, the clear and unambiguousspecification of requirements, and theperformance of suitable acceptanceactivities. Each manufacturer mustestablish an appropriate mix ofassessment and receiving acceptance toensure products and services areacceptable for their intended uses. Thespecifications for the finished devicecannot be met unless the individualparts of the finished device meetspecifications. The most efficient andleast costly approach is to ensure thatonly acceptable products and servicesare received. This means that onlysuppliers, contractors, and consultantsthat meet specifications should be used.

The regulation has been written toallow more flexibility in the waymanufacturers may ensure theacceptability of products and services.Under the requirements, manufacturersmust clearly define in the proceduresthe type and extent of control theyintend to apply to products andservices. Thus, a finished devicemanufacturer may choose to providegreater in-house controls to ensure thatproducts and services meetrequirements, or may require thesupplier to adopt measures necessary to

ensure acceptability, as appropriate.FDA generally believes that anappropriate mix of supplier andmanufacturer quality controls arenecessary. However, finished devicemanufacturers who conduct productquality control solely in-house mustalso assess the capability of suppliers toprovide acceptable product. Whereaudits are not practical, this may bedone through, among other means,reviewing historical data, monitoringand trending, and inspection andtesting.

After evaluation of all of thecomments on § 820.50, FDA has decidedto change the wording of § 820.50(a) andadopt the wording of ISO 9001:1994 tomake clear that manufacturers haveflexibility in determining the degree ofassessment and evaluation necessary forsuppliers, contractors, and consultants.Thus the degree of supplier controlnecessary to establish compliance mayvary with the type and significance ofthe product or service purchased andthe impact of that product or service onthe quality of the finished device. Inaddition, the requirement formanufacturers to establish assessmentcriteria has been deleted but theevaluation still must include adescription how the assessment wasmade (according to what criteria orobjective procedure) and the resultsmust be documented. Eachmanufacturer must now define the typeand extent of control it will exerciseover suppliers, contractors, andconsultants. This is consistent with the1994 version of ISO 9001.

Thus, FDA believes that the flexibilityof the regulation will allowmanufacturers to implement JITprocedures without additional cost. Infact, the new regulation is moreconducive to JIT practices by permittingthe assessment or evaluation of productor services up front, thereby lesseningthe degree of in-house control that maybe necessary.

100. Several comments said that itwas unclear what FDA meant by thephrase ‘‘or held by other persons undercontract conform to specifications’’ andthat this phrase should be deleted.

FDA agrees with the comments andhas deleted the phrase. The phrase wasintended to mean product and serviceswhich were purchased or processed insome manner by other organizations.Section 820.50 now applies to‘‘purchased or otherwise receivedproduct and services’’ to convey thismeaning. FDA emphasizes that therequirements apply to all product andservice received from outside of thefinished device manufacturer, whetherpayment occurs or not. Thus, a

manufacturer must comply with theseprovisions when it receives product orservices from its ‘‘sister facility’’ orsome other corporate or financialaffiliate. ‘‘Otherwise received product’’would include ‘‘customer suppliedproduct’’ as in ISO 9001:1994, section4.7, but would not apply to ‘‘returnedproduct’’ from the customer.

101. One comment stated that‘‘manufacturing materials’’ should bedeleted from the first sentence of theintroductory text of the proposed§ 820.50, as the assessment of themanufacturers of manufacturingmaterials would be a monumental task.

FDA disagrees with the comment. Thefirst sentence of the introductory text of§ 820.50 is rewritten to be a generalrequirement that each manufacturermust establish procedures to ensure thatreceived product and services(purchased or otherwise received)conform to specified requirements. Allmanufacturers are expected to applycontrols to manufacturing materialsappropriate to the manufacturingmaterial, the intended use, and theeffect of the manufacturing materials onsafety and effectiveness. For example,the procedures necessary to ensure thata mold release agent conforms tospecified requirements may be lessinvolved than the procedures forcontrolling latex proteins. The provisionallows the manufacturer the flexibilityof establishing the procedures to meetits needs and to ensure that the productconforms to specified requirements.

102. One comment said that FDAshould delete the last sentence of theintroductory text of proposed § 820.50because it is unnecessary formanufacturers to develop specificationsfor services that are unrelated to productor process quality, and because theterms ‘‘service’’ and ‘‘other persons’’lack definition. Other comments statedthat ‘‘all’’ should be deleted in thegeneral requirement.

FDA disagrees with the comments.First, as used in the regulation,‘‘service’’ means parts of themanufacturing or quality system that arecontracted to others, for example,plating of metals, testing, andsterilizing, among others. Second, FDAbelieves that all suppliers of suchservices must be assessed andevaluated, just like a supplier of aproduct. As always, the degree ofcontrol necessary is related to theproduct or service purchased. FDA has,however, deleted the term ‘‘provided byother persons’’ because it wasunnecessary. FDA did not delete theword ‘‘all’’ because, as discussed above,component manufacturers are notsubject to this regulation, so it is the


finished device manufacturer who isresponsible for ‘‘all’’ product andservices.

103. One comment stated that manysuppliers of components to the medicaldevice industry have their qualitysystems certified to an ISO 9000standard by an independent third partyauditor, and that such registration ofcomponent manufacturers should beconsidered in vendor assessment plans.

FDA agrees in part with the commentin that certification may play a role inevaluating suppliers, but cautionsmanufacturers against relying solely oncertification by third parties as evidencethat suppliers have the capability toprovide quality products or services.FDA has found during inspections thatsome manufacturers who have beencertified to the ISO standards have nothad acceptable problem identificationand corrective action programs.Therefore, the initial assessment orevaluation, depending on the type andpotential effect on device quality of theproduct or service, should be acombination of assessment methods, topossibly include third party or productcertification. However, third partycertification should not be relied onexclusively in initially evaluating asupplier. If a device manufacturer hasestablished confidence in the supplier’sability to provide acceptable products orservices, certification with test data maybe acceptable.

104. Some comments stated thatconsultants should not be included inthe regulation at all. Others stated thatit was not consistent with ISO 9001.

FDA added ‘‘consultants’’ to§ 820.50(a) in response to the commentsfrom § 820.25(c). FDA disagrees that‘‘consultants’’ should be deletedbecause over the years FDA hasobserved that a surprising number offirms hire consultants who have noparticular expertise in the area in whichthe firm is seeking assistance. Section820.50 addresses this problem byensuring that a consultant’s capabilityfor the specific tasks for which he or sheis retained be assessed and documented.Further, FDA does not believe thisrequirement is inconsistent with ISO9001:1994 because ISO uses the term‘‘subcontractor.’’ The term‘‘subcontractor’’ includes consultants.

105. One comment said that requiringevaluation of potential suppliers,contractors, and consultants ‘‘on thebasis of their ability to meetrequirements’’ is vague and should beclearly defined.

FDA disagrees that the phrase isvague. Suppliers, contractors, andconsultants selected by manufacturersof medical devices should have a

demonstrated capability of providingproducts and services that meet therequirements established by the finisheddevice manufacturer. The capability ofthe product or service suppliers shouldbe reviewed at intervals consistent withthe significance of the product orservice provided and the review shoulddemonstrate conformance to specifiedrequirements.

106. One comment questioned theusefulness of § 820.50, given that therequirements under § 820.80 Receiving,in-process, and finished deviceacceptance, require manufacturers toestablish and maintain procedures foracceptance of incoming components.

The intent of § 820.50 is to ensure thatdevice manufacturers select only thosesuppliers, contractors, and consultantswho have the capability to providequality product and services. As withfinished devices, quality cannot beinspected or tested into products orservices. Rather, the quality of a productor service is established during thedesign of that product or service, andachieved through proper control of themanufacture of that product or theperformance of that service. Section820.50 thus mandates that products bemanufactured and services beperformed under appropriate qualityassurance procedures. Finished devicemanufacturers are required under§ 820.50 to establish the requirementsfor, and document the capability of,suppliers, contractors, and consultantsto provide quality products andservices.

Section 820.80 is specific to a devicemanufacturer’s acceptance program.While finished device manufacturers arerequired to assess the capability ofsuppliers, contractors, and consultantsto provide quality products andservices, inspections and tests, andother verification tools, are also animportant part of ensuring thatcomponents and finished devicesconform to approved specifications. Theextent of incoming acceptance activitiescan be based, in part, on the degree towhich the supplier has demonstrated acapability to provide quality products orservices. An appropriate product andservices quality assurance programincludes a combination of assessmenttechniques, including inspection andtest.

107. Several comments stated that itwas not clear how a manufacturer couldevaluate an off-the-shelf component thatis purchased from a distributor ratherthan directly from its manufacturer, andstated that it would not be helpful toaudit the distributor.

FDA agrees that auditing a distributorwould not meet the intent of § 820.50.

Manufacturers should remember thatthe purpose of assessing the capabilityof suppliers is to provide qualityproducts and to provide a greater degreeof assurance, beyond that provided byreceiving inspection and test, that theproducts received meet the finisheddevice manufacturer’s requirements.The agency recognizes that finisheddevice manufacturers may not always beable to audit the supplier of a product.In such cases, the manufacturer mustapply other effective means to assurethat products are acceptable for use.

108. Many comments from bothdomestic and foreign firms in responseto proposed § 820.22(b) said that makingsupplier audit reports subject to FDAreview would have a major adverseimpact on the relationships between thefinished device manufacturers and theirsuppliers and service providers. Somestated that the requirement would causesuppliers to refuse to sell components tomedical device manufacturers,especially suppliers who provide only asmall part of their production to devicemanufacturers. Others said that thispolicy is not consistent with FDA’spolicy for internal audits.

FDA recognizes that quality audits ofsuppliers have a significant anddemonstrated value as a managementtool for corrective action, qualityimprovement, and overall assurance ofcomponent and service quality, anddoes not seek to undermine their value.Therefore, based on the concerns raisedby the comments, FDA will not reviewsupplier audit reports during a routineFDA inspection for compliance withpart 820, as noted in § 820.180(c),‘‘Exceptions.’’ The audit procedures, theevaluation procedures, and documentsother than the supplier audit reportsthemselves that demonstrateconformance with § 820.50 will besubject to review by an FDAinvestigator.

109. One comment stated that it wasunclear what is meant by therequirement to specify ‘‘qualityrequirements’’ that must be met bysuppliers, contractors, and consultants,as stated in § 820.50(a).

The term ‘‘quality requirements’’means the quality control and qualityassurance procedures, standards, andother requirements necessary to assurethat the product or service is adequatefor its intended use. FDA does notbelieve the term is unclear.

110. Several comments on proposed§ 820.50(b), ‘‘Purchasing forms,’’suggested that the term ‘‘forms’’ bereplaced by ‘‘data.’’ Other commentsstated that use of the term would notallow electronic data exchange. Onecomment stated that the use of an


exclusive form for purchasing isunnecessary and redundant, and that itis unduly burdensome to requiredetailed documentation on thosecommonly available items such asfasteners. The comment stated that it iscommon practice to use prints ordrawings to fulfill the purpose of theform.

FDA agrees in part with thecomments, but does not believe that§ 820.50(b) prohibits the use of drawingsor prints, assuming that the documentscontain data clearly describing theproduct or service ordered, and that thespecified requirements are met.However, § 820.50(b) has been rewrittenand now requires manufacturers toestablish purchasing ‘‘data.’’ Thisprovides manufacturers with theflexibility to use both written andelectronic means to establish purchasinginformation.

111. One comment stated that theinclusion of an additional provisionmandating that suppliers notifymanufacturers of any change in theirproduct or service places an undueburden on suppliers and inhibits theirability to make minor adjustmentswithin the parameters of agreed uponspecifications and quality requirements.Many other comments stated that therequirement in § 820.50(b) is feasibleonly for components that are custommade for the manufacturer, and ismeaningless for off-the-shelfcomponents purchased fromdistributors. Other comments stated thatthe requirement is part of the originalCGMP regulation and experience hasshown that suppliers are not willing tosupply device manufacturers with suchinformation. A few other commentsstated that ‘‘any’’ should be deletedbecause the term is too broad and couldresult in burdensome reporting ofvariables which are irrelevant to thecontinued performance or specificationsof the product or service.

FDA agrees in part with the commentsand has amended the requirement tostate that such agreement should beobtained ‘‘where possible.’’ FDA stillbelieves that this change information isvery important to the manufacturer, andthat the manufacturer should obtaininformation on changes to the productor service. Where a supplier refuses toagree to provide such notification,depending on the product or servicebeing purchased, it may render him anunacceptable supplier. However, wherethe product is in short supply and mustbe purchased, the manufacturer willneed to heighten control in other ways.

FDA has also deleted the term ‘‘any’’to give manufacturers the flexibility to

define in the agreement the types ofchanges that would require notification.

112. One comment stated that§ 820.50(b) should incorporate aprovision that would allowmanufacturers to cite publishedstandards in purchasing forms as onesuitable method for specifyingpurchased item quality requirements.

FDA believes the addition isunnecessary, because the regulationpermits manufacturers to clearlydescribe or reference requirements. Areference could be to a standard.

113. One comment stated that it isunclear whether the requirement for asignature to approve purchasingdocuments pertains to approval of theform used for purchasing or approval ofthe individual purchasing transaction.The comment also stated that asignature approval by transaction is notpractical for firms using electronicdocument transmittals.

FDA has rewritten the requirement tobe more clear. The requirement is forapproval of purchasing data orinformation on the purchasingdocument used to purchase a product orservice. Thus, each manufacturer mustreview and approve the purchasing databefore release of the data. Approval ofeach purchasing transaction is notrequired. FDA addressed the use ofelectronic signatures in response toanother comment, and notes that FDA isin the process of developing an agency-wide policy on the use of electronicsignatures.

114. One comment stated thatpurchasing is carried out verbally inmany small firms, without the use ofcomponent-specific purchasing forms,and that the regulation should berevised to allow such verbal purchasingto continue.

FDA disagrees with the comment.About 15 percent of the recalls eachyear are due to unacceptable purchasedproducts. Many of these products areunacceptable because the finisheddevice manufacturer did not properlydescribe the product. The requirementsfor purchased products and servicesmust be documented to ensure that thesupplier, contractor, and consultantprovide a product or service whichconforms to specified requirements.This requirement, and the goal it seeksto achieve, are applicable to both smalland large companies.

115. One comment stated that therequirement that purchasing forms spellout the specifications for manufacturingmaterials in all cases is excessive, andthat the need for specifications shouldbe based on the criticality of and riskassociated with the use of the specificmanufacturing material.

FDA agrees that the specifications formany manufacturing materials may beso well established that the trade nameof the product may be sufficient todescribe the material needed. For othermaterials, specific written specificationsmay be necessary to ensure that thedesired materials are received. Theextent of the specification detailnecessary to ensure that the product orservice purchased meets requirementswill be related to the nature of theproduct or service purchased, takinginto account the effect the product orservice may have on the safety oreffectiveness of the finished device,among other factors. The term‘‘specification’’ has been replaced withthe term ‘‘specified requirements’’ tobetter reflect the intent of therequirement.

116. FDA has deleted the last twosentences of § 820.50(b) in the WorkingDraft and has replaced them with areference to § 820.40, the generaldocument control provision. This doesnot change the requirement but simplyeliminates any confusion about thereviews and approvals beingduplicative.

F. Identification and Traceability(Subpart F)

i. Identification (§ 820.60)

117. A few comments on proposed§§ 820.60 Identification and traceabilityand 820.65 Critical device, traceabilitystated that the two sections should berewritten to delete the distinctionbetween critical and noncritical devices.Some stated they should be consistentwith ISO.

FDA agrees in part with the commentsand has rewritten § 820.60 to beconsistent with ISO 9001:1994 andbroad enough to allow the manufacturerthe flexibility needed to identifyproduct by whatever means describedby the required procedure. The term‘‘critical device’’ has also been deleted,and traceability is addressed solely in§ 820.65.

118. One comment stated thatmanufacturing materials should bedeleted from § 820.60, as therequirements are excessive and noteconomically justifiable with regard tosuch materials.

FDA disagrees with the comment. Thepurpose of § 820.60 is to ensure that allproducts, including manufacturingmaterials used in the manufacture of afinished device, are properly identified.This requirement is intended to helpprevent inadvertent use or release ofunacceptable product intomanufacturing. It is as important thatthe proper manufacturing materials be


used as it is that the proper componentbe used.

119. A few comments thought that§ 820.60 Identification in the WorkingDraft was redundant with § 820.86Acceptance status.

FDA disagrees with the comments.Section 820.60 only requires thatproduct be identified but says nothingabout the acceptance status of thatproduct. Section 820.86 requires thatthe acceptance status be identified sothat inadvertent use of product does notoccur. The manufacturer may choose toset up a system by which theidentification required by § 820.60 canalso show the acceptance statusrequired by § 820.86, but this is up tothe manufacturer.

ii. Traceability (§ 820.65)120. A few comments stated that

proposed § 820.65 Critical devices,traceability implies that traceabilityrequirements exist for all devices.Several other written comments andoral testimony at the August andSeptember 1995 meetings stated that thewording of the Working Draft was toobroad, vague, and ambiguous, and ineffect would require that all devices betraced.

As noted above, FDA has deleted thecritical device terminology. Section820.65 is now entitled Traceability anduses the definition from the originalCGMP of a critical device to provide thenecessary clarity and delineation forthis requirement. Thus, traceability isrequired for the critical devices listed inthe Federal Register notice of March 17,1988 (53 FR 8854). However, FDA isusing the definition of critical device inthe requirement of § 820.65, rather thana reference to the 1988 list of criticaldevices, because that list has not beenupdated since 1988 and there are noplans to revise that list. Therefore, it isimperative that manufacturers use thedefinition within the requirement of§ 820.65 to determine if a particulardevice needs to be traced; it may not besufficient to rely solely on the 1988 list.Manufacturers may find it advantageousto provide unit, lot, or batch traceabilityfor devices for which traceability is nota requirement to facilitate control andlimit the number of devices that mayneed to be recalled due to defects orviolations of the act.

It is important that the traceabilityrequirements in part 820 are notconfused with the Medical DeviceTracking regulation in part 821 (21 CFRpart 821). The tracking regulation isintended to ensure that tracked devicescan be traced from the devicemanufacturing facility to the person forwhom the device is indicated, that is,

the patient. Effective tracking of devicesfrom the manufacturing facility, throughthe distribution network (includingdistributors, retailers, rental firms andother commercial enterprises, deviceuser facilities, and licensedpractitioners) and, ultimately, to anyperson for whom the device is intendedis necessary for the effectiveness ofremedies prescribed by the act, such aspatient notification (section 518(a) ofthe act (21 U.S.C. 360h(a)) or devicerecall (section 518(e).) In contrast, thetraceability provision requires that adevice that meets the definition of a‘‘critical device’’ can be traced from themanufacturing facility only to the‘‘initial consignee’’ as discussed in§ 820.160 Distribution.

121. Another comment on proposed§ 820.65 stated that critical devicecomponent traceability could beinterpreted to be required for almost allelectronic components and othercomponents in a critical device. Thecomment stated that the extent ofcomponent traceability should be left tothe manufacturer’s discretion, since it isan economic risk decision. Severalcomments stated that componenttraceability should only be required‘‘where appropriate,’’ that all ‘‘criticaldevice’’ components do not requiretraceability to comply with the act.

FDA disagrees that the traceabilitydetermination should be based solely oneconomic risk. As noted in the preambleto the November 23, 1993, proposal (58FR 61964), where traceability isimportant to prevent the distribution ofdevices that could seriously injure theuser, traceability of components must bemaintained so that potential and actualproblem components can be traced backto the supplier. The revised requirementmandates traceability of components‘‘where appropriate’’ as recommendedby the GMP Advisory Committee andlimited by the discussion in the scope,§ 820.1(a)(3). The critical componentdefinition in the original CGMPregulation may be used as guidance.However, to carry out the requirementof the revised provision, themanufacturer should perform riskanalysis first on the finished device, andsubsequently on the components ofsuch device, to determine the need fortraceability. FDA believes that theextent of traceability for both active andinactive implantable devices shouldinclude all components and materialsused when such products could causethe medical device not to satisfy itsspecified requirements. ISO/CD 13485also requires that the manufacturer’sagents or distributors maintain recordsof distribution of medical devices withregard to traceability and that such

records be available for inspection. Thisrequirement is found in § 820.160Distribution of this regulation and isconsistent with the requirements in§ 820.151 of the original CGMP.

While FDA understands thattraceability entails additional cost, theagency notes that, if a product recall isnecessary, more devices would besubject to recall if units, lots, or batchesof specific devices are not traceable,with associated higher recall costs to themanufacturer.

G. Production and Process Controls(Subpart G)

i. Production and Process Controls(§ 820.70)

122. A few comments stated that therequirements in proposed § 820.70(a)General are similar to those in ISO 9001,but that ISO 9001 makes clear that therequirements apply only ‘‘whereapplicable’’ and where deviations fromdevice specifications would ‘‘directlyaffect quality.’’ The comments suggestedthat FDA similarly employ suchlanguage to avoid being too restrictiveand overly burdensome.

The requirements in § 820.70(a) areintended to ensure that eachmanufacturer produces devices thatconform to their specifications. Thus,where any deviations fromspecifications could occur duringmanufacturing, the process controlprocedures must describe those controlsnecessary to ensure conformance. Thosecontrols listed in the regulation may notalways be relevant; similarly others maybe necessary. For example, wheredeviations from device specificationscould occur as a result of the absence ofwritten production methods,procedures, and workmanship criteria,such production controls are required.Thus, FDA has retained the provision,but revised it slightly to conform withthe original CGMP requirements in§ 820.100(b)(1).

As noted, the process controlrequirements apply when any deviationfrom specifications could occur. FDAbelieves that such deviations must becontrolled, and that linking therequirements to deviations that directlyaffect quality is inappropriate andsubjective, and that it could lead to themanufacture of potentially dangerousdevices through the lack of control ofprocesses known to directly affect adevice’s specifications. Therefore, theprovision has not been restricted in thismanner. FDA has, however, revised therequirements to state ‘‘Where processcontrols are needed they shall include:’’to make it clear that a manufacturer onlyhas to comply with the requirements


stated in § 820.70 (a)(1) through (a)(5) ifthe general criteria described in§ 820.70(a) have been met.

123. One comment stated that thesecond sentence of proposed § 820.70(a)was too restrictive, in that someprocesses can be accomplished byadequately trained personnel withoutthe use of procedures.

FDA disagrees with the commentbecause the establishment of proceduresis necessary to ensure consistency inmanufacture. The procedures may betailored under the requirement to coveronly those controls necessary to ensurethat a device meets its specifications.FDA notes that the deletion of the word‘‘all’’ does not alter the requirements.The first sentence in the generalrequirement also serves to tie theproduction and process controls to thedesign and development phase wheremany of these controls are originallyestablished in order for the device toconform to its design specifications.

In addition to these changes, FDA hasadded the requirement that productionprocesses be ‘‘monitored’’ because amanufacturer must monitor a controlledprocess to ensure that the processremains in control.

124. FDA deleted the requirement forprocess controls related to ‘‘installationand servicing’’ from proposed § 820.70(a)(1) and (a)(2) in response tocomments. Such control is adequatelyassured by the requirements in§§ 820.170 Installation and 820.200Servicing. FDA amended § 820.70(a)(3)in response to some comments that wereconfused about compliance with‘‘applied reference standards.’’ The term‘‘applied’’ was replaced with‘‘specified’’ to make it clear that themanufacturer must comply withreference standards or codes which heor she has specified in the DMR. FDAhas also deleted ‘‘and process controlprocedures’’ because that requirement isinherent in § 820.70(a), ‘‘General.’’ FDAamended § 820.70(a)(5) by adding‘‘identified and approved’’ in responseto comments and to clarify that the‘‘representative samples’’ have to beidentified and deemed appropriatebefore they are used as referencestandards.

125. One comment believed that thereis no longer a requirement that processchanges be validated. Other commentson the Working Draft § 820.70(b) statedthe requirement was still confusing withrespect to ‘‘unless inspection and testfully verifies,’’ and when the ‘‘approval’’was to occur.

Revised § 820.70(b), ‘‘Production andprocess changes,’’ addresses therequirement for production and processchanges to be ‘‘verified or where

appropriate validated according to§ 820.75.’’ This requirement forvalidation was moved from § 820.40(c),in revised form, to § 820.70. Verificationwas added to give the manufacturer theflexibility to verify changes that can betested and inspected because FDAbelieves that validation is not alwaysnecessary. FDA has provided guidanceon when changes should be validated inits ‘‘Guideline on General Principles ofProcess Validation.’’ The agency notesthat wherever changes may influence avalidated process, the process must berevalidated as described in § 820.75. Afew examples of processes that must bevalidated include sterilization, molding,and welding.

FDA has deleted the last part in§ 820.70(b) of the Working Draft aboutapproving changes and has replaced itwith ‘‘Changes shall be approved inaccordance with § 820.40.’’ This doesnot change the requirement but simplyrefers back to § 820.40 because thisrequires the same review and approval.This was done to eliminate anyconfusion about the reviews andapprovals being duplicative.

126. The EU Commission and othersstated that environmental conditionsonly affect the quality of certain devicesand that the requirements should,therefore, be limited in theirapplication. Other comments stated thatthe requirements in proposed§ 820.70(b), ‘‘Environmental control,’’were not consistent with therequirements in the original CGMP,§ 820.46. Another comment requestedthat FDA delete the reference to‘‘facilities’’ inspection and limit therequirement to review of the controlsystem, as contained in the originalCGMP regulation.

FDA has amended the requirementsnow in § 820.70(c) to apply only whereenvironmental conditions could‘‘reasonably be expected to have anadverse effect on product quality.’’ Therequirements for procedures to ensurecontrol of conditions, periodicinspection of control systems, anddocumentation and review of results aresimilar to the original CGMPrequirements. However, the specific listof conditions to be considered forcontrol, which was carried over fromthe original CGMP regulation to theproposal, was deleted in response to acomment from the GHTF that the listwould be better suited for a guidancedocument. FDA agrees that it is notnecessary to give examples ofconditions that may need controlling ina regulation, and notes that lighting,ventilation, temperature, humidity, airpressure, filtration, airbornecontamination, and static electricity are

among many conditions that should beconsidered for control.

FDA reworded the requirement tomake it clear that the inspection must beof the control system. FDA also addedthat the inspection of the controlsystem(s) shall include ‘‘any necessaryequipment,’’ e.g., pumps, filters,measurement equipment, etc. Thesufficiency of facilities is covered in anew § 820.70(f), ‘‘Buildings,’’ thatrequires that buildings be of suitabledesign and contain sufficient space toallow for the proper manufacture ofdevices. Section 820.70(f) is wordedsimilarly to the original CGMPregulation § 820.40, and is intended toachieve the same objectives as thatsection.

127. One comment stated that the lastsentence of proposed § 820.70(b),‘‘Environmental control,’’ should bedeleted because it is redundant with theaudits required in § 820.22(a). Anothercomment said that environmentalconditions are currently reviewed viainternal audit, which an FDAinvestigator cannot review.

