Combination Product Industry News & Guidance

The Impact of the QMSR Final Rule on Combination Product Developers and Manufacturers

On February 2, 2024, the Food and Drug Administration (FDA) issued a final rule to amend the device current good manufacturing practice (CGMP) requirements of the Quality System Regulation (QSR) to “harmonize and modernize the regulation.” These updates will take effect on February 2, 2026, giving the industry two years to familiarize with the changes and identify the most efficient ways to implement them. 

What should combination product developers and manufacturers look out for in this document? Here are some highlights that will help you strategize your go-forward plan: 

• While there may not be significant substantive changes to the expectations, there are numerous changes in QSR terminology. For example: 

• • “Design History File (DHF)” is being replaced with “Design and Development Files” 
  • “Device Master Record (DMR)” is being replaced with “Medical Device Files” 
  • “Device History Record (DHR)” is being replaced with “Medical Device Records” and “Batch Records” 

• There is a more clearly defined risk-based approach that supports the inclusion of regulatory compliance risk in manufacturers’ safety risk management processes. 
• Another difference is control of labeling and packaging, designed to address the FDA’s opinion that ISO 13485 lacks requirements related to the physical inspection of labeling by the manufacturer. The new requirements are aligned with current 21 C.F.R § 820. 120(b)e, and now requires a prior-to-release individual inspection of a device labels elements. 
• The final rule does not include the previously allowed exemption of developers submitting management review materials, internal audits, and supplier audits from the scope of FDA inspections. According to the FDA’s logic, developers submit these records to notified bodies under the ISO 13485 and MDSAP certification programs, and the elimination of this exception harmonizes global processes.  
• Finally, the implementation period of the rule is now 2 years (vs. 1 year as proposed originally). While this gives companies more time to comply, it is not a huge amount of time (and the clock is already ticking!), so it would be worth addressing sooner rather than later.

A significant Quality Management System (QMS) update in small-to-mid sized companies is definitely a burden. However this time crunch may also exist in larger companies who have in-house device and combination product teams, whereas those resources may be constrained due to other active development projects on established timelines. 

This is a type of activity that may be cost-effectively handled by a consultant. For smaller companies, particularly those that are US-based and may not have pursued 13485 certification or alignment, this may be a bigger issue and warrant more attention. Further note that 13485 certification has no value in regards to this rule – FDA does not recognize this and a company would still be subject to FDA inspection. 

Suttons Creek has deep experience in implementing effective Quality Management Systems for Combination Product Manufacturers under 21 CFR §4 in addition to compliance with ISO 13485:2016, and can assist with assessments, gap analyses, and revisions of such procedures. Additionally, SCI can identify and implement best practices based on learnings from across the industry, which can ultimately lead to increased efficiency, all while enabling internal staff to remain focused on their existing work. 

UPDATE 3/5/2024: 

Further content to consider from the QMSR Final Rule Notice: 

• A fundamental statement generally known by experienced industry personnel, was written very concisely in the Final Rule to provide a useful reference for those without as much background in combination products. 

• • “The regulatory requirements for combination products arise from the statutory and regulatory requirements applicable to drugs, devices, and biological products, which retain their discrete regulatory identities when they are constituent parts of a combination product. At the same time, combination products comprise a distinct category of medical products that can be subject to specialized regulatory requirements, where appropriate.” 

• Risk management is now explicitly called out in the Part 4 combination product requirements. It has always been understood by experts as a key tenet but stated in the “rule books” in a way that everyone entering the combination space necessarily understood. 

• • “The organization shall document one or more processes for risk management in product realization. Records of risk management activities shall be maintained (21 CFR 4.4(b)(1)(ii)).” 

• The CAPA provision in 21 CFR 4 (4.4(b)(1)(iv)) is now “Analysis of data, improvement, and complaint handling.” 

• This provision is now expanded beyond the relatively short CAPA provision from 820,  including the sections 8.4 and 8.5.1-3 of 13485 (which follow practice that is not necessarily followed by most Pharma companies, but we at Suttons Creek recommend and should be a point of emphasis for changes to CP QMSs beyond pure terminology). 

• Note the separation of corrective from preventive action. 

• • “The degree of corrective or preventive action taken to eliminate or minimize actual or potential nonconformities shall be appropriate to the magnitude of the problem and commensurate with the risks encountered and includes processes such as developing procedures for assessing the risk, the actions that need to be taken for different levels of risk, and the