FDA disagrees with the comments.The inspection and review ofenvironmental control systems areroutine quality assurance functions thatare part of the production qualityassurance program. The audits requiredby § 820.22(a) are audits of the qualitysystem, conducted to ensure theadequacy of and conformance with thequality system requirements. Therequirement to conduct a quality auditis in addition to other provisions in theregulation which require that amanufacturer review its specificcontrols to ensure the requirements aremet. FDA may review the activities andresults of environmental control systeminspections.

128. The GHTF commented that therequirements of proposed § 820.70(c),‘‘Cleaning and sanitation,’’ should beplaced in guidance.

After careful consideration, FDAagrees that a separate section oncleaning and sanitation is unnecessary.The objective of proposed § 820.70(c) isadequately met through the requirementof § 820.70(e), ‘‘Contamination control,’’and § 820.70(a), the general processcontrol procedure requirement.Contamination control must includeestablishing and maintaining adequatecleaning procedures and schedules, ifsuch control is necessary to meetmanufacturing process specifications. Inaddition, § 820.25 Personnel requiresthat employees have a thoroughunderstanding of their job functions,which would include a requirement thatthe appropriate employees comprehend


the cleanliness and sanitationprocedures.

129. The GHTF and otherscommented that the requirements ofproposed § 820.70 (d)(1) through (d)(3)should be deleted and placed inguidance because they are redundantwith the first sentence in proposed§ 820.70(d), ‘‘Personnel health andcleanliness.’’

FDA agrees with the comments andhas deleted § 820.70 (d)(1) through(d)(3). FDA has also rewritten thesection, now entitled ‘‘Personnel,’’ torequire procedures to achieve thedesired result, rather than dictate themeans to achieve the result. The sectionas rewritten provides the manufacturerwith more flexibility and is consistentwith ISO/CD 13485. Under this section,a manufacturer’s requirements must notpermit unclean or inappropriatelyclothed employees, or employees withmedical conditions, to work withdevices where such conditions couldreasonably be expected to have anadverse effect on product quality. Theprocedures must also address acceptableclothing, hygiene, and personalpractices, if contact between personneland product or environment couldreasonably be expected to have anadverse effect on product quality.

FDA also added the requirement, fromISO/CD 13485, that personnel who areworking temporarily (such asmaintenance and cleaning personnel)under special environmental conditions(such as a clean room) be appropriatelytrained or supervised by someonetrained to work in such an environment.

130. One comment stated that therequirements of § 820.70(e),‘‘Contamination control,’’ should bedeleted and placed in guidance.Another comment stated that thereference to manufacturing materialsshould be deleted because it isredundant with § 820.70(g),‘‘Equipment.’’

FDA has rewritten the section todelete the specific references tocontaminants that probably gave rise tothe suggestion that the section would bemore appropriate as guidance. Thesection now contains a broadrequirement for the establishment ofprocedures to prevent contamination ofequipment or product by any substancethat could reasonably be expected tohave an adverse effect on productquality. Again, this revision addsflexibility.

FDA disagrees with the comment thatmanufacturing materials should bedeleted from this section. Section820.70(e) requires procedures to ensurethat manufacturing materials do notbecome contaminated. Section

820.70(g), in contrast, establishesrequirements related solely to theequipment used in the manufacturingprocess, and § 820.70(h),‘‘Manufacturing material,’’ addressesrequirements for the removal orlimitation of manufacturing materials.Thus, § 820.70 (g) and (h) are distinctand are intended to achieve differentobjectives.

131. The only two comments receivedon proposed § 820.70(f), ‘‘Sewage andrefuse disposal,’’ recommended that itbe deleted because it was unnecessaryand/or covered by other Federalregulations.

Section 820.70(f) has been deletedbecause the requirements are adequatelycovered in the current requirementsunder § 820.70(e), ‘‘Contaminationcontrol,’’ and § 820.70(c),‘‘Environmental control.’’ Under thesesections, sewage, trash, byproducts,chemical effluvium, and other refusethat could affect a device’s safety,effectiveness, or fitness-for-use must beadequately controlled.

132. Two comments stated that therequirement related to equipment in§ 820.70(g) should ensure thatequipment meets ‘‘specifiedrequirements,’’ not be ‘‘adequate for itsintended use,’’ because intended use isdetermined during the design phase,and because it is easier to assesswhether equipment meets specifiedrequirements.

From these comments, FDA can seethat the requirement should be revisedbecause it may have beenmisinterpreted. The requirement isreworded as suggested. Under therequirement, the equipment must beappropriately designed to facilitatemaintenance, adjustment, cleaning, anduse. It must also meet the requirementsthat are necessary to ensure its properfunctioning for the manufacture of thedevice.

133. A few comments stated that notall equipment requires maintenance,and the requirement for a maintenanceschedule in § 820.70(g)(1) should berevised to make that clear. The GHTFrecommended that the second sentenceof proposed § 820.70(g)(1), whichrequired that the maintenance schedulebe posted or readily available, bedeleted and placed in guidance.

FDA agrees that not all equipmentmay require maintenance and notes thatthe general requirement of § 820.70(a)requires process control procedures thatdescribe only those controls which arenecessary. Therefore, FDA did notrevise the requirement.

FDA has deleted the requirement thatthe maintenance schedule be posted orreadily available. Section 820.70(g),

which directs a manufacturer to ensurethat equipment meets specifiedrequirements, requires that themanufacturer ensure that maintenanceis carried out on schedule to complywith the requirement. To satisfactorilymeet this requirement, FDA expects thatthe schedule will be posted on or nearthe equipment to be maintained, orotherwise made readily available toappropriate personnel. Deletion of therequirement, however, permits themanufacturer added flexibility incomplying with this section.

134. Several comments stated that§ 820.70(g)(2), ‘‘Inspection,’’ and (g)(3),‘‘Adjustment,’’ should be deleted andplaced in guidance because therequirements are adequately covered in§ 820.70(g)(1). Another comment statedthat the requirement for limitations ortolerances to be ‘‘visibly posted on ornear equipment’’ should be deleted.

FDA believes that to adequatelyensure that equipment continues tomeet its specifications, and to ensurethat inherent limitations and allowabletolerances are known, theserequirements are imperative. FDA notesinherent limitations and allowabletolerances must be visibly posted on ornear equipment or made readilyavailable to personnel to allow themanufacturer the flexibility to utilizeany system to make sure that thelimitations or tolerances are readilyavailable to the personnel that needthem. Both § 820.70(g)(2) and (g)(3) arerequirements in the original CGMPregulation and the agency has foundthem to be useful and necessary.

135. One comment stated thatrequiring the removal of manufacturingmaterial to be documented in proposed§ 820.70(g)(4), ‘‘Manufacturingmaterial,’’ would result in impossiblerequirements, such as the requirementto document how much cutting oil islost during a metal removing operation,such as drilling. Others commented thatthe requirement needs to be amended toclarify that only manufacturingmaterials that have an adverse effect orthat are unwanted need to be removedor limited.

FDA disagrees with the first commentbecause § 820.70(g)(4) (now § 820.70(h))only requires that the fact thatmanufacturing material was removed orreduced be documented, not how muchwas removed or how much was lost dueto processing. This requirement iscarried over from the original CGMPregulation, § 820.60(d). FDA hasamended the section, however, to clarifythat this requirement is necessary‘‘Where a manufacturing material couldreasonably be expected to have anadverse effect on product quality.’’ FDA


purposefully qualifies the generalrequirement by that which adverselyaffects ‘‘product quality’’ (product asdefined in § 820.3(r)) and limits therequirement for removal or reduction to‘‘an amount that does not adverselyaffect the device’s quality.’’

136. One comment on § 820.70(h),‘‘Automated processes,’’ (now§ 820.70(i)), stated that the sectionshould be revised to reflect that softwareused in such systems must be validatedfor ‘‘its intended use,’’ not simplyvalidated. Another comment stated thatmost companies buy software currentlyavailable on the market and do not makechanges to the software. It wasrecommended that § 820.70(h) allow foruse of outside personnel for validationruns and not necessarily require thedevelopment of a software validationprocedure. One comment suggested thatthe section should allow verificationrather than validation of off-the-shelfsoftware. Several comments on‘‘automated processes’’ stated that theterm ‘‘data processing systems’’ wasunclear and its inclusion rendered therequirement too broad. Others asked forclarification of ‘‘automated dataprocessing systems.’’

FDA has modified the requirement tomandate validation for the intended useof the software. In addition, therequirement that the software bevalidated by individuals designated bythe manufacturer has also been deletedto make clear that validation may beperformed by those other than themanufacturer. However, whether themanufacturer designates its ownpersonnel or relies on outside assistanceto validate software, there must be anestablished procedure to ensurevalidation is carried out properly.

FDA has maintained the requirementfor validation because the agencybelieves that it is necessary thatsoftware be validated to the extentpossible to adequately ensureperformance. Where source code anddesign specifications cannot beobtained, ‘‘black box testing’’ must beperformed to confirm that the softwaremeets the user’s needs and its intendeduses.

FDA emphasizes that manufacturersare responsible for the adequacy of thesoftware used in their devices, andactivities used to produce devices.When manufacturers purchase ‘‘off-the-shelf’’ software, they must ensure that itwill perform as intended in its chosenapplication.

FDA has amended the requirement tostate ‘‘When computers or automateddata processing systems are used as partof production or the quality system,’’ forclarification. Software used in

production or the quality system,whether it be in the designing,manufacturing, distributing, or tracing,must be validated.

ii. Inspection, Measuring, and TestEquipment (§ 820.72)

137. A few comments stated that it isunclear what is meant by therequirement in proposed § 820.84Inspection, measuring, and testequipment that equipment be capable ofproducing ‘‘valid results.’’ Thecomments stated that such equipmentmay be ‘‘suitable for its intendedpurpose’’ and still not always ‘‘producevalid results.’’

FDA believes that the term ‘‘validresults’’ is commonly understood andnotes that it has been in the originalCGMP regulation under § 820.61 for 18years. The requirement is for theequipment to work properly, therebyproviding ‘‘valid results.’’

FDA renumbered § 820.84 as § 820.72in response to comments that statedthese requirements were moreappropriate under subpart G Productionand Process Controls. FDA revised therequirement in new § 820.72(a),‘‘Control of inspection, measuring, andtest equipment,’’ to make clear that theprocedures must also ensure that theequipment is maintained and moved therequirement that the procedure includeprovisions for handling, preservationand storage of equipment from§ 820.84(d) in the Working Draft to§ 820.72(a). FDA deleted the term ‘‘testsoftware’’ that was in § 820.84(e)because FDA believes that ‘‘testsoftware’’ is now covered under‘‘electronic inspection and testequipment’’ in § 820.72(a).

138. A few comments stated that thelast sentence in proposed § 820.84(a),‘‘Calibration,’’ is unnecessary becausethe requirement for trained personnel isredundant with § 820.25(a) Personnel. Afew comments stated that FDA shouldidentify what must be remedied inproposed § 820.84(a).

FDA agrees that the requirement fortrained personnel is redundant and hasdeleted this sentence from § 820.72(b),‘‘Calibration.’’ FDA has also added tothis section the requirement that thecalibration procedure includeprovisions for remedial action to‘‘reestablish the limits and to evaluatewhether there was any adverse effect onthe device’s quality’’ to clarify thisremedial action requirement and itsrelationship to the requirements in§ 820.100 Corrective and preventiveaction.

139. Several comments stated that§ 820.84(b), ‘‘Calibration standards,’’

should allow for the use of internationalstandards.

FDA agrees and has rewritten thesection, now § 820.72(b)(1), ‘‘Calibrationstandards,’’ to allow the use ofinternational standards. The standardsused must be generally accepted byqualified experts as the prevailingstandards.

140. FDA has deleted the requirementin proposed § 820.84(c), now§ 820.72(b)(2), ‘‘Calibration records,’’that calibration records be ‘‘maintainedby individuals designated by themanufacturer’’ because, on furtherreflection, the agency believes such arequirement is unnecessary. As long asthe required procedures and records aremaintained and displayed or readilyavailable as required, the objective ofthe section, ensuring that calibration isperformed and acceptable, will be met.FDA did add ‘‘equipmentidentification’’ to the list of items thathad to be documented in response to acomment that requested clarification inthis regard, so that equipment is clearlyidentified in the calibration recordseven if the records are not displayed onor near the particular piece ofequipment.

141. Two comments suggesteddeleting proposed § 820.84(d) becausethey believed it was unnecessary toestablish procedures to maintainequipment, because most manufacturerssimply store equipment in protectivecovers.

As already noted, FDA has moved therequirement for establishingmaintenance procedures into thegeneral requirement in § 820.72. FDAhas retained the requirement becausesome equipment requires specialhandling, preservation, and storage. Forexample, the temperature and humidityof a room may affect the equipment andprocedures would need to beestablished taking those factors intoaccount.

142. Several comments stated thatproposed § 820.84(e), ‘‘Facilities,’’should be deleted because it isredundant with the requirements under§ 820.70(g) and the general requirementsof proposed § 820.84(a).

FDA agrees that revised § 820.84(a),which is now § 820.72(a), would requireprocedures to ensure that equipment isprotected from adjustments that couldinvalidate the calibration, in that thesection requires procedures to ensurethat equipment is properly maintained.The procedures that require equipmentto be routinely calibrated, inspected,and checked, will also ensure thatimproperly calibrated equipment is notused. Therefore, FDA has deletedproposed § 820.84(e).


iii. Process Validation (§ 820.75)

143. A few comments on proposed§ 820.75 Special processes stated thatthe meaning of the term ‘‘specialprocesses’’ was unclear. Othercomments stated that FDA shouldprovide examples of processes thatwould be considered ‘‘specialprocesses.’’ Several comments stated theterm ‘‘fully verified’’ was unclear andshould be deleted.

In response to the comments, the term‘‘special processes’’ has been droppedfrom the regulation and the term‘‘process validation’’ is defined in§ 820.3(z)(1). The section now requiresthat when a process ‘‘cannot be fullyverified by subsequent inspection andtest, the process shall be validated witha high degree of assurance. * * *’’Examples of such processes includesterilization, aseptic processing,injection molding, and welding, amongothers. The validation method mustensure that predeterminedspecifications are consistently met. Thenew § 820.75, entitled ‘‘Processvalidation,’’ is consistent with ISO9001:1994, section 4.9, including theterminology ‘‘fully verified.’’ FDA doesnot believe this terminology is unclearsince it has been used in ISO 9001:1987and 1994 and explained in severalguidance documents.

FDA amended this section byremoving the requirement for thesignature of the individual(s)performing the process and placing thesignature requirement on the approvalof the validation where FDA believes itis more important and appropriate. FDAalso added that ‘‘where appropriate, themajor equipment validated’’ must bedocumented. Depending on the processthat is validated, it may be necessary todocument the person performing theprocess or the equipment or both inorder to have adequate controls on theprocess.

144. Several comments were receivedon proposed § 820.75(a)(1) through(a)(4) that stated that the requirementswere redundant with other parts of theregulation and should be modified ordeleted.

FDA disagrees with the commentsand believes that, due to the importanceof process validation and correctperformance of the validated process,the requirements are necessary. Therequirements have been rearranged inthe revised section.

145. Comments on the first sentenceof proposed § 820.75(b) stated that itwas unclear and unrealistic. Othercomments stated that the requirementfor continuous monitoring is notpractical or necessary.

In response to the comments, FDA hasrevised the requirements. Section820.75(b) applies to the performance ofa process after the process has beenvalidated. In contrast, § 820.75(a) relatesto the initial validation of the process.FDA deleted the term ‘‘continuous’’because the agency concurs thatmonitoring can be accomplished at adetermined interval and frequencydepending on the type of validatedprocess being monitored and controlled.FDA notes that the interval andfrequency should be periodicallyevaluated for adequacy, especiallyduring any evaluation or revalidationthat occurs in accordance with therequirements in new § 820.75(c).

New § 820.75(b)(1), which wasproposed § 820.75(c) of the WorkingDraft, requires that validated processesbe performed by a qualifiedindividual(s). FDA notes that§ 820.75(b)(1) is similar to therequirements under § 820.25 Personnelbut emphasizes that validated processesmust not only be performed bypersonnel with the necessary education,background, training, and experience fortheir general jobs but must be performedby personnel qualified for thoseparticular functions. Revised§ 820.75(b)(2), which was proposed§ 820.75(d) of the Working Draft,contains the amended documentationrequirements for validated processes, toinclude the monitoring and controlmethods and data. FDA notes that it isalways ‘‘appropriate’’ to document theequipment used in the process wherethe manufacturer uses differentequipment on different manufacturinglines. To investigate a problem with thedevice, the manufacturer will need toknow which equipment was used, sincethe problem could be with theequipment itself. The same holds truefor the individual(s) performing theprocess.

Section 820.75(c) containsrequirements on process revalidation inresponse to several comments andconcerns on when revalidation activitieswere necessary. FDA believes that thenew arrangement of § 820.75 shouldclarify the requirement.

H. Acceptance Activities (Subpart H)

i. Receiving, In-Process, and FinishedDevice Acceptance (§ 820.80)

146. One comment stated that theemphasis on testing and inspection inproposed § 820.80 completely ignoresthe quality goals, the benefit of requiringpurchasing controls, and statementsmade in the preamble of the proposalreflecting FDA’s negative opinion aboutmanufacturers relying solely on testing

and inspection. A few comments on theWorking Draft stated that ‘‘acceptanceactivities’’ should be defined asinspections, tests, or other verificationactivities so that the regulation does notrequire all of these activities but givesthe manufacturer the flexibility tochoose the appropriate method.

FDA agrees with the comments andhas replaced the term ‘‘inspection andtest’’ with ‘‘acceptance activities’’ in§ 820.80. Further, FDA now defines‘‘acceptance activities’’ to includeinspections, test, or other verificationactivities, such as supplier audits.

147. One comment stated thatrecordkeeping is a significant cost factorin the operation of a total qualitysystem, and that the revised CGMPregulation should not add cost throughduplication of documentation. Thecomment said recording all quantitativedata is inappropriate and of little value.

FDA agrees that unnecessaryduplication of documentation should beavoided. FDA believes that the qualitysystem regulation requires the minimumdocumentation necessary to ensure thatsafe and effective devices are designedand produced. FDA similarly believesthat maintaining records of results ofacceptance activities is imperative toensure that nonconforming product isnot inadvertently used or distributed.FDA has, however, deleted from§ 820.80(a) the requirement forrecording the results of inspections andtesting because § 820.80(e) requires thatthe results of acceptance activities berecorded. The requirement in§ 820.80(a) was therefore unnecessary.Further, the regulation does not specifyquantitative data but simply requiresthat the results be recorded. FDAbelieves that it is essential for themanufacturer to maintain records whichprovide evidence that the product hasgone through the defined acceptanceactivities. These records must clearlyshow whether the product has passed orfailed the acceptance activitiesaccording to the defined acceptancecriteria. Where product fails to passacceptance activities, the procedures forcontrol of nonconforming product mustbe implemented, to includeinvestigations where defined. If theacceptance records are not clear abouthow the product failed, then themanufacturer may end up duplicatingthe acceptance activities in order toperform appropriate investigations.

148. Several comments stated thatproposed § 820.80(b), ‘‘Receivinginspection and testing,’’ did not allowfor urgent use of incoming items. Thecomments said that urgent use shouldbe permitted if forward traceability ismaintained so that recall and


replacement is possible if the material issubsequently found to benonconforming. One comment statedthat the requirements in proposed§ 820.80(b) were too specific and did notallow flexibility.

FDA agrees in part with thecomments. FDA has permittedmanufacturers to use incoming itemsthat had not yet been proven acceptablefor use, provided that the manufacturermaintained control of the unapproveditems and could retrieve the productthat contained the unapproved itemsbefore distribution. Therefore, therequirement that product ‘‘shall not beused or processeduntil * * * verified’’ has been deletedfrom § 820.80(b), now entitled‘‘Receiving acceptance activities.’’However, FDA emphasizes that whilethe product can be used in productionprior to verification, it cannot bedistributed prior to verification. FDAdoes not permit the distribution ofunapproved product through an urgentuse provision, because all finisheddevices must comply with § 820.80(d),‘‘Final acceptance activities,’’ beforethey are released for distribution.

In addition to the changes notedabove, FDA has deleted the requirementthat ‘‘individual(s) designated by themanufacturer shall accept or rejectincoming’’ product. FDA does notbelieve this requirement is necessary in§ 820.80(b) because § 820.80(e) requiresthat the identification of theindividual(s) conducting the acceptanceactivities be recorded.

149. Several comments stated that anabsolute requirement under proposed§ 820.80(c), ‘‘In-process inspection andtesting,’’ for in-process testing wasinconsistent with the preamble, whichstated that an appropriate mix ofcontrols should be established. Othercomments stated that in-processinspection and testing is unnecessary ifthe process is validated and the devicesare subject to final inspection. A fewcomments on the Working Draft statedthat the term ‘‘held’’ was too restrictiveand was not consistent with therequirements and the preamblediscussion for § 820.80(b).

FDA agrees with the comments inpart, but believes that § 820.80 as nowwritten, with the inclusion of ‘‘whereappropriate,’’ does not mandate in-process inspection and testing. FDAacknowledges that in-processacceptance activities may not benecessary or possible for every device,for example, medical socks. Further, therequirement states that in-processproduct must be controlled until therequired inspection and test, or otherverification activities, have been

performed. This will permitmanufacturers to use, under definedconditions and procedures, product thathas not completed the acceptanceactivities described in § 820.80(b) and(c). This does not means thatmanufacturers can ignore therequirements in § 820.80(b) and (c)because these requirements must becompleted in order to comply with§ 820.80(d), which must be satisfiedbefore devices are released fordistribution.

150. FDA received a similar commenton proposed § 820.80(d), ‘‘Finalinspection and test,’’ which said that theprovision requires finished deviceinspection for all devices, withoutdefining what inspection is expected.The comment suggested that § 820.80(d)could be interpreted to require actualproduct inspection, which has beenshown to be ineffective as a means ofcontrolling product quality. Onecomment stated that signatures shouldnot be the only approved method foridentification of the individual(s)responsible for release. The commentstated that use of inspection stamps andinitials should be allowed.

FDA has rewritten § 820.80(d) torequire that manufacturers establish andmaintain procedures for finished deviceacceptance to ensure that eachproduction run, lot, or batch of finisheddevices meets specified requirements.Manufacturers have the flexibility tochoose a combination of methods,including finished device inspectionand test, provided such methods willaccomplish the required result.

FDA believes that it is important forthe person responsible for release tohave personally documented and datedthat release. This can be accomplishedthrough use of an inspection stamp, ifthe stamp is controlled as discussedabove under § 820.40 Documentcontrols. Therefore, FDA has retainedthe requirement for a signature.

151. Several comments on proposed§ 820.80(e), ‘‘Inspection and testrecords,’’ stated that manufacturersshould not be required to record the useof general equipment in inspection andtest records, because this requirementwould be burdensome to largemanufacturers who use many commonpieces of equipment. A few commentsstated that the record requirementsunder § 820.80(e) are overly prescriptiveand go well beyond ISO 9001’scomparable requirements. Thecomments stated that recordkeepingshould be specified by the manufacturerin the spirit of ISO 9001, and shouldinclude only the minimum recordsnecessary to show that finished device

inspections are performed in accordancewith established procedures.

FDA agrees that it may not benecessary to document every piece ofequipment used in acceptance activities.The requirement, renamed ‘‘Acceptancerecords,’’ now provides that equipmentused shall be documented ‘‘whereappropriate.’’ For some criticaloperations and testing, identification ofthe equipment used will be imperativefor proper investigations intononconforming product.

The requirements, as revised, aresimilar to those in ISO 9001:1994. Asdiscussed above, certain informationmust be captured on acceptance recordsfor the records to be useful in evaluatingnonconformance. Through many yearsof experience, FDA has determinedwhat it believes to be a minimumrequirement for these records. Section820.80(e) reflects that determination.

ii. Acceptance Status (§ 820.86)152. Several comments on proposed

§ 820.86, ‘‘Inspection and test status,’’stated that the section was not flexibleenough to allow identification of theinspection and test status of product byvarious means, because the requirementwas for the status to be ‘‘visible.’’ Onecomment questioned why ‘‘componentacceptance’’ was addressed separately.

FDA agrees that the inspection andtest status may be identified by anymethod that will achieve the result,which might include acceptablecomputerized identification, markings,etc. The section has been rewritten toreflect this intent, has been renamed‘‘Acceptance status,’’ and is nowconsistent with ISO 9001:1994. FDAalso agrees that ‘‘componentacceptance’’ is covered by‘‘manufacturing’’ and has deleted theterm.

153. FDA has deleted proposed§ 820.86(b) which required that recordsidentify those responsible for release ofthe product, because the agency believesthat the records required by § 820.80(e)will identify those responsible forrelease of product.

I. Nonconforming Product (Subpart I)154. FDA has rewritten § 820.90

Nonconforming product to utilize theterm ‘‘product’’ throughout, as definedin § 820.3(r), for both shorthandpurposes and consistency with ISO9001:1994.

155. One comment suggested deletingthe term ‘‘inadvertently’’ and adding theword ‘‘distributed’’ before ‘‘installed’’ in§ 820.90(a). Several written commentsand persons who testified at the Augustand September 1995 meetings statedthat § 820.90(a) should be written so


that it is not interpreted to requireinvestigations for everynonconformance. A few commentsstated that the term ‘‘provide for’’ wastoo broad and unclear. Other commentsstated that the requirement to ‘‘ensure’’nonconforming product was ‘‘not usedor distributed’’ was inconsistent withthe provisions in § 820.90(b) whichallowed for concessions under certaincircumstances. One comment stated thatthe requirement that personsresponsible for nonconforming productbe ‘‘notified’’ should be deleted becauseit is overly burdensome and not neededin all cases.

FDA has reworded the generalrequirement for procedures to controlnonconforming product and has deletedthe term ‘‘inadvertently.’’ FDA has alsoadded the requirement that theprocedures provide for the ‘‘evaluation’’of nonconforming product becauseevaluation is key to protecting againstrecurring nonconformance. Theaddition is consistent with ISO9001:1994.

FDA has further revised § 820.90 inresponse to the comments on theWorking Draft. First, the manufacturermust establish procedures to ‘‘control’’nonconforming product. Second, theprocedures shall ‘‘address theidentification, documentation,evaluation, segregation, and dispositionof nonconforming product,’’ whichgives the manufacturers the flexibility todefine how they are going to ‘‘control’’products that are nonconforming. Third,the evaluation process addressed in theprocedure ‘‘shall include adetermination of the need for aninvestigation.’’ Therefore, theprocedures will need to set forth themanufacturer’s SOP on wheninvestigations will take place andprovisions for trending and/ormonitoring the situation in the future.Fourth, FDA added ‘‘The evaluation andany investigation shall be documented,’’which would include the explanationsfor not performing investigations andhow nonconformances will be trendedand/or monitored. Further, the phrase‘‘is not used or distributed’’ has beendeleted to be consistent with§ 820.90(b).

FDA disagrees that the notificationrequirement should be deleted. Wheresome person or organization isresponsible for nonconformances, theymust be notified to ensure that futurenonconformances are prevented. Thisrequirement is also in ISO 9001:1994,section 4.13.1.

156. FDA has rewritten § 820.90(b)(1),‘‘Nonconformity review anddisposition,’’ to make clear that thesection requires procedures that define

the responsibility for review andauthority for disposition ofnonconforming product and that setforth the review and dispositionprocess. FDA believes that properdisposition of nonconforming product isessential for ensuring the safety andeffectiveness of devices. Manufacturershave made determinations thatnonconforming product may be usedwhich have resulted in defectivedevices being distributed. Thus,although it may be appropriate at timesto use nonconforming products, thedisposition process must be adequatelycontrolled.

The revision requires that dispositionand justification for concessions bedocumented. FDA believes that thejustification should be based onscientific evidence, which amanufacturer should be prepared toprovide upon request. Concessionsshould be closely monitored and notbecome accepted practice. This sectionis consistent with ISO 9001:1994,section 4.13.2.

Several comments on the WorkingDraft stated that the term ‘‘concession’’should be deleted because it isconfusing. FDA has rewritten thesentence to ensure the meaning of thisrequirement is clear. The sentence nowreads, ‘‘Documentation shall include thejustification for the use ofnonconforming product and thesignature of the individual(s)authorizing the use.’’

157. Several comments were receivedon proposed § 820.90(b)(2). Onecomment stated that the requirementshould allow for other types ofdisposition besides reprocessing. Onecomment suggested replacing the term‘‘reinspection’’ with ‘‘evaluation,’’ toallow for greater flexibility inverification methods. Many commentssuggested that the requirement foridentification of reprocessed productshould be deleted because they believedit would cause the consumer to foregopurchasing the product. Severalcomments requested that the term‘‘rework’’ be used instead of‘‘reprocessing’’ to harmonizeterminology with ISO standards.

FDA agrees in part with thecomments. FDA, as noted in thedefinition section, has substituted theterm ‘‘rework’’ and the ISO 8402:1994definition for the term ‘‘reprocessing’’ inresponse to the comments. FDA believesthat the revised § 820.90(b)(1) clearlyallows for other methods of dispositionbesides rework. Section 820.90(b)(2),which governs rework when it is chosenas a method of disposition, has beenrevised as requested by replacing theterm ‘‘reinspection’’ with

‘‘reevaluation.’’ The change will allowmanufacturers the flexibility to inspector use other verification activities.

FDA has also deleted the requirementfor identification of reworked productfrom this section because FDA believesthat it is adequately covered in§§ 820.60 Identification and 820.86Acceptance status.

Other minor changes made to thesection include requiring that adetermination of any adverse effect ofthe rework upon the product be made,whether there is ‘‘repeated’’ rework ornot. FDA’s intent is that such adetermination be made with anyrework, given the potential harmfuleffect rework could have on the product.The change harmonizes § 820.90 withISO/CD 13485. In addition, the sentencerequiring a ‘‘complete reinspection’’ forreworked product was deleted becausethe section already requires retestingand reevaluation of reworked product.FDA has also substituted ‘‘current’’ for‘‘original or subsequently modified’’approved specifications for clarity. Therequirements as written are consistentwith the original CGMP requirements in§§ 820.115 and 820.116.

J. Corrective and Preventive Action(Subpart J)

158. A few comments suggestedrevising proposed § 820.100 Correctiveand preventive action to requireprocedures for implementing correctiveand preventive action, consistent withISO 9001. One comment stated that theprocedures should provide for an initialhalt of distribution of suspect productsor tight control and action concerningproducts already distributed beforetaking the long term action listed in thissection.

FDA agrees that it is essential that themanufacturer establish procedures forimplementing corrective and preventiveaction and has revised § 820.100(a)accordingly. The procedures mustinclude provisions for the remainingrequirements in the section. Theseprocedures must provide for control andaction to be taken on devicesdistributed, and those not yetdistributed, that are suspected of havingpotential nonconformities.

159. Other comments stated that thedegree of remedial action should becommensurate with the risk associatedwith a product failure.

FDA agrees that the degree ofcorrective and preventive action takento eliminate or minimize actual orpotential nonconformities must beappropriate to the magnitude of theproblem and commensurate with therisks encountered. FDA cannot dictatein a regulation the degree of action that


should be taken because eachcircumstance will be different, but FDAdoes expect the manufacturer to developprocedures for assessing the risk, theactions that need to be taken fordifferent levels of risk, and how tocorrect or prevent the problem fromrecurring, depending on that riskassessment.

FDA emphasizes that any death, evenif the manufacturer attributes it to usererror, will be considered relevant byFDA and will have a high riskpotentially associated with it. User erroris still considered to be a nonconformitybecause human factors and other similartools should have been consideredduring the design phase of the device.FDA acknowledges that a manufacturercannot possibly foresee every singlepotential misuse during the design of adevice, but when the manufacturerbecomes aware of misuse, the correctiveand preventive action requirementsshould be implemented to determine ifredesign of the device or labelingchanges may be necessary.

160. Several comments on proposed§ 820.100(a)(1) stated that requiring amanufacturer to analyze ‘‘all’’ processes,work operations, and other factorslisted, is excessive and unrealistic.Some comments stated that there shouldnot be a requirement to conduct ananalysis for ‘‘potential causes’’ ofnonconformances. A few commentsstated that including ‘‘quality audits’’ inthe list was inconsistent with the FDApolicy of not reviewing internal audits.A few comments stated that therequirement that the analysis include‘‘trend analysis’’ should be modifiedbecause it places unnecessary emphasison only one statistical method or tool.Other comments stated that statisticaltools are not always necessary and thatthe requirement should be modified.

FDA agrees in part with thecomments. It was not FDA’s intent torequire that processes unrelated to anexisting nonconformity be analyzed.Instead, § 820.100(a)(1) requires ananalysis of those items listed that couldbe related to the problem. To preventconfusion, the word ‘‘all’’ has beendeleted. The requirement is similar tothat of ISO 9001:1994, section 4.14.3(a).

The inclusion of ‘‘quality audits’’ as avaluable feedback mechanism for themanufacturer does not conflict withFDA’s policy of not reviewing internalquality audits. Internal audits arevaluable and necessary tools for themanufacturer to evaluate the qualitysystem. The audit reports should beused to analyze the entire qualitysystem and provide feedback into thesystem to close the feedback loop, sothat corrective or preventive actions can

be taken where necessary. FDA willreview the corrective and preventiveaction procedures and activitiesperformed in conformance with thoseprocedures without reviewing theinternal audit reports. FDA wants tomake it clear that corrective andpreventive actions, to include thedocumentation of these activities, whichresult from internal audits andmanagement reviews are not coveredunder § 820.180(c).

FDA has further revised therequirement to delete the reference totrend analysis in response to thecomments. The provision now requiresthat ‘‘appropriate statisticalmethodology’’ be employed wherenecessary to detect recurring qualityproblems. This revision is made becausethere may be other statistical toolsavailable beyond ‘‘trend analysis.’’ FDAemphasizes that the appropriatestatistical tools must be employed whenit is necessary to utilize statisticalmethodology. FDA has seen far too oftenthe misuse of statistics by manufacturersin an effort to minimize instead ofaddress the problem. Such misuse ofstatistics would be a violation of thissection.

FDA has retained the requirement foranalysis to identify ‘‘potential causes ofnonconforming product,’’ however,because FDA believes this is animportant aspect of preventive action.FDA notes that ISO 9001:1994, section4.14.1, specifically acknowledges thatcorrective and preventive actions areassociated with actual and potentialnonconformities.

161. Several comments stated thatproposed § 820.100(a)(2) was redundantwith requirements in § 820.198Complaints.

FDA agrees in part with the commentsand has written the section to requireinvestigation of the cause ofnonconformities relating to process,product, and the quality system,consistent with ISO 9001:1994, section4.14.2(b). The requirement in thissection is broader than the requirementfor investigations under § 820.198,because it requires that nonconformingproduct discovered before or afterdistribution be investigated to thedegree commensurate with thesignificance and risk of thenonconformity. At times a very indepthinvestigation will be necessary, while atother times a simple investigation,followed by trend analysis or otherappropriate tools will be acceptable. Inaddition, in contrast to § 820.198, therequirement in this section applies toprocess and quality systemnonconformities, as well as productnonconformities. For example, if a

molding process with its knowncapabilities has a normal 5 percentrejection rate and that rate rises to 10percent, an investigation into thenonconformance of the process must beperformed.

162. One comment stated thatproposed § 820.100(a)(3) should notrequire identification of actionnecessary to correct ‘‘other qualityproblems.’’ Another stated that thesection should be harmonized with ISO.One comment thought that therequirement should be to identify actionto correct problems identified by ‘‘trendanalysis.’’

FDA agrees that harmonization isimportant and has harmonized theterminology (and intent) of the sectionwith ISO 9001:1994, sections 4.14.2(c)and 4.14.3(b). However, FDA disagreesthat the section should not requireidentification of action necessary tocorrect ‘‘other quality problems’’because the objective of § 820.100 is tocorrect and prevent poor practices, notsimply bad product. Correction andprevention of unacceptable qualitysystem practices should result in fewernonconformities related to product.Therefore, this section addressesproblems within the quality systemitself. For example, it should identifyand correct improper personneltraining, the failure to followprocedures, and inadequate procedures,among other things.

FDA also disagrees with thesuggestion to link the requirement in§ 820.100(a)(3) to trend analysis and hasdeleted the reference to trend analysisin § 820.100(a)(1) to give themanufacturer the flexibility to usewhatever method of analysis isappropriate.

163. FDA has revised § 820.100(a)(4)to reflect that preventive, as well ascorrective, action must be verified orvalidated. The section is now consistentwith ISO 9001:1994, sections 4.14.2(d)and 4.14.3(c). Two comments stated thatthe definitions of validation andverification cause confusion here, butFDA believes that these concerns shouldbe resolved with the amendeddefinitions under § 820.3 (z) and (aa).

164. FDA has also revised§ 820.100(a)(5) in the same manner, torelate the requirements to preventiveaction. This section is consistent withISO 9001:1994, section 4.14.1, thirdparagraph.

165. One comment suggested thatproposed § 820.100(a)(6) be revised toreflect that minor quality problems maynot need to be disseminated to thosedirectly responsible for ensuring qualityand to be reviewed by management.


FDA agrees in part with thiscomment. The revised § 820.100 (a)(6)and (a)(7) require that proceduresensure that information is disseminatedto those directly responsible for assuringquality or the prevention of suchproblems, and provide for submittingrelevant information on identifiedquality problems, as well as correctiveand preventive actions, for managementreview. This revision should address theconcern raised by the comment becauseonly certain information need bedirected to management. Themanufacturer’s procedures shouldclearly define the criteria to be followedto determine what information will beconsidered ‘‘relevant’’ to the actiontaken and why. FDA emphasizes that itis always management’s responsibilityto ensure that all nonconformity issuesare handled appropriately. This sectionis now consistent with ISO 9001:1994,section 4.14.3(d).

166. Two comments stated that therecords required under § 820.100(b)should be treated as part of the internalaudit.

FDA disagrees with these commentsbecause this information is directlyrelevant to the safety and effectivenessof finished medical devices. FDA hasthe authority to review such records andthe obligation to do so to protect thepublic health. Comparable informationand documentation is reviewed by theFDA under the requirements of theoriginal CGMP, §§ 820.20 (a)(3) and(a)(4) and 820.162. Manufacturers willbe required to make this informationreadily available to an FDA investigator,so that the investigator may properlyassess the manufacturer’s compliancewith these quality system requirements.

K. Labeling and Packaging Control(Subpart K)

i. Device Labeling (§ 820.120)167. Several comments on proposed

§ 820.162 Device labeling stated that thesection should be deleted and placed inguidance because it is unnecessary andredundant with requirements under§§ 820.80 and 820.86. A few commentsstated that the section should bechanged to be the same as that in theoriginal CGMP regulation, under§§ 820.120 and 820.121. Anothercomment stated that labeling andpackaging requirements should be insubpart K of part 820 and handling,storage, distribution, and installationrequirements should be in subpart L ofpart 820 because labeling and packagingfunctionally occur before distributionand installation.

FDA believes that the section, aswritten, is consistent with the

requirements in the original CGMP.Section 820.120 relates specifically tolabeling and its requirements are inaddition to those in both §§ 820.80 and820.86. Further, FDA believes that thedegree of detail in this section isnecessary because these samerequirements have been in place for 18years, yet numerous recalls every yearare the result of labeling errors ormixups. FDA therefore believes thatmore, not less, control is necessary.

FDA has reordered the subparts butnotes that the handling and storagerequirements apply throughout theproduction process.

168. One comment stated that ‘‘tomaintain labeling integrity and toprevent labeling mixups’’ should bedeleted from the general requirementbecause the requirements are detailed inthe following sections. Other commentsstated that all labels need not be affixedto the device and others stated that‘‘legible and affixed’’ may not beappropriate for all implantable devices.

FDA agrees with the comments andhas revised the requirementsaccordingly.

169. A few comments stated that whatis now § 820.120(b), ‘‘Labelinginspections,’’ should allow automatedreaders to be used in place of a‘‘designated individual(s)’’ to examinethe labeling.

FDA disagrees with the commentsbecause several recalls on labeling havebeen attributed to automated readers notcatching errors. The requirement doesnot preclude manufacturers from usingautomated readers where that process isfollowed by human oversight. A‘‘designated individual’’ must examine,at a minimum, a representativesampling of all labels that have beenchecked by the automated readers.Further, automated readers are oftenprogrammed with only the base labeland do not check specifics, such ascontrol numbers and expiration dates,among other things, that are distinct foreach label. The regulation requires thatlabeling be inspected for these itemsprior to release.

170. FDA has amended § 820.120(b) toadd ‘‘any’’ to additional processinginstructions in response to a commentfor clarity. FDA has amended§ 820.120(d) to include ‘‘The label andlabeling used for each production unit,lot, or batch shall be documented in theDHR’’ in response to commentsquestioning whether the labeling usedshould be recorded in the DMR or theDHR. FDA also amended § 820.120(e) byadding ‘‘or shall accompany the devicethrough distribution’’ and deleting‘‘itself or its label’’ for clarity.

171. A few comments on proposed§ 820.165 Critical devices, labelingstated that this section should bedeleted to eliminate any distinctionbetween critical and noncritical devices.

FDA agrees in part and has deleted§ 820.165, but has added therequirement on control numbers to§ 820.120(e).

ii. Device Packaging (§ 820.130)

172. Two comments on proposed§ 820.160 Device packaging stated thatthe section should be changed to allowmanufacturers to use third parties, ifdesired, for packaging. Anothercomment stated that it is very difficultif not impossible to protect fromintentional damage, such as tampering.

FDA agrees with the comments andhas changed the requirement, now in§ 820.130, accordingly. FDA believes,however, that any intentional tamperingwould not be covered because therequirement states ‘‘during customaryconditions.’’

L. Handling, Storage, Distribution, andInstallation (Subpart L)

i. Handling (§ 820.140)

173. One comment on proposed§ 820.120 Handling suggested that theprocedures be ‘‘designed to prevent,’’rather than be established to ‘‘ensurethat,’’ problems delineated in thesection do not occur. The commentstated that the word ‘‘prevent’’ wouldadd clarity, without compromising themeaning of the sentence. Anothercomment stated that the handlingprocedures should apply ‘‘prior todistribution,’’ not during ‘‘any stage ofhandling.’’ One comment stated that therequirement does not cover the need forspecial precautions in handling useddevices which may be contaminated,and that this is an important issuecovered by ISO/CD 13485.

FDA does not believe that § 820.120,now § 820.140, as written is unclear.The procedures are expected to ensurethat mixups, damage, deterioration,contamination, or other adverse effectsdo not occur. FDA amended therequirement, however, to remove ‘‘anystage of’’ so it reads ‘‘during handling.’’The requirement continues to apply toall stages of handling in which amanufacturer is involved, which may insome cases go beyond initialdistribution.

The comparable provision in ISO/CD13485 states, ‘‘If appropriate, specialprovisions shall be established,documented and maintained for thehandling of used product in order toprevent contamination of other product,the manufacturing environment and


personnel.’’ FDA agrees with thisrequirement and has therefore added theterm ‘‘contamination’’ to §§ 820.140Handling and 820.150 Storage.

ii. Storage (§ 820.150)174. Two comments stated that

proposed § 820.122 Storage should beamended to be similar to ISO 9001, andthat the rest of the requirements shouldbe deleted and included in a guidancedocument. One comment stated that theterm ‘‘obsolete’’ should be deletedbecause, although a device may nolonger be sold, thereby making itobsolete, the components for that devicemay still be stored for customer supportof the existing devices.

FDA agrees that § 820.122, now§ 820.150, could be more consistentwith ISO 9001 and has revised thesection to harmonize with ISO9001:1994. FDA has not deleted theterm ‘‘obsolete.’’ FDA understands thata device may no longer be sold, but thatparts and subassemblies may still berequired for customer support;therefore, those components orsubassemblies are not ‘‘obsolete.’’ FDA’sintent in this requirement is to ensurethat only the appropriate product beused or distributed.

FDA has deleted the requirement thatcontrol numbers or identifications belegible and visible because it believesthe requirement is inherent in§ 820.150(a), which requires themanufacturer to establish procedures toprevent mixups. To do this, amanufacturer must ensure that productcan be properly identified.

175. A comment stated that restrictingaccess to designated areas through theuse of keys, bar code readers, or othermeans, should be sufficient to meet theintent of the requirement in proposed§ 820.122(b), without the need forwritten procedures for authorizingreceipt.

FDA has not deleted the requirementfor procedures, now in § 820.150(b), toauthorize receipt of product because theagency believes that strict control overproduct in storage areas and stockrooms results in decreased distributionof nonconforming product. Thus, evenwhere locked storage rooms are utilized,the procedures should detail, amongother things, who is permitted accessand what steps should be followed priorto removal.

iii. Distribution (§ 820.160)176. A few comments on proposed

§ 820.124 Distribution stated that thereare times when ‘‘first in, first out’’inventory procedures may not be in thebest interest of the customer. Thecomments said that especially when

expiration dating is defined and labeled,a ‘‘first in, first out’’ system should notbe required. The GHTF and other EUcomments stated that if a new section‘‘Contract review,’’ similar to ISO9001:1994, section 4.3 was not added tothe regulation, the requirement that‘‘purchase orders are reviewed to ensurethat ambiguities and errors are resolvedbefore devices are released fordistribution’’ should be added to thissection.

FDA agrees with the comments. FDAhas amended the requirement in§ 820.160 to state that the proceduresmust ensure that ‘‘expired devices ordevices deteriorated beyond acceptablefitness for use’’ are not distributed. FDAhas also added the sentence onreviewing purchase orders.

177. A few comments on proposed§ 820.124(b) stated that class I devicesshould be exempt, or that therequirement should apply only tocritical devices, because all devices donot require control numbers. Othercomments stated that the term‘‘consignee’’ should be defined, or theword ‘‘primary’’ should be added before‘‘consignee’’ for clarity.

FDA agrees in part with the commentsand in § 820.160(b) has added the term‘‘initial’’ before ‘‘consignee’’ to makeclear that the requirement formaintaining distribution recordsextends to the first consignee. FDA hasretained the word ‘‘consignee’’ andnotes that it is a person to whom thegoods are delivered. FDA has alsoclarified § 820.160(b)(4) by requiring‘‘Any control number(s) used.’’Therefore, if the manufacturer isrequired by § 820.65 to have controlnumbers, these must be recorded alongwith any control numbers voluntarilyused. Logically, control numbers areused for traceability so they should berecorded in the DHR distributionrecords. FDA disagrees, however, thatthe requirement to maintain distributionrecords should not apply to class Idevices. The information required bythis section is basic information neededfor any class of product in order toconduct recalls or other correctiveactions when necessary.

iv. Installation (§ 820.170)

178. Several comments received onproposed § 820.126, Installation statedthat not all devices require installation.Several comments on the Working Draftasked that, ‘‘The results of theinstallation inspection shall be madeavailable to FDA upon request’’ bedeleted because this was redundantwith FDA’s access to these documentsunder § 820.180.

FDA agrees with the first set ofcomments. As discussed in § 820.1, theinstallation requirements only apply todevices that are capable of beinginstalled. However, to further clarify therequirements in § 820.170, FDA hasmade clear that the requirement appliesto ‘‘devices requiring installation.’’ FDAalso agrees that the sentence ondocument availability is redundant with§ 820.180 for all records and has deletedthe sentence.

179. Several comments raised theissue of applying the regulationrequirements to third party installers.

FDA has rewritten § 820.170. Personswho install medical devices have beenregulated under the original CGMPunder § 820.3(k) which describes amanufacturer as one who ‘‘assembles orprocesses a finished medical device,’’and continue to be regulated under thisquality system regulation under§ 820.3(o). Section 820.152 Installationof the original CGMP discussed themanufacturer or its authorizedrepresentative and persons other thanthe manufacturer’s representative. Thisregulation eliminates that terminology.Under the revised requirement in§ 820.170(a), the manufacturerestablishes installation and inspectioninstructions, and where appropriate testprocedures. The manufacturerdistributes the instructions andprocedures with the device or makesthem available to person(s) installingthe device. Section 820.170(b) requiresthat the person(s) installing the devicefollow the instructions and proceduresdescribed in § 820.170(a) and documentthe activities described in theprocedures and instructions todemonstrate proper installation.

The revised provisions in § 820.170(b)explicitly require that the installation beperformed according to themanufacturer’s instructions, regardlessof whether the installer is employed byor otherwise affiliated with themanufacturer. Section 820.170(b)requires records to be kept by whomeverperforms the installation to establishthat the installation was performedaccording to the procedures. Suchrecords will be available for FDAinspection. FDA does not expect themanufacturer of the finished device tomaintain records of installationperformed by those installers notaffiliated with the manufacturer, butdoes expect the third party installer orthe user of the device to maintain suchrecords.

FDA believes that making theserequirements explicit in the regulationis necessary to ensure that devices aresafe and effective, and that they performas intended after installation. FDA notes


again that installers are considered to bemanufacturers under the original CGMPregulation and that their records are,and will continue to be, subject to FDAinspections when the agency deems itnecessary to review such records.

M. Records (Subpart M)

i. General Requirements (§ 820.180)180. Several comments under

§ 820.180 General requirementssuggested that FDA delete therequirement that records be stored toallow ‘‘rapid retrieval’’ because areasonable time frame should beallowed. One comment stated that thewording of the section needed to beamended to allow records to be locatedin different places, especially for foreignmanufacturers and distributors. Twocomments stated that the requirementshould be qualified by ‘‘subject toconflicting legal requirements in othercountries’’ because some countries have‘‘blocking statutes’’ that would prohibitthe release of some information. Onecomment stated that wherever the word‘‘all’’ appeared in the requirements,FDA should remove it.

FDA has rearranged this section, andnotes that records must be kept in alocation that is ‘‘reasonably accessible’’to both the manufacturer and FDAinvestigators, and that records must bemade ‘‘readily available.’’ FDA expectsthat such records will be made availableduring the course of an inspection. If theforeign manufacturer maintains recordsat remote locations, such records wouldbe expected to be produced by the nextworking day or 2, at the latest. FDA hasclarified that records can be kept atother than the inspected establishment,provided that they are made ‘‘readilyavailable’’ for review and copying. Thisshould provide foreign manufacturersand initial distributors the necessaryflexibility.

FDA has not qualified § 820.180 inresponse to the comments on the‘‘blocking statues’’ because ifmanufacturers want to import medicaldevices into the United States, then theymust comply with applicable statutoryand regulatory requirements, includingpart 820. The records section of thisregulation is essentially the same as thatof the original CGMP and FDA has notfound these ‘‘blocking statutes’’ topresent a problem. Further, countriesincreasingly realize the importance of aglobal market, thus FDA does notanticipate this issue to be a problem inthe future.

In response to the comment on theterm ‘‘all’’, FDA notes that where arequirement exists for ensuring thatrecords are maintained in a certain

fashion, a manufacturer must keep allrecords subject to the regulation in thatmanner. The revised section makes clearthat it is ‘‘all records required’’ by theregulation to which the section’srequirements pertain.

181. A few comments on § 820.180(b),‘‘Record retention period,’’ stated thatthe section should be amended becauseall quality records may not be tied to aspecific device; therefore, such qualityrecords may not need to be maintainedover the lifetime of a device. A fewcomments stated that the retentionperiod requirement is unclear andburdensome, while others stated thatthe period should be left to themanufacturer to define. One commentsuggested the deletion of therequirements related to photocopyingrecords in proposed § 820.180(b)because it is technology that is notnecessarily being used.

FDA believes that all records shouldbe retained for a period equivalent tothe design and expected life of thedevice, but in no case less than 2 years,whether the records specifically pertainto a particular device or not. Therequirement has been amended to makeclear that all records, including qualityrecords, are subject to the requirement.FDA believes this is necessary becausemanufacturers need all such recordswhen performing any type ofinvestigation. For example, it may bevery important to access the wording ofa complaint handling procedure at thetime a particular complaint came inwhen investigating a trend or a problemthat extends to several products or overan extended period of time. Further,FDA does not believe that allowing themanufacturer to define the retentionperiod will serve the public’s bestinterest with regard to safety concernsand hazard analysis.

In response to the comment onphotocopying, FDA has deleted the lasttwo sentences. The agency believes thatthis requirement is outdated and doesnot necessarily reflect the technologybeing utilized today. Section 820.180requires that records be readily availablefor inspection and copying by FDA, andFDA will interpret ‘‘copying’’ to includethe printing of computerized records, aswell as photocopying.

182. One comment on proposed§ 820.180(c) stated that all quality auditreports should be subject to FDA reviewand public disclosure. A few othercomments stated that for a managementrepresentative to certify that ‘‘correctiveaction has been taken’’ would bedifficult because some corrective actionsare long term and may not be completedat the time of certification.

FDA disagrees with the comment thatquality audit reports should be subjectto FDA review for the reasons given inthe preamble of the original CGMPregulation, published in the FederalRegister on July 21, 1978 (43 FR 31508),and believes that the disclosure of theaudit reports themselves would becounterproductive to the intent of thequality system. FDA has added§ 820.180(c), ‘‘Exceptions,’’ to addresswhich records FDA, as a matter ofpolicy, will not request to review orcopy during a routine inspection; suchrecords include quality audit reports.FDA may request an employee inmanagement with executiveresponsibility to certify in writing thatthe management reviews, quality audits,and supplier audits (where conducted)have been performed, among otherthings. FDA may also seek production ofthese reports in litigation underapplicable procedural rules or byinspection warrant where access to therecords is authorized by statute. Again,FDA emphasizes that its policy ofrefraining from reviewing these reportsextends only to the specific reports, notto the procedures required by thesections or to any other qualityassurance records, which will be subjectto review and copying.

FDA agrees with the comments on thetiming of corrective actions and hasamended the certification requirementto state ‘‘corrective action has beenundertaken.’’

ii. Device Master Record (DMR)(§ 820.181)

183. A few comments on proposed§ 820.181 Device master record statedthat the requirement for a ‘‘qualified’’individual to prepare the DMR shouldbe deleted because it is unclear orredundant with the requirements in§ 820.25.

FDA has not deleted the requirementfor the DMR to be prepared, dated, andapproved by a qualified individualbecause the agency believes this isnecessary to assure consistency andcontinuity within the DMR. The sectionis consistent with the original CGMP,§ 820.181. FDA has, however,substituted the phrase ‘‘prepared andapproved in accordance with § 820.40’’to be consistent with the requirementsalready in § 820.40 and to eliminate anyredundancy.

184. Two comments on § 820.181(a)stated that ‘‘software designspecifications’’ should not be includedin the DMR because these documentswill be located in the DHF. Anothercomment requested that the requirementthat the DMR contain ‘‘software sourcecode’’ information be amended because


source codes for commercializedsoftware will not be available to thedevice manufacturers. Anothercomment stated that the source codeshould not be in the DMR because itwill already be in the DHF.

FDA deleted the reference to‘‘software source code’’ because this isalready covered with the requirementfor ‘‘software specifications.’’ The finalsoftware specifications should betransferred into production. Therefore,the final software specification for theparticular device or type of deviceshould be located or referenced in theDMR, while any earlier version shouldbe located or referenced in the DHF.FDA believes that it is more importantfor manufacturers to construct adocument structure that is workable andtraceable, than to worry about whethersomething is contained in one file ascompared to another. The DMR is set upto contain or reference the proceduresand specifications that are current onthe manufacturing floor. The DHF ismeant to be more of a historical file forutilization during investigations andcontinued design efforts.

185. One comment on § 820.181(c)stated that the DMR should not containquality system documents, but ratherthe quality control documents related tothe specific device. Three commentsstated that validation and verificationinformation belongs in the DHF, not theDMR.

FDA agrees in part with the commentsand has revised the section to clarifythat the quality records required in theDMR relate to the specific currentdesign, not the more generalrequirements of the quality system,which are addressed under new§ 820.186. However, the comments areincorrect that all validation andverification information is related solelyto design. There are requirements forvalidation and verification pertaining todevice processing that may be betterkept in the DMR instead of the DHF.The documentation of such verificationand validation activities relating toprocesses that are performed for severaldifferent devices or types of devices canbe placed or referenced in the locationthat best suits the manufacturer. Again,it is more important that themanufacturer store and retrieveinformation in a workable manner, thankeep such information in particularfiles.

186. FDA notes that the regulationcontains a few requirements whichapply ‘‘where appropriate’’ or ‘‘atappropriate stages.’’ FDA emphasizesthat the procedures that themanufacturer places in the DMR mustclearly define the requirements the

manufacturer is following and whenparticular activities are appropriate. Themanufacturer will have failed to complywith the requirements of the section ifthe procedures simply state that thereview or activity occurs at ‘‘appropriatestages.’’

The same principle applies for everysection of this regulation, which iswritten to be flexible enough to coverthe manufacture of all types of devices.Manufacturers must adopt qualitysystems appropriate for their specificproducts and processes. In establishingthese procedures, FDA will expectmanufacturers to be able to providejustifications for the decisions reached.

iii. Device History Record (§ 820.184)187. One comment on § 820.184

stated that labeling should not berequired in the DHR because it isalready required in the DMR. Anothercomment stated that some devices have25 or more labels and that only theprimary identification labels arenecessary in the DHR. One commentstated the requirement should beamended because it explicitly requiresthat dates and quantities for each batchbe in the DHR, while only implyingthrough the general requirement that theDHR must also contain the batch testdata.

FDA agrees that it may not benecessary to include all labeling used inthe DHR. However, FDA continues tobelieve, as it explained in the preambleto proposed regulation published in theFederal Register on November 23, 1993(58 FR 61952 at 61968), that increasedcontrol over labeling is necessary due tothe many labeling errors resulting inrecalls. Therefore, FDA has retained arequirement related to labeling in theDHR, but revised it to make it lessburdensome. The requirement wasamended to ‘‘the primary identificationlabel and labeling’’ which is consistentwith that contained in the originalCGMP regulation, § 820.185. FDAbelieves that the requirement that theDHR contain the primary label andlabeling used for each production unit,coupled with the labeling controls in§ 820.120, should help to ensure thatproper labeling is used and, hopefully,decrease the number of recalls due toimproper labeling.

FDA agrees with the last commentand has added in § 820.184 ‘‘(d) Theacceptance records which demonstratethe device is manufactured inaccordance with the DMR’’ to explicitlystate the requirement to avoid anyconfusion.

188. FDA has deleted the requirementfor the DHR to be ‘‘readily accessibleand maintained by a designated

individual(s)’’ because it believes thatthe objective of that requirement is metthrough §§ 820.40 Document controlsand 820.180 General requirements.

FDA has also added ‘‘deviceidentification’’ to the requirement under§ 820.184(f) because it believes that anyidentification or control number usedshould be documented in the DHR tofacilitate investigations, as well ascorrective and preventive actions. FDAnotes that this provision does not addany requirement for identification ortraceability not already expressed in§§ 820.60 and 820.65.

iv. Quality System Record (§ 820.186)189. Several comments stated that the

regulation should more closelyharmonize with ISO 9001:1994. A fewcomments stated that the regulationshould include the requirements for aquality manual. One comment statedthat general quality system proceduresand instructions should not be requiredin the DMR because the DMR is devicespecific, and many quality systemprocedures are not tied to a particulardevice.

FDA agrees in part with thesecomments and has developed new§ 820.186 Quality system record. Thissection separates the procedures anddocumentation of activities that are notspecific to a particular type of devicefrom the device specific records.

v. Complaint Files (§ 820.198)190. Two comments on proposed

§ 820.198 Complaint files stated that therequirements were very detailed andthat much of the language should beplaced in a guidance document.

FDA disagrees with the comments.These requirements are essentially thesame as the original CGMP requirementsunder § 820.198, and 18 years ofexperience with these requirementsshows that many manufacturers still donot understand and properly handlecomplaints. Therefore, FDA believesthat the amount of detail in § 820.198 isappropriate and necessary. In an effortto make the requirements more clear,however, the section has beenreorganized to better illustrate howcomplaint information should behandled.

Section 820.198(a) sets forth thegeneral requirement for establishing andmaintaining a complaint handlingprocedure and includes a few items thatthe procedure needs to address. Section820.198(b) discusses the initial reviewand evaluation of the complaints inorder to determine if complaints are‘‘valid.’’ It is important to note that thisevaluation is not the same as acomplaint investigation. The evaluation


is performed to determine whether theinformation is truly a complaint or notand to determine whether the complaintneeds to be investigated or not. If theevaluation decision is not to investigate,the justification must be recorded.Section 820.198(c) then describes onesubset of complaints that must beinvestigated, but explains thatduplicative investigations are notnecessary. In cases where aninvestigation would be duplicative, areference to the original investigation isan acceptable justification for notconducting a second investigation.Section 820.198(d) describes anothersubset of complaints that must beinvestigated (those that meet the MDRcriteria) and the information that isnecessary in the record of investigationof those types of complaints. Section820.198(e) sets out the type ofinformation that must be recordedwhenever complaints are investigated.The information described in § 820.198(e)(1) through (e)(5) would most likelybe attained earlier in order to performthe evaluation in § 820.198(b). Thisinformation need not be duplicated inthe investigation report as long as thecomplaint and investigation report canbe properly identified and tied together.Section 820.198 (e)(1) through (e)(5) areconsidered to be basic informationessential to any complaint investigation.If there is some reason that theinformation described in § 820.198(e)cannot be obtained, then themanufacturer should document thesituation and explain the efforts made toascertain the information. This will beconsidered to be acceptable as long asa reasonable and good faith effort wasmade. For example, a single phone callto a hospital would not be consideredby FDA to be a reasonable, good faitheffort to obtain information. Section820.198(f) is the same as § 820.198(d) ofthe original CGMP, where themanufacturing facility is separate ordifferent from that of the formallydesignated complaint handling unit. Insuch cases, it is important that thefacility involved in the manufacturing ofthe device receive or have access tocomplaint and investigationinformation. In order to givemanufacturers the flexibility of usingcomputer or automated data processingsystems, the term ‘‘reasonablyaccessible,’’ from § 820.180, is used.Section 820.198(g) is the complaintrecordkeeping requirement fordistributors. In order to givemanufacturers the same flexibility asdescribed in § 820.198(f), FDA hasincluded ‘‘reasonably accessible’’ in§ 820.198(g).

Throughout § 820.198, when there isreference to the MDR regulation or tothe types of events that are reportableunder the MDR regulation, this sectionsimply refers to events or complaintsthat ‘‘represent an event which isrequired to be reported to FDA underpart 803 or 804 of this chapter.’’

191. A few comments on § 820.198(a)stated that the section should allow formore than one ‘‘formally designatedunit’’ to handle complaints, especiallyfor large corporations where it wouldnot be feasible or beneficial for alldivisions to have a single complainthandling unit. A few other commentsstated that § 820.198(a)(2) on oralcomplaints should be deleted because itis too subjective.

FDA disagrees with these comments.Large corporations may have differentcomplaint handling units for differentproduct types or differentmanufacturing establishments.However, there should be only oneformally designated complaint handlingunit for each product type orestablishment. If a corporation choosesto operate with different complainthandling units for products and/orestablishments, the manufacturer mustclearly describe and define its corporatecomplaint handling procedure to ensureconsistency throughout the differentcomplaint handling units. A system thatwould allow multiple interpretations ofhandling, evaluating, categorizing,investigating, and following up, wouldbe unacceptable. Each manufacturershould establish in its procedures whichone group or unit is ultimatelyresponsible for coordinating allcomplaint handling functions.

FDA also disagrees that therequirement that oral complaints bedocumented upon receipt should bedeleted. A December 1986 GeneralAccounting Office (GAO) report entitled‘‘Medical Devices; Early Warning ofProblems Is Hampered by SevereUnderreporting,’’ (Ref. 11) showed thatapproximately 83 percent of thehospitals report complaints orally. FDAbelieves that these oral complaints mustbe captured in the complaint handlingprocess.

192. FDA, as noted above, has addedto § 820.198(c) the phrase ‘‘unless suchinvestigation has already beenperformed for a similar complaint andanother investigation is not necessary’’to clarify that duplicative investigationsare not required if the manufacturer canshow that the same type of failure ornonconformity has already beeninvestigated.

193. Several comments on proposed§ 820.198(b), now § 820.198(d), statedthat the evaluation of complaints

pertaining to death, injury, or hazard tohealth should be removed from thissection because it is redundant with theMDR regulation. Several othercomments on § 820.198(b) stated thatcomplaints pertaining to death, injury,or hazard to health need not bemaintained separately, as long as theyare identified.

FDA disagrees that the requirementsare redundant, but believes that theyexpressly state what is expected in thehandling of this type of complaintinformation. The requirements havebeen moved to a separate section,§ 820.198(d).

FDA agrees with the second set ofcomments and has revised the section topermit such complaints to be ‘‘clearlyidentified.’’ This will give amanufacturer flexibility in choosing ameans of ensuring that these types ofcomplaints can be immediatelyrecognized and segregated for purposesof prioritizing and meeting otherrequirements.

FDA has substituted the term‘‘promptly’’ for the term ‘‘immediately’’to be more consistent with the newMDR regulation timeframes. FDA hasalso clarified that § 820.198 (d)(1)through (d)(3) are in addition to theinformation that must be recorded in§ 820.198(e).

194. A few comments on proposed§ 820.198 (c) and (d) stated that FDAshould make clear that some of therequirements will not always beapplicable. For example, the commentsstated that a record of corrective actioncannot be made if such action is notrequired, and is not taken.

Where corrective action is notnecessary and is not taken, it cannot bedocumented. The section was revised tomake that clear. As stated in thepreamble to the proposal (58 FR 61952at 61968), the manufacturer’sprocedures should clearly identify whencorrective action will be taken.

In addition, FDA combinedprovisions in § 820.198 (c) through (e) toeliminate redundancy and added therequirement that the records includeany device identification, as well ascontrol number used, to facilitatecorrective and preventive actions. FDAhas also deleted the term ‘‘written’’ in§ 820.198(e) to be consistent with FDA’sstatements on electronic and computersystems.

195. FDA deleted the requirements inproposed § 820.198(f) in response tocomments because it agrees that it is notnecessary to repeat the requirements ofthe MDR regulation in the qualitysystem regulation. Section 820.198(a)requires that all complaints be evaluatedto determine whether they are subject to


the requirements of the MDR regulationunder part 803 or 804.

196. A few comments on proposed§ 820.198(g), now § 820.198(f), statedthat duplicate records are not needed inthis age of computer systems, and thatthe requirement as written would becounterproductive.

FDA agrees with the comments andhas rewritten the section to allow thecomplaints and records of investigationto be reasonably accessible at theformally designated complaint unit andthe manufacturing site, where theselocations are distinct. A manufacturer’sprocedures must ensure that themanufacturing site is alerted tocomplaints concerning devicesproduced at that site.

197. Several comments on proposed§ 820.198(h), now § 820.198(g), statedthat the requirement is unnecessary,given that FDA can inspect a foreignmanufacturer that imports devices, andis burdensome.

FDA has revised the section to permitthe records to be reasonably accessible,similar to § 820.198(f), which shouldalleviate any burden. However, theagency must have access to theserecords in the United States.

198. Several comments on proposed§ 820.198 (i) and (j) stated that therequirements should be deleted becausethey are redundant with the MDRrequirements in part 803.

FDA disagrees that all of therequirements in § 820.198 (i) and (j) areredundant. The requirement thatprocedures ensure that complaints areprocessed uniformly and in a timelymanner, and evaluated to determinewhether they are reportable under part803 or 804, has been moved up to§ 820.198(a). These are basicrequirements for complaint handling. Ifthe complaint is determined to be of thetype subject to part 803 or 804, thoserequirements apply. The requirementsof parts 803 and 804 are not repeated inthis regulation. FDA has deleted§ 820.198(j).

N. Servicing (Subpart N)199. Numerous comments were

received on the servicing requirementsthat were proposed. Many of thesecomments dealt with competitive issuesbetween manufacturers that perform orcontract out their own servicing andthird party service organizations. Thecomments received, as well as therecommendations from the GMPAdvisory Committee, were split onmany issues. Therefore in thisregulation, FDA has chosen to codifyonly longstanding requirements forservicing performed by originalmanufacturers and remanufacturers.

The requirements in § 820.200 aresimilar to those in ISO 9001:1994, withsome supplemental requirements forclarification on monitoring servicereports, on the relationship of servicereports and complaints, and on the typeof information FDA believes is essentialin any service report. As describedabove in the definition section of thispreamble, a separate rulemaking willspecify and clarify the requirements forthird party service organizations.

200. Other comments on proposed§ 820.200(a) stated that it is impracticalto return a used device to its originalspecifications because a certain amountof wear and tear should be expected,without detriment to the safety andeffectiveness of the device. Severalcomments on § 820.200(a) stated thatthe term ‘‘records’’ should be replacedby ‘‘reports,’’ to be consistent with ISO9001.

FDA agrees and has revised therequirements in § 820.200(a) to besimilar to the requirements in ISO9001:1994 as recommended bycomments at the GMP AdvisoryCommittee meeting to require that theservicing instructions and proceduresensure that the device will meet‘‘specified requirements’’ for thedevice’s intended use. FDA is awarethat with use and age, a device may beserviced to function as intended, butmay not meet original specifications.

FDA agrees with the comments andhas modified the language in§ 820.200(b), (c), and (d) to use the term‘‘service reports.’’

201. A few comments on proposed§ 820.200(b), ‘‘Service reportevaluation,’’ questioned whether fullcorrective action was necessary forevery service report and whether servicecalls need to be handled as complaintsonly when there is a death, injury, orhazard to safety.

FDA has rewritten this section into§ 820.200(b) and (c) to clarify theagency’s intent and to use termsconsistent with those used in § 820.198.Section 820.200(b) now states that‘‘Each manufacturer shall analyzeservice reports with appropriatestatistical methodology in accordancewith § 820.100.’’ Full corrective actionmay not be required for every servicereport. However, if the analysis of aservice report indicates a high risk tohealth, or that the frequency of servicingis higher than expected, the remainderof the corrective and preventive actionelements are applicable, in accordancewith the corrective and preventiveaction procedures established under§ 820.100.

Section 820.200(c) provides that whena service report ‘‘represents an event

which must be reported to FDA underpart 803 or 804 of this chapter,’’ it isautomatically considered by FDA to bea complaint that must be handledaccording to § 820.198. FDA emphasizesthat this provision is not intended tolimit ‘‘complaints’’ to MDR reportableevents.

202. FDA has also added in§ 820.200(d) the requirements forrecording the name of the device, anydevice identification(s) and controlnumber(s) used, as well as test andinspection data, because FDA believessuch documentation in the servicereport will facilitate investigations. Thisadditional documentation provisiondoes not add any requirement foridentification or traceability not alreadyexpressed in §§ 820.60 and 820.65.Therefore, § 820.200(d) as amendedfocuses on the type of information thatshould be captured on the service reportinstead of where the information shouldbe sent.

O. Statistical Techniques (Subpart O)

203. FDA amended § 820.250(a) to beconsistent with the requirements in ISO9001:1994, section 4.20.

204. Several comments on§ 820.250(b) stated that the provision aswritten seems to require the use ofsampling plans, and that everymanufacturer does not necessarily usesampling plans. Another commentstated that sampling plans are not oftenused during reviews of nonconformities,quality audits, or complaints, and thatthese examples should, therefore, bedeleted. Two other commentsquestioned the meaning of ‘‘regularlyreviewed.’’

FDA’s intent was not to require theuse of sampling plans, but to requirethat where they are used, they should bewritten and valid. Section 820.250 wasrevised to make that clear. Samplingplans are not always required, but anytime sampling plans are used, they mustbe based on a valid statistical rationale.Further, FDA acknowledges that themost common use of sampling plans isduring receiving acceptance, and hasdeleted the examples. FDA has alsoclarified the review requirement bystating ‘‘to ensure that when changesoccur the sampling plans are reviewed.’’

VI. Summary of Changes From the July1995 Working Draft to the Final Ruleand Rationale

Note: Minor changes to improve grammar,readability, and clarity, as well as changes interminology and organization for the sake ofconsistency throughout the regulation, arenot listed.


A. Section 820.1 Scope1. Inserted sentence, ‘‘If a

manufacturer engages in only someoperations subject to the requirementsin this part, and not in others, thatmanufacturer need only comply withthose requirements applicable to theoperations in which it is engaged’’ forfurther clarification of the scope inresponse to many comments.

2. Amended sentence on componentmanufacturers to read, ‘‘This regulationdoes not apply to manufacturers ofcomponents or parts of finished devices,but such manufacturers are encouragedto use appropriate provisions of thisregulation as guidance’’ as a result of themany written comments and oraltestimony at the August and September1995 meetings.

3. Inserted sentence on how tointerpret the phrase ‘‘whereappropriate’’ in the regulation, asrecommended by the GMP AdvisoryCommittee. This sentence is consistentwith International Organization forStandards (ISO)/CD 13485—‘‘Application of Quality Systems toMedical Devices.’’

B. Section 820.3 Definitions4. Amended the definition of

Complaint by inserting ‘‘after it isreleased for distribution’’ in response tocomments for clarification and toharmonize with ISO/CD 13485.

5. Amended the definition ofComponent by deleting ‘‘packaging’’ forclarification that every piece ofpackaging is not necessarily acomponent, only the materials that arepart of the ‘‘finished, packaged, andlabeled device.’’

6. Amended the definition of Designoutput to clarify its relationship withthe Device Master Record.

7. Amended the definition of Designreview to delete ‘‘and propose thedevelopment of solutions’’ in order toallow the manufacturer the flexibility todetermine whom the appropriateperson(s) is to propose solutions.

8. Deleted the definition of End of lifein response to the many writtencomments and oral testimony at theAugust and September 1995 meetings.

9. Amended the definition ofManufacturer to delete componentmanufacturers and to remove the terms‘‘servicer’’ and ‘‘refurbisher.’’ Theobligations of servicers and refurbisherswill be addressed in a separaterulemaking later this year. The terms‘‘installation’’ and ‘‘remanufacturing’’were added to codify longstanding FDApolicy and interpretations of the originalCGMP regulation.

10. Amended the definition ofManufacturing material in response to

comments requesting clarification andseparation of examples.

11. Deleted the definition of Record toavoid confusion. Record will continueto be defined by the act and case law.

12. Removed the definition ofRefurbisher for reasons discussed inparagraph 28, section V.A. of thisdocument.

13. Inserted the definition ofRemanufacturer for reasons discussedin paragraph 28, section V.A. of thisdocument, and made the languageconsistent with that of the 510(k)provision and the PMA amendment/supplement requirements.

14. Changed the term Reprocessing toRework and adopted a definitionconsistent with ISO 8402 QualityManagement and Assurance VocabularyStandard in response to comments forcloser harmonization of terminology.

15. Removed the definition ofServicing, and Servicer which wasproposed to the GMP AdvisoryCommittee, for reasons discussed above.

16. Amended the definition ofValidation as recommended by the GMPAdvisory Committee for further clarityby delineating the terms validation,process validation, and designvalidation.

17. Amended the definition ofVerification for further clarity inresponse to comments and to moreclosely harmonize with ISO 8402.

C. Section 820.5 Quality System

18. Deleted the requirements in§ 820.5(a) and (b) because theserequirements are now found in § 820.20.

D. Section 820.20 ManagementResponsibility

19. Moved the requirements from§ 820.186 and rewrote into new§ 820.20(d) and (e) for clarity, betterorganization, and closer harmonizationwith ISO/CD 13485.

E. Section 820.25 Personnel

20. Inserted the phrase, ‘‘establishprocedures for identifying trainingneeds’’ in § 820.25(b) in response tocomments to add this requirement andto harmonize with the requirement inISO/CD 13485.

21. Deleted the sentence in § 820.25on understanding the ‘‘CGMPrequirements applicable to their jobfunction’’ to provide manufacturerswith the flexibility to appropriatelytrain personnel.

F. Section 820.30 Design Controls

22. Amended the requirements inDesign and development planning forclarity and to more closely harmonizewith ISO/CD 13485.

23. In § 820.30(c), inserted thesentence, ‘‘The procedures shall includea mechanism for addressing incomplete,ambiguous, or conflicting requirements’’in response to comments to add thisrequirement and to harmonize with therequirement in ISO/CD 13485.

24. In § 820.30(d), deleted thesentence, ‘‘Design output proceduresshall ensure that design output meetsthe design input requirements’’ becausethis was redundant with therequirement in § 820.30(f) Designverification.

25. Amended § 820.30(e) Designreview to clarify that the proceduresshall ensure that an independent personis included in design reviews.

26. Section 820.30(f) Designverification and validation was splitinto two paragraphs, (f) Designverification and (g) Design validationand the requirements were separatedbetween the two paragraphs, inresponse to many written comments andoral testimony at the August andSeptember 1995 meetings and toimprove clarity and consistency withISO/CD 13485.

27. Amended the requirement for§ 820.30(i) Design changes to add thephrase ‘‘before their implementation’’due to an inadvertent omission in theJuly 1995 Working Draft.

G. Section 820.50 Purchasing Controls28. Deleted the last two sentences in

§ 820.50(b) and inserted ‘‘Purchasingdata shall be approved in accordancewith § 820.40’’ because the last twosentences were redundant with therequirements in § 820.40.

H. Section 820.65 Traceability

29. Substituted the definition ofcritical device from the original CGMPfor the phrase ‘‘where necessary toensure the protection of the publichealth,’’ in response to many commentsrequesting clarification as to whentraceability is necessary.

30. Added ‘‘where appropriate’’ forthe traceability of components inresponse to the recommendation of theGMP Advisory Committee, the writtencomments, and to harmonize with ISO/CD 13485.

I. Section 820.70 Production andProcess Controls

31. Inserted ‘‘identified andapproved’’ in § 820.70(a)(5) before‘‘representative samples’’ to clarify thatthe samples have to be established anddeemed appropriate before they areused as a standard.

32. Substituted in § 820.70(b) ‘‘whereappropriate validated according to§ 820.75’’ for ‘‘unless inspection and test


fully verifies the results of the changes’’because it was redundant with therequirements set forth in § 820.75.

33. Amended the requirement in§ 820.70(c) to apply only ‘‘Whereenvironmental conditions couldreasonably be expected to have anadverse effect on product quality,’’ inresponse to comments and to beconsistent with the original CGMPrequirements.

34. Amended the requirements in§ 820.70(d) and (e) to include ‘‘couldreasonably be expected to have anadverse effect on product quality’’ toconsistently qualify when theseprovisions are appropriate.

35. Amended the requirement in§ 820.70(h) to apply only ‘‘Where amanufacturing material couldreasonably be expected to have anadverse effect on product quality,’’ inresponse to comments and to beconsistent with the original CGMPrequirements.

36. Rearranged the wording in§ 820.70(i) to clarify ‘‘automated dataprocessing systems.’’

J. Section 820.72 Inspection,Measuring, and Test Equipment

37. Renumbered § 820.84 as § 820.72for better organization becauseInspection, measuring, and testequipment requirements are moreappropriate under Subpart G—Production and Process Controls thanunder Subpart H—AcceptanceActivities.

38. Section 820.72(b) ‘‘Calibrationstandards’’ and (c) ‘‘Calibration records’’were reorganized as paragraphs(1) and(2), respectively under paragraph (b)‘‘Calibration.’’

39. Amended § 820.72(b) to includeprovisions for remedial action to‘‘reestablish the limits and to evaluatewhether there was any adverse effect onthe device’s quality’’ in response tocomments which questioned whetherthis was adequately covered under§ 820.100.

40. Section 820.84(d), ‘‘Maintenance,’’is reorganized into § 820.72(a) ‘‘Controlof inspection, measuring, and testequipment’’ and ‘‘test software’’ isdeleted because it is considered to becovered under ‘‘electronic inspectionand test equipment’’ in the generalrequirement.

K. Section 820.75 Process Validation41. Section 820.75(a) is amended for

clarity. The phrase ‘‘with a high degreeof assurance’’ was deleted from thedefinition of ‘‘Validation’’ and added asa requirement under process validation.

42. Section 820.75(b)(2) was amendedto state ‘‘where appropriate, the

individual(s) performing the process orthe major equipment used’’ in responseto comments requesting that flexibilitybe given to the manufacturer todetermine when these items needed tobe documented.

43. Section 820.75 (c) and (d) wereredesignated as paragraphs (b)(1) and(b)(2) for better organization and flow.

44. Section 820.75(c) was added toaddress comments and concerns onwhen revalidation activities werenecessary.

L. Section 820.80 Receiving, In-process, and Finished DeviceAcceptance

45. Section 820.80(c) was amended toadd ‘‘where appropriate’’ to reinforcethe discussion in the preamble that in-process testing is not always necessarydepending upon the type of device andthe manufacturing set-up.

M. Section 820.90 NonconformingProduct

46. Amended the requirement in§ 820.90(a) to include, ‘‘The evaluationof nonconformance shall include adetermination of the need for aninvestigation * * *. The evaluationand any investigation shall bedocumented.’’ in response to manywritten comments and oral testimony atthe August and September 1995meetings on whether everynonconformance had to be investigated.

47. Amended the requirement in§ 820.90(b)(1) to read, ‘‘Documentationshall include the justification for use ofnonconforming product’’ in response toseveral comments confused about themeaning of the term ‘‘concession.’’

48. In § 820.90(b)(2), substituted theterm ‘‘rework’’ for the term‘‘reprocessing’’ for reasons described inthe definitions section.

49. Deleted the sentence,‘‘Reprocessed product shall be clearlyidentified during reprocessing, and shallbe subjected to reevaluation’’ in§ 820.90(b)(2) because the requirementwas redundant with the requirements in§§ 820.60 Identification and 820.86Acceptance status.

N. Section 820.100 Corrective andPreventive Action

50. Amended § 820.100(a)(7) to clarifywhat information is to be submitted tomanagement for review.

O. Section 820.120 Device Labeling

51. Inserted ‘‘where appropriate’’before ‘‘use’’ in § 820.120(a) becauseevery device may not have a labeldirectly affixed to the device itself (e.g.implantable devices).

52. Inserted the sentence, ‘‘The labeland labeling used for each productionunit, lot, or batch shall be documentedin the DHR’’ into § 820.120(d) inresponse to comments questioningwhether the labeling used should berecorded in the device master record orthe device history record.

P. Section 820.160 Distribution53. Inserted the requirement in

§ 820.160 ‘‘that purchase orders arereviewed to ensure that ambiguities anderrors are resolved before devices arereleased for distribution’’ in response tothe GHTF comments and other EUcomments that the regulation did notaddress the requirements in ISO 9001,section 4.3, ‘‘Contract Review.’’

Q. Section 820.170 Installation54. Amended the installation

requirements for clarity and deleted thelast sentence in § 820.170(b), ‘‘Theresults of the installation inspectionshall be made available to FDA uponrequest’’ because this sentence isredundant with the requirements in§ 820.180 for all records.

R. Section 820.181 Device MasterRecord (DMR)

55. In § 820.181 deleted the phrase‘‘dated, and signature of the qualifiedindividual(s) designated by themanufacturer’’ and inserted ‘‘andapproved in accordance with § 820.40’’to be consistent with the requirementsalready in § 820.40.

56. In § 820.181 deleted the phrase‘‘and software source code forcustomized software’’ becausecomments stated that this was alreadycovered with the requirement for‘‘software specifications.’’

S. Section 820.186 Quality SystemRecord (QSR)

57. Amended the requirement in§ 820.186 by adding the sentence,

The QSR shall include, or refer to thelocation of, procedures and thedocumentation of activities required by thispart that are not specific to a particular typeof device(s), including but not limited to therecords required by § 820.20. Eachmanufacturer shall ensure that the QSR isprepared and approved in accordance with§ 820.40.

Deleted the requirements in § 820.186(a)through (d) because those requirementsare now found in § 820.20. This changewas in response to comments andsuggestions made by the GHTF forfurther harmonization with ISO/CD13485 and for clarity.

T. Section 820.198 Complaint Files58. In § 820.198 deleted the

terminology ‘‘pertaining to death,


injury, or any hazard to safety’’throughout this section and inserted ‘‘anevent which must be reported to theFDA under part 803 or 804 of thischapter’’ to reference the MDRregulation.

59. Added the phrase ‘‘unless suchinvestigation has already beenperformed for a similar complaint andanother investigation is not necessary’’in § 820.198(c) in response to commentswhich thought a second investigationwas always mandated by thisrequirement.

60. Amended § 820.198(d) bychanging the word ‘‘immediately’’ to‘‘promptly’’ to be consistent with thenew MDR regulation. Added, ‘‘Inaddition to the information required by§ 820.198(e),’’ to clarify that aninvestigation under § 820.198(d) was toinclude requirements under paragraphs(d)(1) through (d)(3) and underparagraphs (e)(1) through (e)(8).

61. Substituted the phrase‘‘reasonably accessible’’ for‘‘concurrently maintained’’ in § 820.198(f) and (g) as recommended by the GMPAdvisory Committee to clarify FDA’sintent of allowing these records to beavailable in other media forms besidesthe hard copies which were previouslyrequired.

U. Section 820.200 Servicing62. Amended § 820.200(a) to adopt

language consistent with ISO/CD 13485,which was suggested at the GMPAdvisory Committee meeting, in orderto clarify the requirement and furtherharmonize.

63. Deleted the last two sentences in§ 820.200(a) on providing information tothird party servicers since this industrywill be addressed in a separaterulemaking, as discussed above.

64. Section 820.200(d) was amendedfor clarity and to focus on the servicereport and what type of informationshould be captured on the report insteadof where the information should be sent.

V. Section 820.250 StatisticalTechniques

65. Amended § 820.250(b) byinserting the phrase, ‘‘to ensure thatwhen changes occur the sampling plansare reviewed’’ in response to commentsfor clarification on when the plansneeded to be reviewed.

VII. Environmental ImpactThe agency has determined under 21

CFR 25.24(a)(8) and (a)(10) that thisaction is of a type that does notindividually or cumulatively have asignificant effect on the humanenvironment. Therefore, neither anenvironmental assessment nor an

environmental impact statement isrequired.

VIII. Intergovernmental Partnership

The agency has analyzed thisrulemaking in accordance with theprinciples and criteria set forth inExecutive Order 12875, ‘‘Enhancing theIntergovernmental Partnership’’ and inthe Unfunded Mandates Reform Act of1995 (Pub. L. 104–4). Executive Order12875 states that no agency or executivedepartment shall issue any regulationthat is not required by statute and thatcreates a mandate upon a State, local, ortribal government unless the FederalGovernment supplies funds necessary tocomply with the mandate, or the agencyprovides the Office of Management andBudget (OMB) a description of theagency’s consultation with affectedState, local, and tribal governments, thenature of their concerns, any writtencommunications submitted to theagency by such units of government,and the agency’s position supporting theneed to issue the regulation containingthe mandate. Executive Order 12875does not apply to this final rule becausethe regulatory requirements are notgenerally applicable to governmentfacilities but to finished devicemanufacturers. The agency notes,however, that the membership of theadvisory committee established toreview this regulation and makerecommendations to the agency on thefeasibility and reasonableness of theregulation (GMP Advisory Committee)must include three members who areofficers or employees of any State orlocal government or of the FederalGovernment, and that in 1995 thiscommittee included two Stategovernment representatives and oneFederal Government representative.

The agency has also examined theconsistency of this final rule with theUnfunded Mandates Reform Act of1995. The Unfunded Mandates ReformAct requires (in section 202) thatagencies prepare an assessment ofanticipated costs and benefits beforeproposing any rule that may result in anannual expenditure by State, local, andtribal governments, in the aggregate, orby the private sector, of $100 million(adjusted annually for inflation). FDAbelieves that the private sectorexpenditures for this rule fall below$100 million annually but nonetheless,due to uncertainties of these estimates,the agency has prepared for the privatesector an assessment of anticipated costsand benefits for the 1993 proposed ruleand this final rule as described insection IX. of this document.

IX. Economic Impact

A. SummaryFDA has examined the impacts of the

final rule under Executive Order 12866and the Regulatory Flexibility Act (Pub.L. 96–354). Executive Order 12866directs agencies to assess all costs andbenefits of available regulatoryalternatives and, when regulation isnecessary, to select regulatoryapproaches that maximize net benefits(including potential economic,environmental, public health and safety,and other advantages; distributiveimpacts; and equity). The agencybelieves that this final rule is consistentwith the regulatory philosophy andprinciples identified in the ExecutiveOrder. As explained in detail below,FDA finds that this final rule has anestimated total annual incremental costof $81.9 million to the U.S. industry andan estimated average annual benefit offrom $180 million to $220 million inlives saved and is economicallysignificant under Executive Order12866. Consequently, the agency hascompleted this full regulatory flexibilityanalysis which demonstrates that thisrule is consistent with the principles setforth in the Executive Order and theRegulatory Flexibility Act, and also withthe Unfunded Mandates Reform Act asdescribed in section VIII. of thisdocument. This analysis, together withthe preamble published in the FederalRegister and supporting analysis andmaterials, constitutes a final regulatoryflexibility analysis. In addition, thisdocument has been reviewed by OMB asan economically significant regulatoryaction under Executive Order 12866.

The detailed data for this analysiswere developed by Eastern ResearchGroup, Inc. (ERG), under contract toFDA and their two reports: ‘‘EconomicAnalysis of the Proposed Revisions tothe Good Manufacturing PracticesRegulation for Medical Devices,’’ and‘‘Addendum to the Final Report’’ are onfile at the Dockets Management Branch(HFA–305), Food and DrugAdministration, 12420 Parklawn Dr.,rm. 1–23, Rockville, MD 20857.

The objective of this rule is to reducethe number of fatalities and injuriesattributable to defective medicaldevices. FDA finds that private marketincentives do not adequately reduce therisk of design-related device failuresbecause neither physicians norconsumers have all of the informationneeded to make adequate judgments ofproduct quality and legal tort remediesare slow, inefficient, and extremelycostly.

The changes to the CGMP regulationwill require manufacturers to extend


1 Fisher, A.; Chestnut, L.; and Violette, D. (1989).‘‘The Value of Reducing Risks of Death: A Note onNew Evidence.’’ Journal of Policy Analysis andManagement, 8 (pp. 88–100).

2 Gilmartin, R.V. (1992). ‘‘The Benefits ofCooperation for Industry and Regulators Alike: AGlobal Perspective.’’ Presented at the Third AnnualGlobal Medical Device Conference, October 2.

their quality systems to include severalnew areas, such as design andpurchasing, and to clarify or expandselected existing requirements. Severalof the changes to the regulation make itmore consistent with ISO 9001:1994quality standards. The rule will affectall medical device establishmentsengaged in the design, manufacture,contract sterilization, and packaging ofmedical devices.

This analysis presents the costs andbenefits of the final CGMP rule andreflects the differences between theproposed and final regulation. Thecomplete methodology and preliminaryeconomic analysis was presented in theNovember 1993 ERG report, ‘‘EconomicAnalysis of Proposed Revisions to theGood Manufacturing PracticesRegulation for Medical Devices’’. Whilethe proposed rule covered componentmanufacturers, the cost of compliancefor such manufacturers wasinadvertently omitted from theNovember 1993 ERG report. However,FDA has decided not to covercomponent manufacturers, thereforemost of the preliminary analysisremains valid (e.g., estimates of laborand resource requirements, level ofcompliance, and number of firmsremain the same for the final analysis,except where noted).

Based on the ERG study, the totalannual incremental costs to the U.S.industry of the final CGMP regulationare estimated to be about $81.9 million.These costs are more than offset,however, by benefits to public healthand by economic benefits to the medicaldevice industry. FDA estimates that thebenefits to public health will include 36to 44 fewer deaths and 484 to 677 fewerserious injuries per year, which areattributed to design-related devicefailures. Studies on the value of astatistical-life have reported estimatesranging from $1.6 million to $8.5million.1 Assuming an economic valueof $5 million per fatality avoided, themonetary value of saving 36 to 44 liveseach year will be $180 to $220 million.Therefore, the value of the public health

benefits of preventing deaths aloneeasily exceeds the cost of complianceeven without estimating benefits from areduced number of serious injuries.Moreover, additional economic benefitsto medical device establishments willresult from cost savings due to fewerdesign-related product recalls, betterproduct quality, and greaterproductivity. In addition, medicaldevice establishments exporting to theEU will greatly benefit from theharmonization of the CGMP regulationwith the ISO 9001:1994 qualitystandards. Because the EU is adoptingISO 9001:1994 as a basis for its medicaldevice manufacturing quality system,the harmonization of the two qualityrequirements will eliminate the need fordevice manufacturers to maintaindifferent quality systems for eachmarket.

FDA supports the internationalharmonization of standards andregulations governing medical devicesand the eventual mutual recognition ofCGMP inspections between majordevice markets. While full achievementof this goal is still in the future, theharmonization of quality standards is animportant first step.

FDA believes in a step wise approachtoward harmonization and eventualmutual recognition. For CGMPinspections or Quality SystemConformity Assessments, these goalscomprise four basic steps. First, theharmonization of quality systemrequirements is a fundamental buildingblock of all future work in this area.FDA believes that by working with theGHTF, specifically Study Group #3 ofthe GHTF, it has developed a final rulethat incorporates the harmonizedquality system requirements which arerecognized around the world. Second isthe harmonization of regulatory auditingor compliance inspections. This work iscurrently underway in the GHTF inStudy Group #4, which has developedone draft document entitled ‘‘GuidelinesFor Regulatory Auditing QualitySystems of Medical DeviceManufacturers,’’ expected to be

finalized in 1997. The third step is forharmonization of the policy,interpretation, and regulatoryconsequences of noncompliance withthe quality system requirements in thisrule and in counterpart requirements ofother countries. Underlying theseactivities is an ongoing need forconfidence building between the partiesworking towards mutual recognition.FDA believes that this regulation willprovide a sound foundation for the goalof mutual recognition of inspections, agoal that will benefit industry, as wellas the agency. The Health IndustryManufacturers Association has statedthat reciprocity for quality assuranceinspections could save the medicaldevice industry millions of dollars aswell as provide significant savings togovernments.2

For individual establishments, theeconomic impact of the regulation willdepend on a number of factors, such asthe level of current compliance, the typeof activities performed at theestablishment, and the nature of theproduct. On average, the smallerestablishments will bear a relativelygreater economic burden.

B. Industry Profile

Firms in the medical device industryare heterogeneous. They vary in size,product type, product and processtechnology, and rate of new productintroductions. There are over 7,000medical device establishments involvedin the production of approximately4,000 different types of devices (Table1). Sixty-two percent of theseestablishments are very small (fewerthan 20 employees), while 27 percentare of medium-size (20 to 99employees), 7 percent are large (100 to249 employees), and 4 percent are verylarge (250 or more employees). Thesesize categories were developed to reflectsize categories within the medicaldevice industry and differ from theSmall Business Administrationdefinition. Under the Small BusinessAdministration definition, over 98% ofall establishments would be small.

TABLE 1.—DISTRIBUTION OF AFFECTED ESTABLISHMENTS BY EMPLOYMENT SIZE

Type of establishment Total 1

Employment size 2

Small(1–19)

Medium(20–99)

Large(100–249)

Very large(≥250)

Design and Production Manufacturer ....................................................... 5,415 3,323 1,414 415 265Contract manufacturer .............................................................................. 419 257 109 32 20Specification developer ............................................................................. 541 352 162 27 0Repacker/relabeler .................................................................................... 828 538 248 41 0


TABLE 1.—DISTRIBUTION OF AFFECTED ESTABLISHMENTS BY EMPLOYMENT SIZE—Continued

Type of establishment Total 1

Employment size 2

Small(1–19)

Medium(20–99)

Large(100–249)

Very large(≥250)

Contract sterilizer ...................................................................................... 34 22 10 2 0

Total ............................................................................................... 7,237 4,492 1,943 517 285

1 Based on data from FDA’s Registration and Listing Branch, 1992, adjusted to reflect 13 percent not required to register and 6 percent exemptfrom CGMP requirements.

2 ERG (1993), Section 3.

C. Comments to November, 1993Proposed Changes to the CGMPRegulation

A small percentage of the publiccomments on the November 1993proposed regulation addressed theeconomic impact analysis. The majorityof these comments made very general,nonspecific observations and thereforecannot be addressed directly. Many ofthese comments stated that FDAunderestimated the regulatory burdenthat the proposed CGMP regulationwould place on medical devicemanufacturers. Others stated that theircompanies would expend more than theper establishment estimated costs; somediscussed the hiring of additionalpersonnel to address the compliancerequirements.

In developing the cost estimates forthe 1993 proposal, ERG attempted todescribe the labor hours (and associatedcosts) needed to achieve an acceptableminimum level of compliance with eachrequirement. These estimates took intoaccount the incremental labor andcapital resources that would be neededto progress from the existing compliancelevel to the new level required by theproposal. For individual establishments,the economic impact of the CGMPregulation would depend on a numberof factors, such as the level of currentcompliance, the type of activitiesperformed, and the nature of theproduct. Not surprisingly, thoseestablishments that currently undertakerelatively few of the activities to berequired would incur greatercompliance costs than the averagespresented.

In the final rule, FDA has eliminatedor modified several requirements to givemedical device establishments greaterflexibility in selecting compliancemethods. In general, the words ‘‘whereappropriate’’ were added to manyrequirements to make them lessprescriptive and allow establishments todetermine if or when they areappropriate for their product. Forexample, in § 820.65 Traceability, thefinal requirement allows the

manufacturer to identify whichcomponents require traceability. Inaddition, many procedures may notneed to be changed, only documented.To further minimize compliance costs,FDA intends to provide additionalguidance materials. The DSMAcurrently offers guidance materials andregional seminars on CGMP matters.

1. Health Industry ManufacturersAssociation (HIMA)

HIMA commented that FDAunderstated the costs for personneltraining, maintenance of new systems,documentation revisions, andoperational costs.

ERG agrees that it did not fullyaddress the initial training requirementsin the cost analysis for the proposedCGMP regulation. New costs for initialtraining were included in the costanalysis for the final CGMP regulation.However, the existing CGMP regulationrequires periodic training of personnel.Therefore no incremental costs forperiodic training were estimated.

ERG did not change its cost estimatefor quality system maintenance andprocedure revisions. Estimates weremade for the incremental compliancecosts associated with an annual reviewof each new procedure, but theseprocedures would be revised onlysporadically and probable estimates oftheir future costs would be small andcould not be reasonably quantified.

ERG recognized that companies willincur incremental costs to use newprocedures. Although a separateestimate of these operational costs wasnot made, they were incorporated intothe estimates of the individualrequirements where applicable.

2. Other General CommentsSome manufacturers of low-risk

devices and some that have neverexperienced a product recall or MDRevent questioned the merit and benefitsof applying design controls to allproducts. In the proposed and finalCGMP regulation, FDA exempted almostall class I devices because the publichealth benefits gained did not exceed

the costs of implementation. However,FDA believes that all class II and IIIdevices should be covered because theirfailure could adversely affect publichealth. Even firms with excellent pastrecords put their consumers at futurerisk if their design systems areinadequate. ERG estimates that strictcompliance to the final CGMPregulation will avert about 43 deathsand over 600 serious injuries per year.In addition, the literature on qualitysystems consistently states that firmsimplementing such systems, whichbegin with design controls, report costsavings in the long-run.

A number of comments argued thatthe proposed CGMP regulation wouldslow product innovation and increasehealth care costs. FDA believes that thegains from improvements in qualitycontrol and greater efficiencies willlessen the impact on both innovationand health care costs and will not lowerthe innovation rate for products withsignificant medical benefit.Manufacturers will also avoid the costsof most design-related medical devicerecalls. ERG estimated that design-related recalls cost industryapproximately $40 million per year.Health care spending overall will alsodecrease as deaths, injuries andmalfunctions from medical devicefailures decrease.

Some comments suggested that theproposed CGMP regulation would hurtthe domestic medical device industry’scompetitiveness and encouragecompanies to move their operations toforeign countries. FDA has sought toharmonize the final CGMP regulationwith ISO 9001:1994 and ISO/CD 13485.Some comments had stated they wouldlike to see even greater harmonization inthe final regulation. The harmonizationof regulatory requirements will benefitmedical device establishments becausethey will be able to maintain a singleregulatory compliance program. Theharmonization of CGMP requirements isalso a first step in developing mutualrecognition agreements between U.S.and foreign governments. An FDAsponsored survey of innovative medical


3 ERG (1994). FDA Survey of EstablishmentsIntroducing New Medical Devices. (Task Order 3,Contract No. 223–91–8100.)

4 ERG (1994). FDA Survey of EstablishmentsIntroducing New Medical Devices. (Task Order 3,Contract No. 223–91–8100).

device companies found that nearly 65percent of them sold their productsoutside the United States, including 40percent of the small and 70 percent ofthe medium-sized companies.3 Thus, amajority of firms should benefit fromharmonization efforts. Since foreignfirms exporting their products to theUnited States must comply with theU.S. CGMP regulation, they will incuressentially the same incremental coststo comply with the final CGMPregulation as domestic establishments.

3. Small Business ConcernsSome comments representing small

businesses were concerned about theincrease in procedural anddocumentation requirements. Theprocedures and paperwork requirementswill be simpler for small medical deviceestablishments relative to larger firms.Further, small businesses can reducecompliance costs by using FDAguidance and training materials,industry-generated guidance, and othertechnical assistance that is available.FDA is preparing an extensive range oftechnical support regarding the finalCGMP regulation, including guidancedocuments, workshops, and othermaterials and presentations.

Several small businesses argued thatthe regulatory costs falldisproportionately on small business,hindering industry growth. Theregulatory requirements apply equallyto whoever is designing and developingnew devices. However, the vast majorityof firms are small and medium in sizeand these firms are least likely to havesuch design control procedures alreadyin place. As a result, their incrementalcosts may be higher. Nevertheless,because procedures reflect thecomplexity of the processes they guide,small and medium-sized establishmentsshould incur proportionately lowergross compliance costs for thoseactivities than larger establishments.

4. Section 820.22 Quality auditSome comments believed that

requiring quality audits to be performedby individuals without directresponsibility for the matters beingaudited poses a severe burden for smallbusiness. This requirement is alreadypresent in the original CGMP regulationand thus was not addressed in theeconomic analysis of the finalregulation.

5. Section 820.25 PersonnelComments stated that the requirement

to maintain files on consultants was

onerous and interfered withmanufacturers’ selection processes. FDAmodified this requirement and moved itto § 820.50 Purchasing, in the finalCGMP regulation. Companies will nowbe required to verify that consultantsmeet specified requirements and definethe type and extent of control they willexercise over them. The incrementalcompliance costs were judged to benegligible.

6. Section 820.30 Design controlComments believed that the

requirement stipulating that devices besampled from three production runsbefore a device is released for routinedistribution was too prescriptive andburdensome. FDA has modified therequirement in the final rule to requiredesign validation of initial productionunits, lots, or batches, or theirequivalent. This modification shouldgive manufacturers greater flexibility inimplementing this requirement.

Some comments from smallbusinesses were critical of therequirement that independent personnelperform design reviews and stated thatthey will have to hire outside engineersfor this task. In the final rule FDAallows greater flexibility and states thatthe independent personnel can beindividual(s) who do not have directresponsibility for the design stage beingreviewed. Thus, staff personnel(including engineers working on othercomponents of the device andnonengineering personnel) can performdesign reviews.

7. Section 820.40 Document controlSome comments believed that the cost

of implementing documentationsystems and other paperwork wasunderstated. However, ERG’s estimatesincluded the incremental compliancecosts for formalizing a written documentcontrol procedure and ERG consideredpaperwork requirements in itsestimation. The final rule also extendsdocument control requirements to thedesign phase and cost estimates forthese requirements were added to theeconomic assessment.

Most companies consider documentcontrol procedures to be essential andhave realized some benefits from suchprocedures, typically in the form ofefficiency gains and avoideddocumentation mixups. These potentialbenefits were not quantified.

8. Section 820.50 Purchasing controlComments questioned the need to

establish the quality of materialspurchased from long-establishedsuppliers or from new suppliers of smallquantities of components. Historical

records, however, even for suppliers ofsmall quantities, can be used to assessa supplier’s quality. Supplier audits arenot mandated in the CGMP regulation,but may be a useful tool in assessing asupplier’s capabilities. Cost estimatesfor auditing from one- half to four newsuppliers per year for small to very largeestablishments were included in theeconomic assessment.

9. Section 820.80 Receiving, in-process, and finished device acceptance

One comment believed that requiringmanufacturers to retain the quantitativeresults of testing was excessive. Thefinal rule stipulates that ‘‘the results’’ ofacceptance activities are to be recorded,but does not specify that all quantitativeresults must be recorded. Because thisrequirement is consistent with currentindustry practices, incremental costswere not assigned to this section.

10. Section 820.90 Nonconformingproduct

Comments noted that identifying aproduct as ‘‘reprocessed’’ has a negativeimpact on sales. (FDA now uses theterm ‘‘reworked’’.) This language wasrevised in the final rule to clarify thatreworked devices need to be identifiedas such at the manufacturing facility toavoid mixups. No costs were estimatedfor this requirement.

D. Industry Costs

ERG estimated the total annualincremental cost of the final rule at$81.9 million. This includes $9.5million in one-time costs that wereannualized over 5 years at a 10 percentdiscount rate. Table 2 lists the mostcostly of the new requirements.

Costs were based on the incrementaltasks each manufacturer must performto achieve compliance. ERG retainedmost of the methodology and data fromthe proposed rule to estimate the costsof the final rule. Where applicable, costswere estimated for additional orchanged final requirements. Also, thedistribution of costs acrossestablishment size was modified toreflect new information on the rate ofproduct innovation.4 The rates ofinnovation per year used for thisanalysis are: 0.4 percent for small, 1.3percent for medium-sized, 2.6 percentfor large, and 6.5 percent for very largeestablishments.


TABLE 2.—TOTAL COMPLIANCE COSTS, BY MOST COSTLY INCREMENTAL TASKS

[$ millions]

Incremental tasks One-timeannualized 1

Annual TotalannualizedLabor Nonlabor

Design Controls:Design Verification .................................................................................................... NA 18.2 27.4 45.6Design Review .......................................................................................................... NA 6.2 NA 6.2Design Changes ........................................................................................................ NA 4.0 NA 4.0Design and Development Planning ........................................................................... NA 1.2 NA 1.2

Other:Quality Audit .............................................................................................................. 0.5 4.7 NA 5.2Evaluation of Suppliers and Contractors .................................................................. 0.6 1.9 0.9 3.4Management Review ................................................................................................. NA 2.2 NA 2.2Purchasing Data ........................................................................................................ NA 1.1 NA 1.1

All Remaining ................................................................................................................... 8.4 4.6 0.0 13.0

Total for Final Regulation ................................................................................... 9.5 44.1 28.3 81.9

1 One-time costs annualized over 5 years at discount rate of 10 percent.NA=Not Applicable.Note: Totals may not add due to rounding.Source: ERG (1996), Section 4.

The great majority of costs for all sizeestablishments will be associated withthe establishment of design controls fornew products. Therefore, the moreinnovative establishments willexperience greater compliance coststhan the less innovative establishments.The estimated annual design controlcosts total $57.5 million, whichrepresents 70 percent of the total annualincremental costs of compliance. Themost costly task within the designcontrol category is design verification($45.6 million), which includes designvalidation. Other costly tasks are designreview ($6.2 million), whichencompasses conducting anddocumenting design reviews; designchanges ($4.0 million), which includesdocumenting and maintaining designchange procedures; and design anddevelopment planning ($1.2 million),which includes documenting andmaintaining plans for device design and

development. The requirement forextending the quality system audit ($5.2million) and the evaluation of suppliersand contractors ($3.4 million) are alsorelatively high cost items.

The estimated total cost ofcompliance for the final rule ($81.9million) is $2.6 million less than theestimated cost of the November 1993proposed rule ($84.5 million). Somecost increases were due to addedrequirements for increaseddocumentation. However, these costincreases were offset partly by adecrease of $0.5 million from themodification of some requirements (e.g.§§ 820.65 Traceability and 820.160Distribution). The remaining changesresulted from changes in assumptions ornew information about cost andcompliance rates in design control andsupplier audits and from newinformation regarding productinnovation rates across establishmentsize.

The projected average cost perestablishment (see Table 3) variessubstantially across industry sectors andestablishment size categories. Asexpected, the average incremental costsare largest for establishments that designmedical devices: design and productionmanufacturers and specificationdevelopers. For these two sectors, theaverage per establishment costs are$15,994 for design and productionmanufacturers and $14,767 forspecification developers. Actual perestablishment costs will varysubstantially depending on the producttype, design complexity, innovationrate, and level of design controlcurrently in place. The averageincremental costs for the other threesectors are significantly lower: $3,554for contract manufacturer, $1,995 forrepacker/relabeler, and $2,040 forcontract sterilizer.

TABLE 3.—AVERAGE TOTAL ANNUALIZED 1 COSTS PER ESTABLISHMENT BY TYPE AND SIZE

[Dollars]

Establishment type Small (1–19) Medium(20–99)

Large(100–249)

Very large(≥250) All

Design and Production Manufacturer ............................................. 11,085 25,800 22,748 12,258 15,994Specification Developer .................................................................. 9,927 24,052 20,583 NA 14,767Contract Manufacturer .................................................................... 2,357 4,027 5,802 10,678 3,554Repacker/Relabeler ........................................................................ 1,471 2,588 3,969 NA 1,995Contract Sterilizer ........................................................................... 1,491 2,621 3,999 NA 2,400

1 One-time costs annualized over 5 years at a discount rate of 10 percent.NA=Not Applicable.Source: ERG (1996), Section 6.

Because average current compliancerates tend to vary directly withestablishment size and there are

relatively few large and very largeestablishments (7 and 4 percent of allmedical device establishments,

respectively), the largest share of thecosts are incurred by smallestablishments, $35.2 million (43


5 There is no code in the MDR database to identifydesign-related events.

percent) and medium-sizeestablishments, $34.5 million (42percent), while the smallest share is

incurred by very large establishments,$3.4 million (4 percent) (see Table 4).

TABLE 4.—TOTAL ANNUALIZED COSTS BY SIZE CATEGORY

[$ millions]

Establishment size One-timeannualized 1

Annual TotalannualizedLabor Nonlabor

Small (1–19) ..................................................................................................................... 4.9 18.2 12.1 35.2Medium (20–99) ............................................................................................................... 3.0 18.2 13.3 34.5Large (100–249) ............................................................................................................... 1.0 5.1 2.8 8.8Very large (≥250) .............................................................................................................. 0.7 2.6 0.1 3.4All establishments ............................................................................................................. 9.5 44.1 28.3 81.9

1 One-time costs annualized over five years at discount rate of 10 percent.Note: Totals may not add due to rounding.Source: ERG (1996), Section 4.

E. Benefits From Proposed Changes tothe CGMP Regulation

ERG used the methodology and datafrom the proposed rule to estimate thebenefits of the final CGMP regulation.Adjustments to the number anddistribution of MDR’s were made basedon updated numbers of closed cases.Also, more reliable estimates of industrysavings from avoided design-relatedrecalls were incorporated.

The changes to the CGMP regulationwill provide public health benefits tomedical device users and economicbenefits to the medical device industry.Based on its review of medical devicerecalls over the 4-year period 1988 to1991, FDA has estimated that 30 percentof all medical device product recalls aredue to inadequate design controls. It isextremely difficult to judge how many

of these recalls could reasonably havebeen avoided, but ERG judged that amajority would have been prevented ifmanufacturers had fully implementedthe CGMP design control requirements.

1. Public Health Benefits

ERG used the MDR database toestimate the public health benefits ofthe final CGMP regulation. There wereover 41,600 MDR’s submitted to FDA in1991; 97 percent of these MDR’s areclosed (i.e., a review of the case iscompleted). Of these closed cases, FDAdetermined that 9.3 percent of thefatalities and 12.4 percent of the seriousinjuries were due to device failures. Thebulk of the remaining incidents weredue to user problems, but also includecases where cause could not be clearlyestablished. To estimate the total

number of deaths and serious injuriesfor 1991 by cause, the 1988–1991averages of device recalls were used. Toestimate the number of deaths andserious injuries due to design-relatedcauses, ERG assumed that the percent ofMDR’s that were design-related was thesame as that for recalls (30 percent).5Based on these assumptions, medicaldevices contributed to an estimated 49fatalities and 663 serious injuries in1991 due to design-related problems inclass II and III devices (see Table 5). Tocorrect for the substantial underreporting of MDR’s, ERG made anupward adjustment in the number ofMDR’s of 20 percent for fatalities and 40percent for serious injuries. The numberof estimated fatalities adjusted forunderreporting of MDR’s would be 59,with 929 serious injuries.

TABLE 5.—NUMBER OF DESIGN-RELATED REPORTS AND ESTIMATED AVOIDED DEATHS AND SERIOUS INJURIES

Fatalities Serious Injuries

Class II Class III Total Class II Class III Total

Number in 1991 ............................................................................ 555 475 1,030 4,391 11,794 16,185Device-related ............................................................................... 105 59 164 330 1,881 2,211Design-related 1 ............................................................................. 32 18 49 99 564 663Number avoided ............................................................................ 23 13 36 72 412 484Adjusted number of design-related MDR’s 2 ................................. 38 21 59 139 790 929Adjusted Number avoided ............................................................ 28 15 43 101 576 677

1 Assumes 30 percent of device-related MDR’s are design-related, based on FDA recall data.2 Total number of fatalities and injuries increased by 20 and 40 percent, respectively, to adjust for under-reporting.Source: ERG (1996), Section 5.

To develop an approximate idea ofthe preventability of these incidents,ERG convened a panel of industrialengineers and regulatory specialistswith extensive experience in the designof medical devices. The panel examineda random sample of 100 design-relatedmedical device recalls and judged

whether implementation of designcontrols could have prevented therecall. ERG found that the expectedvalue of their judgments implied thatproper design controls would haveprevented about 73 percent of theserecalls. Assuming the samepreventability ratio for design-related

MDR events, ERG calculated that theproposal would prevent about 36 to 43deaths and 484 to 677 serious injuriesper year, depending on the degree ofMDR underreporting.

To verify the reasonableness of theestimates, FDA examined an alternativemethod of estimating the number of


6 Design-related medical device recalls cost theindustry approximately $40 million annually.(Eastern Research Group, Inc. (1994). FDA Surveyof Medical Device Recall Costs. (Task Order 3,Contract Number 223–91–8100).


fatalities caused by design-relatedfailures. For this calculation, 3 years ofdesign-related recalls were assumedlinked to MDR fatalities that occurredfor these devices 1 year before or 3months after the date of the recall. Thisapproach, which provides aconservative estimate because not allrelevant fatalities and subsequentMDR’s would occur during this limitedtime period, found that about 60 deathsper year were due to design-relateddevice failures. If 73 percent of suchincidents could be avoided throughcompliance with the proposed CGMPregulation, 44 deaths per year would beprevented.

These estimates of the public healthbenefits from fewer design-relateddeaths and serious injuries representFDA’s best projections, given thelimitations and uncertainties of the dataand assumptions. The above numbers,however, do not capture the quality oflife losses to patients who experienceless severe injuries than those reportedin MDR’s, who experience anxiety as aresult of treatment with an unreliablemedical device, or who experienceinconvenience and additional medicalcosts because of device failure.

Medical device malfunctions aresubstantially more numerous thandeaths or injuries from device failuresand also represent a cost to society.Malfunctions represent a loss of productand an inconvenience to users and/orpatients. Additionally, medical devicemalfunctions burden medical personnelwith additional tasks, such as repeatingtreatments, replacing devices, returningand seeking reimbursement for faileddevices, and providing reports on thecircumstances of medical devicefailures. No attempt was made toquantify these additional costs.

2. Industry BenefitsThe medical device industry would

gain substantial economic benefits fromthe proposed changes to the CGMPregulation in three ways: Cost savingsfrom fewer recalls, productivity gainsfrom improved designs, and efficiencygains for export-oriented manufacturerswho would now need to comply withonly one set of quality standards.

An average of 359 medical devicerecall events per year were reported toFDA over the period 1988 to 1991. Asstated above, FDA estimates that design-related deficiencies contributed to 30percent of those recall events annually.Applying the 73 percent recallpreventability factor, ERG projects thatthere would be 67 fewer recalls of classII and III devices each year under thefinal CGMP regulation (see Table 6).Based on data from a recent survey of

recall costs, 67 fewer recalls implies thatthe industry would avoid roughly $29million worth of recall expenses peryear by complying with the final CGMPregulation.6

TABLE 6.—NUMBER OF AVOIDED DE-SIGN-RELATED RECALL EVENTS BYCLASS OF DEVICE

[FY 1988–FY 1991]

Device class

Averagenumber

of design-relatedrecall

events1

Numberof avoid-ed de-

sign-relat-ed recallevents2

I ................................. 15 NAII ................................ 80 58III ............................... 12 9

All Devices ............. 107 67

1 Office of Compliance and Surveillance,CDRH.

2 ERG estimates based on random sampleof 100 design-related recalls.

Source: ERG (1996), Section 5.

ERG also found that the designcontrol requirements in the final CGMPregulation would require manufacturersto integrate their design and productionoperations and that most industryexperts believe that this change wouldlead to better quality products, moreefficient engineering, lowermanufacturing costs, and reducedproduct development time. Thesesavings, however, could not bequantified.

Still another benefit of the revisedregulation relates to the harmonizationof the final CGMP regulation with theISO 9001:1994 international standard.This change would especially benefitexport-oriented establishments, becausethey would need to meet only one setof quality standards. ERG could notderive quantitative measures of thisbenefit. However, 65 percent ofinnovative medical device companiesexport their products, thus a majorityshould benefit from harmonization ofCGMP regulation between major tradingpartners.7

F. Economic and Small Business Impact

The ability of medical deviceestablishments to pass on the added costof the final regulation will determinethe economic impact to the industry.The diversity of medical devices

precludes any easy characterization oftheir product markets. Under thecurrent medical care system, however,the demand for many medical devicestends to be price inelastic because theyare often prescribed by physicians andfrequently paid for by third parties.Thus, small price increases have nottypically prompted significant declinesin industry sales. Nonetheless,competitive pressures have increasedsubstantially under new health carecost-containment measures. Therefore,to examine the potential effect of thecosts of compliance on the industry’scompetitive structure, ERG calculatedthe maximum impact on industryaverage prices and products, usingextreme scenarios. Financial datacharacterizing the scope of FDA-regulated medical device establishmentsare not available. To make estimates ofthe regulatory impact on price andprofits, ERG used a combination ofcensus and Dun and Bradstreet data (seeERG (1993) for methodology). ERGassumed that the firms characterized inthese data sources had the same sizeand product distribution, andintroduced new products at the samerate as the population of FDA-regulatedestablishments. While the validity ofthese assumptions is uncertain, it wasthe only data available to measureregulatory impact. ERG presents twoextreme scenarios, the first reflects themagnitude of the potential impact onproduct prices if all costs were passedforward. The second demonstrates themaximum drop in profits if no costswere passed forward. In reality, somecombination of these scenarios willoccur.

Based on the assumption that all costsof compliance are passed through to theend user, with no loss in sales and nooffset for avoided recalls or otherindustry productivity gains, ERG foundthat the average increase in the price ofmedical devices would be less than 0.13percent. Estimated price increasesranged from 0.04 percent for X-RayApparatus and Tubes (SIC 3844) to 0.34percent for Dental Equipment andSupplies (SIC 3843) (see Table 7). Themaximum price increase was calculatedusing aggregate compliance costs as apercentage of the value of shipments.The price increases calculated by size ofestablishment suggest that smallestablishments will be under greaterpressure to increase prices. The cost ofcompliance represented an average of1.36 percent of the value of shipmentsfor small establishments and 0.01percent for very large establishments.These differences in impacts by sizereflect the finding that small


8 The Small Business Administrations definitionis by the employment size at the company level.Detailed demographic and financial data is notavailable by company size, therefore FDA usedestablishment data. FDA does not know the impacton companies.


establishments have lower currentcompliance than large establishments.

To estimate the potential impact ofcompliance costs on medical deviceindustry profits, ERG calculated after-tax compliance costs as a percentage ofafter-tax income for each medical deviceSIC (see Table 7). Again, no adjustmentswere made for avoided recalls orexpected productivity gains. Ifmanufacturers have no ability toincrease prices to offset the increase incompliance costs, this estimaterepresents an upper bound of thepotential effect on entity income. Underthese circumstances, the medical devicesectors could incur reductions inincome ranging from about 0.81 percent(SIC 3845, Electromedical Equipment)to about 4.27 percent (SIC 3843, DentalEquipment and Supplies). ERGconcluded that such impacts may affectsome establishments’ decisions todevelop new products where expectedprofits are marginal or highly uncertain,but judged that the level of incrementalcosts imposed by this regulation wouldnot substantially lower the innovationrate especially for products withsignificant medical benefits.

TABLE 7.—MAXIMUM POTENTIAL IM-PACT ON PRICE OR PROFITS BY IN-DUSTRY AND EMPLOYMENT SIZE

Totalannualized

compli-ance costsas a per-

centage ofshipments

After-taxcompli-ance

costs asa per-

centageof after-tax in-come

Industry:3841 Surgical and

medical instru-ments ................ 0.12 2.00

3842 Surgical ap-pliance and sup-plies .................. 0.14 1.78

3843 Dental equip-ment and sup-plies .................. 0.34 4.27

3844 x-ray appara-tus and tubes .... 0.04 0.88

3845Electromedicalequipment ......... 0.05 0.81

3851 Ophthalmicgoods ................ 0.24 3.54

All ......................... 0.13 1.87Establishment size:

Small (1–19) ......... 1.36 NAMedium (20–99) ... 0.35 NALarge (100–249) 0.09 NAVery large (≥250) 0.01 NAAll ......................... 0.13 NA

NA = not available.Source: ERG (1996), Section 6.

The Regulatory Flexibility Actrequires agencies to analyze regulatoryoptions that would minimize anysignificant impact of a rule on smallentities. This section together with otherdiscussions in this preamble andsupporting analysis and materialsconstitute the agency’s regulatoryflexibility analysis. A description of theprojected reporting, recordkeeping, andcompliance requirements including thetype of professional skills required isincluded in the ERG economic analysisreports that are referenced above and onfile at the Dockets Management Branch(address above). In accordance with theRegulatory Flexibility Act, FDA hasconsidered the effect of this action onsmall businesses and has determinedthat there will be a significant impact ona substantial number of smallbusinesses. Almost all medical deviceestablishments are classified as smallunder the Small BusinessAdministrations definition of size.8 Theincremental costs are greatest forestablishments that design medicaldevices and that currently have lowerlevels of compliance with the newdesign control requirements. Theserequirements account for 70 percent ofthe total incremental costs of the finalrule but affect only design andproduction manufacturers andspecification developers (82 percent ofthe total affected establishments). Othersectors of the industry will incursubstantially lower costs (see Table 3).

The actual added cost perestablishment will vary by theestablishment’s current level ofcompliance, complexity of productdesign, product type, and rate ofproduct innovation. As indicated inTable 3, the average medium-size andlarge manufacturers of devices willincur greater compliance costs ($25,800and $22,748 per establishment,respectively) relative to small and verylarge establishments ($11,085 and$12,258, respectively). However, thepotential impact on product price(measured as a percent of the value ofshipments) is greatest for small (1.36percent) and medium-size (0.35 percent)establishments. Large and very largeestablishments will incur only a 0.09percent and 0.01 percent increase,respectively, due to much larger valuesof shipments and higher rates ofcompliance with the final rule. Smallerestablishments producing differentiatedproducts or marketing to niche markets

may not be at a disadvantage because oftheir ability to pass on the added costof compliance. However, those smallerestablishments that compete with largerestablishments based on price alonewould suffer a drop in profits if theycurrently operate at lower levels ofcompliance than their competitors.

FDA believes that actual perestablishment compliance costs will belower than estimated for the followingreasons: First, the final CGMP regulationclosely parallels the ISO 9001:1994quality standards, which have beenadopted as the quality standard for theEU and are becoming the internationalquality standards for medical devices.Close to 65 percent of domestic medicaldevice manufacturers export theirproducts and generate approximatelyone-third of their sales from exports.9Compliance with the quality controlrequirements is necessary for firms tomaintain international competitivenessand in fact many U.S. medical devicemanufacturers have become ISOcertified since the 1993 publication ofthe proposed CGMP regulation and theEU implementation of unifiedregulatory requirements.

Second, the FDA has extended theeffective date of the final rule to June 1,1997, and has chosen not to takeregulatory action for an additional yearon the design control requirements. Thisrevised effective date will also reducethe cost of implementation estimated forthe 1993 proposal where the proposedeffective date was only 180 days afterdate of publication. The extension willgive manufacturers a longer time toimplement the new requirements,allowing the costs to be spread overalmost a 2-year period as compared to180 days. June 1998 coincides with theimplementation of the EU’s InactiveMedical Device Directive. Therefore, theeconomic impact of complying with thenew quality system regulation will beshared with the economic impact ofcomplying with the new EU MedicalDevice Directive for any manufacturerwho also produces devices for sale inthe EU, lessening the direct impact ofthe new quality system regulation.

Third, ERG estimates of the number oflabor hours needed for design controlsassume that many establishments havelittle or no formal system in place. Oncean establishment has developed asystem, minor modifications to anestablishment’s existing product (forwhich many 510(k) applications andPMA supplements are submitted) maybe less costly than ERG assumed.


Finally, cost estimates assume thatestablishments will use in-houseexpertise or hired consultants for allcompliance activities. In fact, FDA andtrade publications have disseminatedmuch of the information that would beneeded by the firms. FDA has takenmany steps specifically to assist smallbusinesses in complying with this finalrule. The two stage implementation ofthe regulation was a concerted effort toreduce the regulatory burden on smallbusinesses. Stage 1 was set up to be a1 year training and cooperative phasefor the entire medical devicecommunity. FDA and industry would beparticipating in a number of cooperativeefforts as well as joint training exercises.Most importantly, FDA would beevaluating design controls andproviding industry with feedback in thenature of a report. During this time, totruly allow it to be a learning experiencefor both the device manufacturers andthe FDA investigators, there would beno regulatory actions taken as a result ofthese evaluations and reports. Thebiggest benefactor of the two stageimplementation would clearly be smallbusinesses.

Further, several guidances have beenprepared by FDA for this regulation asa whole, as well as on subject mattersthat are significant in this final rule.FDA plans to release the following threeguidances within 60 days after the finalrule is published: (1) DSMA’s ‘‘MedicalDevice Quality Systems Manual: ASmall Entity Compliance Guide,’’ whichincludes discussion on the entireregulation plus multiple examples ofprocedures and forms that can beadopted and modified bymanufacturers; (2) ‘‘Design ControlGuidance For Medical DeviceManufacturers,’’ which is intended toassist manufacturers in understandingthe intent of the design controlrequirements. Assistance is provided byinterpreting the language of theregulation and explaining theunderlying concepts in practical terms;and (3) ‘‘Do It By Design: AnIntroduction to Human Factors inMedical Devices,’’ which containsbackground information about humanfactors as a discipline, descriptions andillustrations of device problems, and adiscussion of human factors principlesand methods as a part of the designcontrol system. FDA also plans torelease the following guidances afterpublication of this final rule: (1) Aguidance on ‘‘Validation,’’ which willinclude discussions on designvalidation, computer validation, andprocess validation; and (2) a draft of the‘‘Design Control Inspectional Strategy,’’

which will be the questions that FDAinvestigators will be asking whenassuring compliance with the designcontrol requirements.

FDA is also prepared to releaseshortly after publication of this finalrule a 4 hour series of videotapesdiscussing the Quality SystemRegulation. The videotapes will also beaccompanied by a guidebook entitled‘‘The FDA and World Wide QualitySystem Requirements Guidebook ForMedical Devices.’’ This guidebook willcontain the entire Quality SystemRegulation from FDA, the entire text ofISO 9001:1994, FDA guidance from theregulation’s preamble, and guidance onquality systems from the GHTF.

FDA has also tentatively scheduledtwo teleconferences. The firstteleconference, which would be todiscuss the Quality System Regulationand answer questions that have come upfrom manufacturers beginning toimplement the regulation, is tentativelyscheduled for December 1996. A secondteleconference is tentatively scheduledfor April/May of 1997 and willspecifically address design controls andthe final Design Control InspectionalStrategy. FDA is also exploring thepossibility of conducting regionalworkshops in May of 1997 to furtherdiscuss the design control requirementsand their implementation.

In addition to these activities, FDAand DSMA will continue to provideguidance and workshops that can helpsmall business with their complianceactivities, and will continue toparticipate in industry associationworkshops, conferences, and meetings.While all of the above-mentionedactivities will be available to allmanufacturers, small manufacturers willbenefit the most from these FDAactivities without having to paysubstantial costs, as most of theguidance and written material will beavailable on the world wide web, andthe teleconferences and otherworkshops sponsored or cosponsored byFDA will be of nominal cost.

Finally, as described elsewhere in thispreamble, FDA intends to conduct amidcourse review of the new designcontrol requirements during thetransition year (June 1997 to June 1998).Specifically, the results of the firstseveral months of design controlinspections will be reviewed by early1998, and any midcourse adjustments tothe inspectional strategy will beinstituted and made public by theSpring of 1998. Also during thismidcourse review FDA will evaluate theinformation gathered at that point anddetermine if the design controlrequirements as written in this final rule

are appropriate to obtain the goalsexpressed in this preamble. Anynecessary adjustments or proposedrevisions will be published in theFederal Register and comments will besolicited as necessary during the springof 1998. This implementation strategy isresponsive to requests by industry forFDA to harmonize the quality systemregulation’s implementation with themandatory date for implementation ofthe EU’s Medical Device Directive,which is June 1998. However, if duringthe midcourse review of stage one it isdetermined that the industry and/orFDA needs more time to fullyimplement the design controlrequirements, FDA will publish thatdecision in the Spring of 1998 prior tothe June 1, 1998, regulatoryimplementation date.

Small businesses will also benefit inthat FDA considered but rejectedapplying design requirements to allclass I devices, because the addedbenefits to public health were not greatenough to offset the increased burdenon industry. Two requirements wereeliminated or modified in the final rulethat decreased the burden on industry:The applicability of the CGMPregulation to component suppliers wasremoved, and § 820.65 Traceability waslimited to traceability of componentswhere necessary to assure the protectionof public health. These changes willparticularly aid small businesses. Inaddition, revisions were made to manyrequirements in the final rule to makeit less prescriptive and to allowestablishments greater flexibility inimplementing the requirements. Costsavings from these changes were notestimated.

In addition, revisions were made tomany requirements in the final rule tomake it less comprehensive in scope,less prescriptive and to allowestablishments greater flexibility inimplementing the requirements. Costsavings from these changes were notestimated. Based on the above, theagency has determined that the currentrule represents the least burdensomealternative that meets the public healthgoal of reducing deaths and seriousinjuries attributable to defective medicaldevices.

In summary, FDA concludes that theestimated $81.9 million annualincremental cost to comply with thefinal CGMP regulation is likely anupward bound figure and that it wouldbe substantially offset by significantsavings from avoided recalls and moreimportantly, the avoidance of deathsand serious injuries due to design-related device failures. FDA’s estimateof public health benefits includes the


prevention of 36 to 44 deaths and 484to 677 serious injuries annually.Establishing design controls will alsoresult in better designed and higherquality devices and fewer devicefailures. This quality improvement willin turn reduce the inconvenience andexpense of repetitive treatments ordiagnoses. The agency also believes theactual cost to comply with the final rulewill be lower than estimated becausethe industry compliance baselines usedto estimate costs are from 1993. Sincethat time, market pressures haveinduced many firms that export to theEU to become ISO 9001:1994 certified.These firms would now be incompliance with most of FDA’s finalCGMP regulation. Further, FDA hasprovided continued education efforts

over the past 15 years, to mitigateindustry costs.

IX. Paperwork Reduction Act of 1995This final rule contains information

collections that are subject to review byOMB under the Paperwork ReductionAct of 1995 (Pub. L. 104–13). The title,description and respondents of theinformation collection are shown belowwith an estimate of the annualincremental increase in therecordkeeping burden that respondentsmust undertake to achieve compliancewith the final regulation.

Title: Medical Devices, QualitySystem Regulations, Current GoodManufacturing Practice Requirements.

Description: This final quality systemregulation amends and revises thecurrent good manufacturing practice

requirements for medical devices, setout at 21 CFR part 820. This finalregulation replaces quality assuranceprogram requirements with qualitysystem requirements; adds design andpurchasing controls; modifies thecritical device requirements; revisescertain existing requirements, such asvalidation and managementresponsibility, to clarify the intent of therequirements; and harmonizes theCGMP regulations for medical deviceswith quality system specifications inISO 9001:1994 ‘‘Quality Systems-Modelfor Quality Assurance in Design,Development, Production, Installationand Servicing.’’

Description of Respondents: Businessor other for-profit and small businessesor organizations.

CFR sectionNumber of

record-keep-ers

Annual fre-quency of rec-

ordkeeping

Total annualrecords

Hours perrecord-keeper Total hours

Total operat-ing and main-tenance costs

820.20(a) ................................................... 7,237 1 7,237 10.96 79,386 ........................820.20(b) ................................................... 7,237 1 7,237 4.88 35,285 ........................820.20(c) ................................................... 7,237 1 7,237 10.28 74,364 ........................820.20(d) ................................................... 7,237 1 7,237 16.49 119,305 ........................820.20(e) ................................................... 7,237 1 7,237 16.49 119,305 ........................820.22(a) ................................................... 7,237 1 7,237 52.03 376,507 ........................820.25(b) ................................................... 7,237 1 7,237 21.13 152,896 ........................820.30(a)(1) .............................................. 7,237 1 7,237 2.92 21,162 ........................820.30(b) ................................................... 7,237 1 7,237 9.91 71,718 ........................820.30(c) ................................................... 7,237 1 7,237 2.92 21,162 ........................820.30(d) ................................................... 7,237 1 7,237 2.92 21,162 ........................820.30(e) ................................................... 7,237 1 7,237 38.98 282,115 ........................820.30(f) .................................................... 7,237 1 7,237 62.37 451,342 $27,359,420820.30(g) ................................................... 7,237 1 7,237 62.37 451,342 ........................820.30(h) ................................................... 7,237 1 7,237 5.56 40,236 ........................820.30(i) .................................................... 7,237 1 7,237 28.77 208,173 ........................820.30(j) .................................................... 7,237 1 7,237 4.40 31,848 ........................820.40 ....................................................... 7,237 1 7,237 11.76 85,081 ........................820.40(b) ................................................... 7,237 1 7,237 ........................ ........................ ........................820.50 (a)(1) to (a)(3) ............................... 7,237 1 7,237 31.12 225,240 898,500820.50(b) ................................................... 7,237 1 7,237 10.04 72,679820.60 ....................................................... 7,237 1 7,237 0.54 3,914 ........................820.65 ....................................................... 7,237 1 7,237 ........................ ........................ ........................820.70 (a)(1) to (a)(5) ............................... 7,237 1 7,237 ........................ ........................ ........................820.70 (b)–(c) ........................................... 7,237 1 7,237 ........................ ........................ ........................820.70(d) ................................................... 7,237 1 7,237 3.09 22,335 ........................820.70(e) ................................................... 7,237 1 7,237 ........................ ........................ ........................820.70 (g)(1) to (g)(3) ............................... 7,237 1 7,237 ........................820.70(h) ................................................... 7,237 1 7,237 ........................ ........................ ........................820.70(i) .................................................... 7,237 1 7,237 9.41 68,092 ........................829.72(a) ................................................... 7,237 1 7,237 5.83 42,165 ........................820.72 (b)(1) to (b)(3) ............................... 7,237 1 7,237 ........................ ........................ ........................820.75(a) ................................................... 7,237 1 7,23 72.79 20,172 ........................820.75(b) ................................................... 7,237 1 7,237 ........................ ........................ ........................820.75(b)(2) .............................................. 7,237 1 7,237 0.15 1,096 ........................820.75(c) ................................................... 7,237 1 7,237 0.15 1,096 ........................820.80 (a)–(e) ........................................... 7,237 1 7,237 ........................ ........................ ........................820.86 ....................................................... 7,237 1 7,237 ........................ ........................ ........................820.90(a) ................................................... 7,237 1 7,237 6.11 44,217 ........................820.90 (b)(1) to (b)(2) ............................... 7,237 1 7,237 6.11 44,217 ........................820.100 (a)(1) to (a)(7) ............................. 7,237 1 7,237 20.06 145,144 ........................820.100(b) ................................................. 7,237 1 7,237 ........................ ........................ ........................820.120 ..................................................... 7,237 1 7,237 ........................ ........................ ........................820.120(b) ................................................. 7,237 1 7,237 ........................ ........................ ........................820.120(d) ................................................. 7,237 1 7,237 ........................ ........................ ........................820.130 ..................................................... 7,237 1 7,237 ........................ ........................ ........................820.140 ..................................................... 7,237 1 7,237 9.45 68,418 ........................820.150 (a)–(b) ......................................... 7,237 1 7,237 9.45 68,418 ........................820.160 (a)–(b) ......................................... 7,237 1 7,237 ........................ ........................ ........................


CFR sectionNumber of

record-keep-ers

Annual fre-quency of rec-

ordkeeping

Total annualrecords

Hours perrecord-keeper Total hours

Total operat-ing and main-tenance costs

820.170 (a)–(b) ......................................... 7,237 1 7,237 ........................ ........................ ........................820.180 ..................................................... 7,237 1 7,237 ........................ ........................ ........................820.181 (a)–(e) ......................................... 7,237 1 7,237 ........................ ........................ ........................820.184 (a)–(f) .......................................... 7,237 1 7,237 ........................ ........................ ........................820.186 ..................................................... 7,237 1 7,237 ........................ ........................ ........................820.198 (a)–(c) ......................................... 7,237 1 7,237 3.71 26,850 ........................820.200(a) and 820.200(d) ....................... 7,237 1 7,237 4.35 31,459 ........................820.250 ..................................................... 7,237 1 7,237 ........................ ........................ ........................

Totals .......................................... 7,237 1 7,237 487.50 3,527,901 28,257,920

1 Incremental increase in hours and costs to achieve compliance with additional requirements.Note: Totals may not add due to rounding

Under OMB information collection0910–0073, which expired on June 30,1995, there were 375,266 burden hoursapproved for recordkeepingrequirements currently contained inpart 820 to include 114,882 burdenhours as a one time start up expenditurefor 750 new firms. The additionalrequirements contained in this final rulewill add 3,527,901 burden hours to theburden, resulting in a total annualrecordkeeping burden of 3,903,167hours. The 3,527,901 burden hoursincludes 1,433,579 burden hours for aone time start up expenditure for 7,237manufacturers and 2,094,321 burdenhours expended annually by 7,237manufacturers.

The final rule estimate ofrecordkeeping burden includes about9.6 times as many manufacturers with aone time start up expenditure, due tothe addition of the design controlrequirements, than did FDA’s estimateof the manufacturers that would havehad a one time start up expenditureunder the old regulation. Further therecordkeeping burden hour calculationsfor the new regulation were done undercontract using a more complexmethodology involving the estimatednoncompliance ratio for small, medium,large, and very large manufacturers (asdefined above) times the number ofmanufacturers in each category andfactors in a rate of product innovationfor new products, including 510(k)devices. This methodology is moreprecise than the methodologypreviously utilized. Therefore, it is verydifficult to directly compare the totalburden hours in this final rule ascompared to the estimated burden hoursfiled for the old regulation whichexpired June 1995.

Approximately 85 percent of theadditional burden hours for the finalrule are from the following four subpartsof part 820: (1) Subpart B—QualitySystem Requirements; (2) Subpart C—Design Controls; (3) Subpart E—Purchasing Controls; and (4) Subpart J—

Corrective and Preventive Action. Over45 percent of the 3,527,901 burdenhours are attributed directly to theaddition of design control requirements.The recordkeeping burden hours fordesign control are significant because ofthe nature of the new requirements, aswell as in response to numerouscomments on the 1993 and 1995proposals. The comments requested thatthe regulation focus on proceduresrequired under design control ascompared to prescriptive requirementson the design activities. The qualitysystem requirements, as well as thecorrective and preventive actionrequirements combined areapproximately 31 percent of theadditional recordkeeping burden hoursand were in response to two majorissues: (1) Most importantly, FDA hadidentified these two areas as two of thetop four deficiencies found duringinspections of the medical deviceindustry, across all sizes ofmanufacturers; and (2) numerouscomments requested harmonizationwith the ISO 9000 series standards. Theinvolvement of management withexecutive responsibility, the concept ofa total quality system which is a closedfeedback loop system, and the practiceof using that closed loop system intaking appropriate corrective andpreventive action is paramount inensuring that safe and effective medicaldevices are available to the public. Thepurchasing control requirements andthe respective recordkeeping burden areapproximately 8 percent of theadditional recordkeeping burden.Purchasing requirements were theoverwhelming choice of the medicaldevice industry as compared to theoption of the final rule encompassingcomponent manufacturers. See thediscussion in section V.7. of thisdocument.

It is important to note that smallmanufacturers may comply with thisfinal rule with less procedures andpaperwork than larger manufacturers of

the same product because the structureand interfaces for a small manufactureroften require less documentation andpaperwork.

Although the November 23, 1993,proposed rule provided a 90 daycomment period under the PaperworkReduction Act of 1980, and this finalrule incorporates the commentsreceived, as required by 44 U.S.C.section 3507(d), FDA is providingadditional opportunities for publiccomment under the PaperworkReduction Act of 1995, which applies tothis final rule and was enacted after theexpiration of the comment period.

Therefore, the agency solicits publiccomment on the information collectionrequirements in order to: (1) Evaluatewhether the proposed collection ofinformation is necessary for the properperformance of the functions of theagency, including whether theinformation will have practical utility;(2) evaluate the accuracy of the agency’sestimate of the burden of the proposedcollection of information, including thevalidity of the methodology andassumptions used; (3) enhance thequality, utility, and clarity of theinformation to be collected; and (4)minimize the burden of the collection ofinformation on those who are torespond, including through the use ofappropriate automated, electronic,mechanical, or other technologicalcollection techniques or other forms ofinformation technology, e.g., permittingelectronic submission of responses.

Individuals and organizations maysubmit comments on the informationcollection requirements by December 6,1996, and should direct comments toFDA’s Dockets Management Branch(address above).

Prior to the effective date of this finalrule, FDA will publish a notice in theFederal Register when the informationcollection requirements in this rule aresubmitted for OMB approval, and againwhen OMB makes a decision toapprove, modify, or disapprove the


information collection requirements.Persons are not required to respond toa collection of information unless itdisplays a currently valid OMB controlnumber.

X. Congressional Review

This final rule has been determined tobe a major rule for purposes of 5 U.S.C.801 et seq., Subtitle E of the SmallBusiness Regulatory EnforcementFairness Act of 1996 (Pub. L. 104–121).FDA is submitting the information andreports as required by that statute.

XI. References

The following references have been placedon display in the Dockets ManagementBranch and may be seen by interestedpersons between 9 a.m. and 4 p.m., Mondaythrough Friday.

1. ‘‘Device Recalls: A Study of QualityProblems,’’ FDA, Center for Devices andRadiological Health, Rockville, MD 20857,HHS Publication FDA 90–4235, January1990.

2. ‘‘FDA Medical Device Regulation FromPremarket Review to Recall,’’ Office ofInspector General, Washington, DC, HHSPublication OEI 09–90–00040, February1991.

3. ‘‘Software Related Recalls for FiscalYears FY 83—FY 91,’’ FDA, Center forDevices and Radiological Health, Rockville,MD 20857, May 1992.

4. ISO 9001:1994 ‘‘Quality Systems—Model for Quality Assurance in Design,Development, Production, Installation, andServicing.’’

5. ISO draft revision of ISO/CD 13485‘‘Quality Systems—Medical Devices—Supplementary Requirements to ISO 9001.’’

6. Federal Register notice entitled‘‘Medical Devices; Current GoodManufacturing Practices (CGMP) RegulationsDocument; Suggested Changes; Availability,’’November 30, 1990 (55 FR 49644).

7. Federal Register notice entitled‘‘Medical Devices; Current GoodManufacturing Practice (CGMP) Regulations;Proposed Revisions; Request for Comments,’’November 23, 1993 (55 FR 61952).

8. Federal Register notice entitled‘‘Medical Devices; Working Draft of theCurrent Good Manufacturing Practice(CGMP) Final Rule; Notice of Availability;Request for Comments; Public Meeting,’’ July24, 1995 (60 FR 37856).

9. European Standard (EN) 46001 ‘‘QualitySystems—Medical Devices—ParticularRequirements for the Application of EN29001.’’

10. ‘‘Guidelines on General Principles ofProcess Validation,’’ Center for Drugs andBiologics, and Center for Devices andRadiological Health, FDA, Rockville, MD20857, May 11, 1987.

11. ‘‘Medical Devices; Early Warning ofProblems Is Hampered by SevereUnderreporting,’’ United States GeneralAccounting Office, Washington, DC, GAO/PEMD–87–1.

List of Subjects

21 CFR Part 808Intergovernmental relations, Medical

devices.

21 CFR Part 812Health records, Medical devices,

Medical research, Reporting andrecordkeeping requirements.

21 CFR Part 820Medical devices, Reporting and

recordkeeping requirements.Therefore, under the Federal Food,

Drug, and Cosmetic Act and underauthority delegated to the Commissionerof Food and Drugs, 21 CFR parts 808,812, and 820 are amended as follows:

PART 808—EXEMPTIONS FROMFEDERAL PREEMPTION OF STATEAND LOCAL MEDICAL DEVICEREQUIREMENTS

1. The authority citation for 21 CFRpart 808 is revised to read as follows:

Authority: Secs. 520, 521, 701 of theFederal Food, Drug, and Cosmetic Act (21U.S.C. 360j, 360k, 371).

2. Section 808.1 is amended byadding new paragraph (d)(10) to read asfollows:

§ 808.1 Scope.

* * * * *(d) * * *(10) Part 820 of this chapter (21 CFR

part 820) (CGMP requirements) does notpreempt remedies created by States orTerritories of the United States, theDistrict of Columbia, or theCommonwealth of Puerto Rico.* * * * *

PART 812—INVESTIGATIONALDEVICE EXEMPTIONS

3. The authority citation for 21 CFRpart 812 is revised to read as follows:

Authority: Secs. 301, 501, 502, 503, 505,506, 507, 510, 513–516, 518–520, 701, 702,704, 721, 801, 803 of the Federal Food, Drug,and Cosmetic Act (21 U.S.C. 331, 351, 352,353, 355, 356, 357, 360, 360c-360f, 360h-360j,371, 372, 374, 379e, 381, 383); secs. 215, 301,351, 354–360F of the Public Health ServiceAct (42 U.S.C. 216, 241, 262, 263b-263n).

4. Section 812.1 Scope is amended byrevising the fourth sentence ofparagraph (a) to read as follows:

§ 812.1 Scope.(a) * * * An IDE approved under

§ 812.30 or considered approved under§ 812.2(b) exempts a device from therequirements of the following sectionsof the Federal Food, Drug, and CosmeticAct (the act) and regulations issuedthereunder: Misbranding under section

502 of the act, registration, listing, andpremarket notification under section510, performance standards undersection 514, premarket approval undersection 515, a banned device regulationunder section 516, records and reportsunder section 519, restricted devicerequirements under section 520(e), goodmanufacturing practice requirementsunder section 520(f) except for therequirements found in § 820.30, ifapplicable (unless the sponsor states anintention to comply with theserequirements under § 812.20(b)(3) or§ 812.140(b)(4)(v)) and color additiverequirements under section 721.* * * * *

5. Part 820 is revised to read asfollows:

PART 820—QUALITY SYSTEMREGULATION

Subpart A—General ProvisionsSec.820.1 Scope.820.3 Definitions.820.5 Quality system.

Subpart B—Quality System Requirements820.20 Management responsibility.820.22 Quality audit.820.25 Personnel.

Subpart C—Design Controls820.30 Design controls.

Subpart D—Document Controls820.40 Document controls.

Subpart E—Purchasing Controls820.50 Purchasing controls.

Subpart F—Identification and Traceability820.60 Identification.820.65 Traceability.

Subpart G—Production and ProcessControls820.70 Production and process controls.820.72 Inspection, measuring, and test

equipment.820.75 Process validation.

Subpart H—Acceptance Activities

820.80 Receiving, in-process, and finisheddevice acceptance.

820.86 Acceptance status.

Subpart I—Nonconforming Product820.90 Nonconforming product.

Subpart J—Corrective and PreventiveAction

820.100 Corrective and preventive action.

Subpart K—Labeling and PackagingControl

820.120 Device labeling.820.130 Device packaging.

Subpart L—Handling, Storage, Distribution,and Installation

820.140 Handling.820.150 Storage.


820.160 Distribution.820.170 Installation.

Subpart M—Records

820.180 General requirements.820.181 Device master record.820.184 Device history record.820.186 Quality system record.820.198 Complaint files.

Subpart N—Servicing

820.200 Servicing.

Subpart O—Statistical Techniques

820.250 Statistical techniques.Authority: Secs. 501, 502, 510, 513, 514,

515, 518, 519, 520, 522, 701, 704, 801, 803of the Federal Food, Drug, and Cosmetic Act(21 U.S.C. 351, 352, 360, 360c, 360d, 360e,360h, 360i, 360j, 360l, 371, 374, 381, 383).

Subpart A—General Provisions

§ 820.1 Scope.(a) Applicability.(1) Current good manufacturing

practice (CGMP) requirements are setforth in this quality system regulation.The requirements in this part govern themethods used in, and the facilities andcontrols used for, the design,manufacture, packaging, labeling,storage, installation, and servicing of allfinished devices intended for humanuse. The requirements in this part areintended to ensure that finished deviceswill be safe and effective and otherwisein compliance with the Federal Food,Drug, and Cosmetic Act (the act). Thispart establishes basic requirementsapplicable to manufacturers of finishedmedical devices. If a manufacturerengages in only some operations subjectto the requirements in this part, and notin others, that manufacturer need onlycomply with those requirementsapplicable to the operations in which itis engaged. With respect to class Idevices, design controls apply only tothose devices listed in § 820.30(a)(2).This regulation does not apply tomanufacturers of components or parts offinished devices, but suchmanufacturers are encouraged to useappropriate provisions of this regulationas guidance. Manufacturers of humanblood and blood components are notsubject to this part, but are subject topart 606 of this chapter.

(2) The provisions of this part shall beapplicable to any finished device asdefined in this part, intended for humanuse, that is manufactured, imported, oroffered for import in any State orTerritory of the United States, theDistrict of Columbia, or theCommonwealth of Puerto Rico.

(3) In this regulation the term ‘‘whereappropriate’’ is used several times.When a requirement is qualified by‘‘where appropriate,’’ it is deemed to be

‘‘appropriate’’ unless the manufacturercan document justification otherwise. Arequirement is ‘‘appropriate’’ ifnonimplementation could reasonably beexpected to result in the product notmeeting its specified requirements orthe manufacturer not being able to carryout any necessary corrective action.

(b) Limitations. The quality systemregulation in this part supplementsregulations in other parts of this chapterexcept where explicitly statedotherwise. In the event that it isimpossible to comply with allapplicable regulations, both in this partand in other parts of this chapter, theregulations specifically applicable to thedevice in question shall supersede anyother generally applicable requirements.

(c) Authority. Part 820 is establishedand issued under authority of sections501, 502, 510, 513, 514, 515, 518, 519,520, 522, 701, 704, 801, 803 of the act(21 U.S.C. 351, 352, 360, 360c, 360d,360e, 360h, 360i, 360j, 360l, 371, 374,381, 383). The failure to comply withany applicable provision in this partrenders a device adulterated undersection 501(h) of the act. Such a device,as well as any person responsible for thefailure to comply, is subject toregulatory action.

(d) Foreign manufacturers. If amanufacturer who offers devices forimport into the United States refuses topermit or allow the completion of aFood and Drug Administration (FDA)inspection of the foreign facility for thepurpose of determining compliancewith this part, it shall appear forpurposes of section 801(a) of the act,that the methods used in, and thefacilities and controls used for, thedesign, manufacture, packaging,labeling, storage, installation, orservicing of any devices produced atsuch facility that are offered for importinto the United States do not conform tothe requirements of section 520(f) of theact and this part and that the devicesmanufactured at that facility areadulterated under section 501(h) of theact.

(e) Exemptions or variances. (1) Anyperson who wishes to petition for anexemption or variance from any devicequality system requirement is subject tothe requirements of section 520(f)(2) ofthe act. Petitions for an exemption orvariance shall be submitted according tothe procedures set forth in § 10.30 ofthis chapter, the FDA’s administrativeprocedures. Guidance is available fromthe Center for Devices and RadiologicalHealth, Division of Small ManufacturersAssistance, (HFZ–220), 1350 PiccardDr., Rockville, MD 20850, U.S.A.,telephone 1–800–638–2041 or 1–301–443–6597, FAX 301–443–8818.

(2) FDA may initiate and grant avariance from any device quality systemrequirement when the agencydetermines that such variance is in thebest interest of the public health. Suchvariance will remain in effect only solong as there remains a public healthneed for the device and the devicewould not likely be made sufficientlyavailable without the variance.

§ 820.3 Definitions.(a) Act means the Federal Food, Drug,

and Cosmetic Act, as amended (secs.201–903, 52 Stat. 1040 et seq., asamended (21 U.S.C. 321–394)). Alldefinitions in section 201 of the actshall apply to the regulations in thispart.

(b) Complaint means any written,electronic, or oral communication thatalleges deficiencies related to theidentity, quality, durability, reliability,safety, effectiveness, or performance ofa device after it is released fordistribution.

(c) Component means any rawmaterial, substance, piece, part,software, firmware, labeling, orassembly which is intended to beincluded as part of the finished,packaged, and labeled device.

(d) Control number means anydistinctive symbols, such as adistinctive combination of letters ornumbers, or both, from which thehistory of the manufacturing, packaging,labeling, and distribution of a unit, lot,or batch of finished devices can bedetermined.

(e) Design history file (DHF) means acompilation of records which describesthe design history of a finished device.

(f) Design input means the physicaland performance requirements of adevice that are used as a basis for devicedesign.

(g) Design output means the results ofa design effort at each design phase andat the end of the total design effort. Thefinished design output is the basis forthe device master record. The totalfinished design output consists of thedevice, its packaging and labeling, andthe device master record.

(h) Design review means adocumented, comprehensive, systematicexamination of a design to evaluate theadequacy of the design requirements, toevaluate the capability of the design tomeet these requirements, and to identifyproblems.

(i) Device history record (DHR) meansa compilation of records containing theproduction history of a finished device.

(j) Device master record (DMR) meansa compilation of records containing theprocedures and specifications for afinished device.


(k) Establish means define, document(in writing or electronically), andimplement.

(l) Finished device means any deviceor accessory to any device that issuitable for use or capable offunctioning, whether or not it ispackaged, labeled, or sterilized.

(m) Lot or batch means one or morecomponents or finished devices thatconsist of a single type, model, class,size, composition, or software versionthat are manufactured under essentiallythe same conditions and that areintended to have uniform characteristicsand quality within specified limits.

(n) Management with executiveresponsibility means those senioremployees of a manufacturer who havethe authority to establish or makechanges to the manufacturer’s qualitypolicy and quality system.

(o) Manufacturer means any personwho designs, manufactures, fabricates,assembles, or processes a finisheddevice. Manufacturer includes but is notlimited to those who perform thefunctions of contract sterilization,installation, relabeling,remanufacturing, repacking, orspecification development, and initialdistributors of foreign entitiesperforming these functions.

(p) Manufacturing material means anymaterial or substance used in or used tofacilitate the manufacturing process, aconcomitant constituent, or a byproductconstituent produced during themanufacturing process, which is presentin or on the finished device as a residueor impurity not by design or intent ofthe manufacturer.

(q) Nonconformity means thenonfulfillment of a specifiedrequirement.

(r) Product means components,manufacturing materials, in- processdevices, finished devices, and returneddevices.

(s) Quality means the totality offeatures and characteristics that bear onthe ability of a device to satisfy fitness-for-use, including safety andperformance.

(t) Quality audit means a systematic,independent examination of amanufacturer’s quality system that isperformed at defined intervals and atsufficient frequency to determinewhether both quality system activitiesand the results of such activities complywith quality system procedures, thatthese procedures are implementedeffectively, and that these proceduresare suitable to achieve quality systemobjectives.

(u) Quality policy means the overallintentions and direction of anorganization with respect to quality, as

established by management withexecutive responsibility.

(v) Quality system means theorganizational structure,responsibilities, procedures, processes,and resources for implementing qualitymanagement.

(w) Remanufacturer means anyperson who processes, conditions,renovates, repackages, restores, or doesany other act to a finished device thatsignificantly changes the finisheddevice’s performance or safetyspecifications, or intended use.

(x) Rework means action taken on anonconforming product so that it willfulfill the specified DMR requirementsbefore it is released for distribution.

(y) Specification means anyrequirement with which a product,process, service, or other activity mustconform.

(z) Validation means confirmation byexamination and provision of objectiveevidence that the particularrequirements for a specific intended usecan be consistently fulfilled.

(1) Process validation meansestablishing by objective evidence that aprocess consistently produces a result orproduct meeting its predeterminedspecifications.

(2) Design validation meansestablishing by objective evidence thatdevice specifications conform with userneeds and intended use(s).

(aa) Verification means confirmationby examination and provision ofobjective evidence that specifiedrequirements have been fulfilled.

§ 820.5 Quality system.Each manufacturer shall establish and

maintain a quality system that isappropriate for the specific medicaldevice(s) designed or manufactured, andthat meets the requirements of this part.

Subpart B—Quality SystemRequirements

§ 820.20 Management responsibility.(a) Quality policy. Management with

executive responsibility shall establishits policy and objectives for, andcommitment to, quality. Managementwith executive responsibility shallensure that the quality policy isunderstood, implemented, andmaintained at all levels of theorganization.

(b) Organization. Each manufacturershall establish and maintain anadequate organizational structure toensure that devices are designed andproduced in accordance with therequirements of this part.

(1) Responsibility and authority. Eachmanufacturer shall establish the

appropriate responsibility, authority,and interrelation of all personnel whomanage, perform, and assess workaffecting quality, and provide theindependence and authority necessaryto perform these tasks.

(2) Resources. Each manufacturershall provide adequate resources,including the assignment of trainedpersonnel, for management,performance of work, and assessmentactivities, including internal qualityaudits, to meet the requirements of thispart.

(3) Management representative.Management with executiveresponsibility shall appoint, anddocument such appointment of, amember of management who,irrespective of other responsibilities,shall have established authority overand responsibility for:

(i) Ensuring that quality systemrequirements are effectively establishedand effectively maintained inaccordance with this part; and

(ii) Reporting on the performance ofthe quality system to management withexecutive responsibility for review.

(c) Management review. Managementwith executive responsibility shallreview the suitability and effectivenessof the quality system at definedintervals and with sufficient frequencyaccording to established procedures toensure that the quality system satisfiesthe requirements of this part and themanufacturer’s established qualitypolicy and objectives. The dates andresults of quality system reviews shallbe documented.

(d) Quality planning. Eachmanufacturer shall establish a qualityplan which defines the qualitypractices, resources, and activitiesrelevant to devices that are designedand manufactured. The manufacturershall establish how the requirements forquality will be met.

(e) Quality system procedures. Eachmanufacturer shall establish qualitysystem procedures and instructions. Anoutline of the structure of thedocumentation used in the qualitysystem shall be established whereappropriate.

§ 820.22 Quality audit.Each manufacturer shall establish

procedures for quality audits andconduct such audits to assure that thequality system is in compliance with theestablished quality system requirementsand to determine the effectiveness of thequality system. Quality audits shall beconducted by individuals who do nothave direct responsibility for the mattersbeing audited. Corrective action(s),including a reaudit of deficient matters,


shall be taken when necessary. A reportof the results of each quality audit, andreaudit(s) where taken, shall be madeand such reports shall be reviewed bymanagement having responsibility forthe matters audited. The dates andresults of quality audits and reauditsshall be documented.

§ 820.25 Personnel.(a) General. Each manufacturer shall

have sufficient personnel with thenecessary education, background,training, and experience to assure thatall activities required by this part arecorrectly performed.

(b) Training. Each manufacturer shallestablish procedures for identifyingtraining needs and ensure that allpersonnel are trained to adequatelyperform their assigned responsibilities.Training shall be documented.

(1) As part of their training, personnelshall be made aware of device defectswhich may occur from the improperperformance of their specific jobs.

(2) Personnel who performverification and validation activitiesshall be made aware of defects anderrors that may be encountered as partof their job functions.

Subpart C—Design Controls

§ 820.30 Design controls.(a) General. (1) Each manufacturer of

any class III or class II device, and theclass I devices listed in paragraph (a)(2)of this section, shall establish andmaintain procedures to control thedesign of the device in order to ensurethat specified design requirements aremet.

(2) The following class I devices aresubject to design controls:

(i) Devices automated with computersoftware; and

(ii) The devices listed in the followingchart.

Section Device

868.6810 Catheter, Tracheobronchial Suc-tion.

878.4460 Glove, Surgeon’s.880.6760 Restraint, Protective.892.5650 System, Applicator, Radio-

nuclide, Manual.892.5740 Source, Radionuclide Tele-

therapy.

(b) Design and development planning.Each manufacturer shall establish andmaintain plans that describe orreference the design and developmentactivities and define responsibility forimplementation. The plans shallidentify and describe the interfaces withdifferent groups or activities thatprovide, or result in, input to the design

and development process. The plansshall be reviewed, updated, andapproved as design and developmentevolves.

(c) Design input. Each manufacturershall establish and maintain proceduresto ensure that the design requirementsrelating to a device are appropriate andaddress the intended use of the device,including the needs of the user andpatient. The procedures shall include amechanism for addressing incomplete,ambiguous, or conflicting requirements.The design input requirements shall bedocumented and shall be reviewed andapproved by a designated individual(s).The approval, including the date andsignature of the individual(s) approvingthe requirements, shall be documented.

(d) Design output. Each manufacturershall establish and maintain proceduresfor defining and documenting designoutput in terms that allow an adequateevaluation of conformance to designinput requirements. Design outputprocedures shall contain or makereference to acceptance criteria andshall ensure that those design outputsthat are essential for the properfunctioning of the device are identified.Design output shall be documented,reviewed, and approved before release.The approval, including the date andsignature of the individual(s) approvingthe output, shall be documented.

(e) Design review. Each manufacturershall establish and maintain proceduresto ensure that formal documentedreviews of the design results areplanned and conducted at appropriatestages of the device’s designdevelopment. The procedures shallensure that participants at each designreview include representatives of allfunctions concerned with the designstage being reviewed and anindividual(s) who does not have directresponsibility for the design stage beingreviewed, as well as any specialistsneeded. The results of a design review,including identification of the design,the date, and the individual(s)performing the review, shall bedocumented in the design history file(the DHF).

(f) Design verification. Eachmanufacturer shall establish andmaintain procedures for verifying thedevice design. Design verification shallconfirm that the design output meets thedesign input requirements. The resultsof the design verification, includingidentification of the design, method(s),the date, and the individual(s)performing the verification, shall bedocumented in the DHF.

(g) Design validation. Eachmanufacturer shall establish andmaintain procedures for validating the

device design. Design validation shallbe performed under defined operatingconditions on initial production units,lots, or batches, or their equivalents.Design validation shall ensure thatdevices conform to defined user needsand intended uses and shall includetesting of production units under actualor simulated use conditions. Designvalidation shall include softwarevalidation and risk analysis, whereappropriate. The results of the designvalidation, including identification ofthe design, method(s), the date, and theindividual(s) performing the validation,shall be documented in the DHF.

(h) Design transfer. Eachmanufacturer shall establish andmaintain procedures to ensure that thedevice design is correctly translated intoproduction specifications.

(i) Design changes. Each manufacturershall establish and maintain proceduresfor the identification, documentation,validation or where appropriateverification, review, and approval ofdesign changes before theirimplementation.

(j) Design history file. Eachmanufacturer shall establish andmaintain a DHF for each type of device.The DHF shall contain or reference therecords necessary to demonstrate thatthe design was developed in accordancewith the approved design plan and therequirements of this part.

Subpart D—Document Controls

§ 820.40 Document controls.Each manufacturer shall establish and

maintain procedures to control alldocuments that are required by thispart. The procedures shall provide forthe following:

(a) Document approval anddistribution. Each manufacturer shalldesignate an individual(s) to review foradequacy and approve prior to issuanceall documents established to meet therequirements of this part. The approval,including the date and signature of theindividual(s) approving the document,shall be documented. Documentsestablished to meet the requirements ofthis part shall be available at alllocations for which they are designated,used, or otherwise necessary, and allobsolete documents shall be promptlyremoved from all points of use orotherwise prevented from unintendeduse.

(b) Document changes. Changes todocuments shall be reviewed andapproved by an individual(s) in thesame function or organization thatperformed the original review andapproval, unless specifically designatedotherwise. Approved changes shall be


communicated to the appropriatepersonnel in a timely manner. Eachmanufacturer shall maintain records ofchanges to documents. Change recordsshall include a description of thechange, identification of the affecteddocuments, the signature of theapproving individual(s), the approvaldate, and when the change becomeseffective.

Subpart E—Purchasing Controls

§ 820.50 Purchasing controls.

Each manufacturer shall establish andmaintain procedures to ensure that allpurchased or otherwise receivedproduct and services conform tospecified requirements.

(a) Evaluation of suppliers,contractors, and consultants. Eachmanufacturer shall establish andmaintain the requirements, includingquality requirements, that must be metby suppliers, contractors, andconsultants. Each manufacturer shall:

(1) Evaluate and select potentialsuppliers, contractors, and consultantson the basis of their ability to meetspecified requirements, includingquality requirements. The evaluationshall be documented.

(2) Define the type and extent ofcontrol to be exercised over the product,services, suppliers, contractors, andconsultants, based on the evaluationresults.

(3) Establish and maintain records ofacceptable suppliers, contractors, andconsultants.

(b) Purchasing data. Eachmanufacturer shall establish andmaintain data that clearly describe orreference the specified requirements,including quality requirements, forpurchased or otherwise receivedproduct and services. Purchasingdocuments shall include, wherepossible, an agreement that thesuppliers, contractors, and consultantsagree to notify the manufacturer ofchanges in the product or service so thatmanufacturers may determine whetherthe changes may affect the quality of afinished device. Purchasing data shallbe approved in accordance with§ 820.40.

Subpart F—Identification andTraceability

§ 820.60 Identification.

Each manufacturer shall establish andmaintain procedures for identifyingproduct during all stages of receipt,production, distribution, andinstallation to prevent mixups.

§ 820.65 Traceability.Each manufacturer of a device that is

intended for surgical implant into thebody or to support or sustain life andwhose failure to perform when properlyused in accordance with instructions foruse provided in the labeling can bereasonably expected to result in asignificant injury to the user shallestablish and maintain procedures foridentifying with a control number eachunit, lot, or batch of finished devicesand where appropriate components. Theprocedures shall facilitate correctiveaction. Such identification shall bedocumented in the DHR.

Subpart G—Production and ProcessControls

§ 820.70 Production and process controls.(a) General. Each manufacturer shall

develop, conduct, control, and monitorproduction processes to ensure that adevice conforms to its specifications.Where deviations from devicespecifications could occur as a result ofthe manufacturing process, themanufacturer shall establish andmaintain process control proceduresthat describe any process controlsnecessary to ensure conformance tospecifications. Where process controlsare needed they shall include:

(1) Documented instructions, standardoperating procedures (SOP’s), andmethods that define and control themanner of production;

(2) Monitoring and control of processparameters and component and devicecharacteristics during production;

(3) Compliance with specifiedreference standards or codes;

(4) The approval of processes andprocess equipment; and

(5) Criteria for workmanship whichshall be expressed in documentedstandards or by means of identified andapproved representative samples.

(b) Production and process changes.Each manufacturer shall establish andmaintain procedures for changes to aspecification, method, process, orprocedure. Such changes shall beverified or where appropriate validatedaccording to § 820.75, beforeimplementation and these activitiesshall be documented. Changes shall beapproved in accordance with § 820.40.

(c) Environmental control. Whereenvironmental conditions couldreasonably be expected to have anadverse effect on product quality, themanufacturer shall establish andmaintain procedures to adequatelycontrol these environmental conditions.Environmental control system(s) shallbe periodically inspected to verify thatthe system, including necessary

equipment, is adequate and functioningproperly. These activities shall bedocumented and reviewed.

(d) Personnel. Each manufacturershall establish and maintainrequirements for the health, cleanliness,personal practices, and clothing ofpersonnel if contact between suchpersonnel and product or environmentcould reasonably be expected to have anadverse effect on product quality. Themanufacturer shall ensure thatmaintenance and other personnel whoare required to work temporarily underspecial environmental conditions areappropriately trained or supervised by atrained individual.

(e) Contamination control. Eachmanufacturer shall establish andmaintain procedures to preventcontamination of equipment or productby substances that could reasonably beexpected to have an adverse effect onproduct quality.

(f) Buildings. Buildings shall be ofsuitable design and contain sufficientspace to perform necessary operations,prevent mixups, and assure orderlyhandling.

(g) Equipment. Each manufacturershall ensure that all equipment used inthe manufacturing process meetsspecified requirements and isappropriately designed, constructed,placed, and installed to facilitatemaintenance, adjustment, cleaning, anduse.

(1) Maintenance schedule. Eachmanufacturer shall establish andmaintain schedules for the adjustment,cleaning, and other maintenance ofequipment to ensure that manufacturingspecifications are met. Maintenanceactivities, including the date andindividual(s) performing themaintenance activities, shall bedocumented.

(2) Inspection. Each manufacturershall conduct periodic inspections inaccordance with established proceduresto ensure adherence to applicableequipment maintenance schedules. Theinspections, including the date andindividual(s) conducting theinspections, shall be documented.

(3) Adjustment. Each manufacturershall ensure that any inherentlimitations or allowable tolerances arevisibly posted on or near equipmentrequiring periodic adjustments or arereadily available to personnelperforming these adjustments.

(h) Manufacturing material. Where amanufacturing material couldreasonably be expected to have anadverse effect on product quality, themanufacturer shall establish andmaintain procedures for the use andremoval of such manufacturing material


to ensure that it is removed or limitedto an amount that does not adverselyaffect the device’s quality. The removalor reduction of such manufacturingmaterial shall be documented.

(i) Automated processes. Whencomputers or automated data processingsystems are used as part of productionor the quality system, the manufacturershall validate computer software for itsintended use according to anestablished protocol. All softwarechanges shall be validated beforeapproval and issuance. These validationactivities and results shall bedocumented.

§ 820.72 Inspection, measuring, and testequipment.

(a) Control of inspection, measuring,and test equipment. Each manufacturershall ensure that all inspection,measuring, and test equipment,including mechanical, automated, orelectronic inspection and testequipment, is suitable for its intendedpurposes and is capable of producingvalid results. Each manufacturer shallestablish and maintain procedures toensure that equipment is routinelycalibrated, inspected, checked, andmaintained. The procedures shallinclude provisions for handling,preservation, and storage of equipment,so that its accuracy and fitness for useare maintained. These activities shall bedocumented.

(b) Calibration. Calibrationprocedures shall include specificdirections and limits for accuracy andprecision. When accuracy and precisionlimits are not met, there shall beprovisions for remedial action toreestablish the limits and to evaluatewhether there was any adverse effect onthe device’s quality. These activitiesshall be documented.

(1) Calibration standards. Calibrationstandards used for inspection,measuring, and test equipment shall betraceable to national or internationalstandards. If national or internationalstandards are not practical or available,the manufacturer shall use anindependent reproducible standard. Ifno applicable standard exists, themanufacturer shall establish andmaintain an in-house standard.

(2) Calibration records. Theequipment identification, calibrationdates, the individual performing eachcalibration, and the next calibration dateshall be documented. These recordsshall be displayed on or near each pieceof equipment or shall be readilyavailable to the personnel using suchequipment and to the individualsresponsible for calibrating theequipment.

§ 820.75 Process validation.(a) Where the results of a process

cannot be fully verified by subsequentinspection and test, the process shall bevalidated with a high degree ofassurance and approved according toestablished procedures. The validationactivities and results, including the dateand signature of the individual(s)approving the validation and whereappropriate the major equipmentvalidated, shall be documented.

(b) Each manufacturer shall establishand maintain procedures for monitoringand control of process parameters forvalidated processes to ensure that thespecified requirements continue to bemet.

(1) Each manufacturer shall ensurethat validated processes are performedby qualified individual(s).

(2) For validated processes, themonitoring and control methods anddata, the date performed, and, whereappropriate, the individual(s)performing the process or the majorequipment used shall be documented.

(c) When changes or processdeviations occur, the manufacturer shallreview and evaluate the process andperform revalidation where appropriate.These activities shall be documented.

Subpart H—Acceptance Activities

§ 820.80 Receiving, in-process, andfinished device acceptance.

(a) General. Each manufacturer shallestablish and maintain procedures foracceptance activities. Acceptanceactivities include inspections, tests, orother verification activities.

(b) Receiving acceptance activities.Each manufacturer shall establish andmaintain procedures for acceptance ofincoming product. Incoming productshall be inspected, tested, or otherwiseverified as conforming to specifiedrequirements. Acceptance or rejectionshall be documented.

(c) In-process acceptance activities.Each manufacturer shall establish andmaintain acceptance procedures, whereappropriate, to ensure that specifiedrequirements for in-process product aremet. Such procedures shall ensure thatin-process product is controlled untilthe required inspection and tests orother verification activities have beencompleted, or necessary approvals arereceived, and are documented.

(d) Final acceptance activities. Eachmanufacturer shall establish andmaintain procedures for finished deviceacceptance to ensure that eachproduction run, lot, or batch of finisheddevices meets acceptance criteria.Finished devices shall be held inquarantine or otherwise adequately

controlled until released. Finisheddevices shall not be released fordistribution until: (1) The activitiesrequired in the DMR are completed; (2)the associated data and documentationis reviewed; (3) the release is authorizedby the signature of a designatedindividual(s); and (4) the authorizationis dated.

(e) Acceptance records. Eachmanufacturer shall documentacceptance activities required by thispart. These records shall include: (1)The acceptance activities performed; (2)the dates acceptance activities areperformed; (3) the results; (4) thesignature of the individual(s)conducting the acceptance activities;and (5) where appropriate theequipment used. These records shall bepart of the DHR.

§ 820.86 Acceptance status.Each manufacturer shall identify by

suitable means the acceptance status ofproduct, to indicate the conformance ornonconformance of product withacceptance criteria. The identification ofacceptance status shall be maintainedthroughout manufacturing, packaging,labeling, installation, and servicing ofthe product to ensure that only productwhich has passed the requiredacceptance activities is distributed,used, or installed.

Subpart I—Nonconforming Product

§ 820.90 Nonconforming product.(a) Control of nonconforming product.

Each manufacturer shall establish andmaintain procedures to control productthat does not conform to specifiedrequirements. The procedures shalladdress the identification,documentation, evaluation, segregation,and disposition of nonconformingproduct. The evaluation ofnonconformance shall include adetermination of the need for aninvestigation and notification of thepersons or organizations responsible forthe nonconformance. The evaluationand any investigation shall bedocumented.

(b) Nonconformity review anddisposition. (1) Each manufacturer shallestablish and maintain procedures thatdefine the responsibility for review andthe authority for the disposition ofnonconforming product. The proceduresshall set forth the review anddisposition process. Disposition ofnonconforming product shall bedocumented. Documentation shallinclude the justification for use ofnonconforming product and thesignature of the individual(s)authorizing the use.


(2) Each manufacturer shall establishand maintain procedures for rework, toinclude retesting and reevaluation of thenonconforming product after rework, toensure that the product meets its currentapproved specifications. Rework andreevaluation activities, including adetermination of any adverse effect fromthe rework upon the product, shall bedocumented in the DHR.

Subpart J—Corrective and PreventiveAction

§ 820.100 Corrective and preventiveaction.

(a) Each manufacturer shall establishand maintain procedures forimplementing corrective and preventiveaction. The procedures shall includerequirements for:

(1) Analyzing processes, workoperations, concessions, quality auditreports, quality records, service records,complaints, returned product, and othersources of quality data to identifyexisting and potential causes ofnonconforming product, or other qualityproblems. Appropriate statisticalmethodology shall be employed wherenecessary to detect recurring qualityproblems;

(2) Investigating the cause ofnonconformities relating to product,processes, and the quality system;

(3) Identifying the action(s) needed tocorrect and prevent recurrence ofnonconforming product and otherquality problems;

(4) Verifying or validating thecorrective and preventive action toensure that such action is effective anddoes not adversely affect the finisheddevice;

(5) Implementing and recordingchanges in methods and proceduresneeded to correct and prevent identifiedquality problems;

(6) Ensuring that information relatedto quality problems or nonconformingproduct is disseminated to thosedirectly responsible for assuring thequality of such product or theprevention of such problems; and

(7) Submitting relevant informationon identified quality problems, as wellas corrective and preventive actions, formanagement review.

(b) All activities required under thissection, and their results, shall bedocumented.

Subpart K—Labeling and PackagingControl

§ 820.120 Device labeling.

Each manufacturer shall establish andmaintain procedures to control labelingactivities.

(a) Label integrity. Labels shall beprinted and applied so as to remainlegible and affixed during the customaryconditions of processing, storage,handling, distribution, and whereappropriate use.

(b) Labeling inspection. Labeling shallnot be released for storage or use untila designated individual(s) has examinedthe labeling for accuracy including,where applicable, the correct expirationdate, control number, storageinstructions, handling instructions, andany additional processing instructions.The release, including the date andsignature of the individual(s)performing the examination, shall bedocumented in the DHR.

(c) Labeling storage. Eachmanufacturer shall store labeling in amanner that provides properidentification and is designed to preventmixups.

(d) Labeling operations. Eachmanufacturer shall control labeling andpackaging operations to prevent labelingmixups. The label and labeling used foreach production unit, lot, or batch shallbe documented in the DHR.

(e) Control number. Where a controlnumber is required by § 820.65, thatcontrol number shall be on or shallaccompany the device throughdistribution.

§ 820.130 Device packaging.Each manufacturer shall ensure that

device packaging and shippingcontainers are designed and constructedto protect the device from alteration ordamage during the customaryconditions of processing, storage,handling, and distribution.

Subpart L—Handling, Storage,Distribution, and Installation

§ 820.140 Handling.Each manufacturer shall establish and

maintain procedures to ensure thatmixups, damage, deterioration,contamination, or other adverse effectsto product do not occur duringhandling.

§ 820.150 Storage.(a) Each manufacturer shall establish

and maintain procedures for the controlof storage areas and stock rooms forproduct to prevent mixups, damage,deterioration, contamination, or otheradverse effects pending use ordistribution and to ensure that noobsolete, rejected, or deterioratedproduct is used or distributed. When thequality of product deteriorates overtime, it shall be stored in a manner tofacilitate proper stock rotation, and itscondition shall be assessed asappropriate.

(b) Each manufacturer shall establishand maintain procedures that describethe methods for authorizing receipt fromand dispatch to storage areas and stockrooms.

§ 820.160 Distribution.

(a) Each manufacturer shall establishand maintain procedures for control anddistribution of finished devices toensure that only those devices approvedfor release are distributed and thatpurchase orders are reviewed to ensurethat ambiguities and errors are resolvedbefore devices are released fordistribution. Where a device’s fitness foruse or quality deteriorates over time, theprocedures shall ensure that expireddevices or devices deteriorated beyondacceptable fitness for use are notdistributed.

(b) Each manufacturer shall maintaindistribution records which include orrefer to the location of:

(1) The name and address of theinitial consignee;

(2) The identification and quantity ofdevices shipped;

(3) The date shipped; and(4) Any control number(s) used.

§ 820.170 Installation.

(a) Each manufacturer of a devicerequiring installation shall establish andmaintain adequate installation andinspection instructions, and whereappropriate test procedures. Instructionsand procedures shall include directionsfor ensuring proper installation so thatthe device will perform as intendedafter installation. The manufacturershall distribute the instructions andprocedures with the device or otherwisemake them available to the person(s)installing the device.

(b) The person installing the deviceshall ensure that the installation,inspection, and any required testing areperformed in accordance with themanufacturer’s instructions andprocedures and shall document theinspection and any test results todemonstrate proper installation.

Subpart M—Records

§ 820.180 General requirements.

All records required by this part shallbe maintained at the manufacturingestablishment or other location that isreasonably accessible to responsibleofficials of the manufacturer and toemployees of FDA designated toperform inspections. Such records,including those not stored at theinspected establishment, shall be madereadily available for review and copyingby FDA employee(s). Such records shallbe legible and shall be stored to


minimize deterioration and to preventloss. Those records stored in automateddata processing systems shall be backedup.

(a) Confidentiality. Records deemedconfidential by the manufacturer may bemarked to aid FDA in determiningwhether information may be disclosedunder the public information regulationin part 20 of this chapter.

(b) Record retention period. Allrecords required by this part shall beretained for a period of time equivalentto the design and expected life of thedevice, but in no case less than 2 yearsfrom the date of release for commercialdistribution by the manufacturer.

(c) Exceptions. This section does notapply to the reports required by§ 820.20(c) Management review,§ 820.22 Quality audits, and supplieraudit reports used to meet therequirements of § 820.50(a) Evaluationof suppliers, contractors, andconsultants, but does apply toprocedures established under theseprovisions. Upon request of adesignated employee of FDA, anemployee in management withexecutive responsibility shall certify inwriting that the management reviewsand quality audits required under thispart, and supplier audits whereapplicable, have been performed anddocumented, the dates on which theywere performed, and that any requiredcorrective action has been undertaken.

§ 820.181 Device master record.Each manufacturer shall maintain

device master records (DMR’s). Eachmanufacturer shall ensure that eachDMR is prepared and approved inaccordance with § 820.40. The DMR foreach type of device shall include, orrefer to the location of, the followinginformation:

(a) Device specifications includingappropriate drawings, composition,formulation, component specifications,and software specifications;

(b) Production process specificationsincluding the appropriate equipmentspecifications, production methods,production procedures, and productionenvironment specifications;

(c) Quality assurance procedures andspecifications including acceptancecriteria and the quality assuranceequipment to be used;

(d) Packaging and labelingspecifications, including methods andprocesses used; and

(e) Installation, maintenance, andservicing procedures and methods.

§ 820.184 Device history record.Each manufacturer shall maintain

device history records (DHR’s). Each

manufacturer shall establish andmaintain procedures to ensure thatDHR’s for each batch, lot, or unit aremaintained to demonstrate that thedevice is manufactured in accordancewith the DMR and the requirements ofthis part. The DHR shall include, orrefer to the location of, the followinginformation:

(a) The dates of manufacture;(b) The quantity manufactured;(c) The quantity released for

distribution;(d) The acceptance records which

demonstrate the device is manufacturedin accordance with the DMR;

(e) The primary identification labeland labeling used for each productionunit; and

(f) Any device identification(s) andcontrol number(s) used.

§ 820.186 Quality system record.Each manufacturer shall maintain a

quality system record (QSR). The QSRshall include, or refer to the location of,procedures and the documentation ofactivities required by this part that arenot specific to a particular type ofdevice(s), including, but not limited to,the records required by § 820.20. Eachmanufacturer shall ensure that the QSRis prepared and approved in accordancewith § 820.40.

§ 820.198 Complaint files.(a) Each manufacturer shall maintain

complaint files. Each manufacturer shallestablish and maintain procedures forreceiving, reviewing, and evaluatingcomplaints by a formally designatedunit. Such procedures shall ensure that:

(1) All complaints are processed in auniform and timely manner;

(2) Oral complaints are documentedupon receipt; and

(3) Complaints are evaluated todetermine whether the complaintrepresents an event which is required tobe reported to FDA under part 803 or804 of this chapter, Medical DeviceReporting.

(b) Each manufacturer shall reviewand evaluate all complaints todetermine whether an investigation isnecessary. When no investigation ismade, the manufacturer shall maintaina record that includes the reason noinvestigation was made and the name ofthe individual responsible for thedecision not to investigate.

(c) Any complaint involving thepossible failure of a device, labeling, orpackaging to meet any of itsspecifications shall be reviewed,evaluated, and investigated, unless suchinvestigation has already beenperformed for a similar complaint andanother investigation is not necessary.

(d) Any complaint that represents anevent which must be reported to FDAunder part 803 or 804 of this chaptershall be promptly reviewed, evaluated,and investigated by a designatedindividual(s) and shall be maintained ina separate portion of the complaint filesor otherwise clearly identified. Inaddition to the information required by§ 820.198(e), records of investigationunder this paragraph shall include adetermination of:

(1) Whether the device failed to meetspecifications;

(2) Whether the device was beingused for treatment or diagnosis; and

(3) The relationship, if any, of thedevice to the reported incident oradverse event.

(e) When an investigation is madeunder this section, a record of theinvestigation shall be maintained by theformally designated unit identified inparagraph (a) of this section. The recordof investigation shall include:

(1) The name of the device;(2) The date the complaint was

received;(3) Any device identification(s) and

control number(s) used;(4) The name, address, and phone

number of the complainant;(5) The nature and details of the

complaint;(6) The dates and results of the

investigation;(7) Any corrective action taken; and(8) Any reply to the complainant.(f) When the manufacturer’s formally

designated complaint unit is located ata site separate from the manufacturingestablishment, the investigatedcomplaint(s) and the record(s) ofinvestigation shall be reasonablyaccessible to the manufacturingestablishment.

(g) If a manufacturer’s formallydesignated complaint unit is locatedoutside of the United States, recordsrequired by this section shall bereasonably accessible in the UnitedStates at either:

(1) A location in the United Stateswhere the manufacturer’s records areregularly kept; or

(2) The location of the initialdistributor.

Subpart N—Servicing

§ 820.200 Servicing.(a) Where servicing is a specified

requirement, each manufacturer shallestablish and maintain instructions andprocedures for performing and verifyingthat the servicing meets the specifiedrequirements.

(b) Each manufacturer shall analyzeservice reports with appropriate


statistical methodology in accordancewith § 820.100.

(c) Each manufacturer who receives aservice report that represents an eventwhich must be reported to FDA underpart 803 or 804 of this chapter shallautomatically consider the report acomplaint and shall process it inaccordance with the requirements of§ 820.198.

(d) Service reports shall bedocumented and shall include:

(1) The name of the device serviced;(2) Any device identification(s) and

control number(s) used;(3) The date of service;

(4) The individual(s) servicing thedevice;

(5) The service performed; and(6) The test and inspection data.

Subpart O—Statistical Techniques

§ 820.250 Statistical techniques.(a) Where appropriate, each

manufacturer shall establish andmaintain procedures for identifyingvalid statistical techniques required forestablishing, controlling, and verifyingthe acceptability of process capabilityand product characteristics.

(b) Sampling plans, when used, shallbe written and based on a valid

statistical rationale. Each manufacturershall establish and maintain proceduresto ensure that sampling methods areadequate for their intended use and toensure that when changes occur thesampling plans are reviewed. Theseactivities shall be documented.

Dated: October 1, 1996.David A. Kessler,Commissioner of Food and Drugs.Donna E. Shalala,Secretary of Health and Human Services.[FR Doc. 96–25720 Filed 10–3–96; 11:22 am]BILLING CODE 4160–01–P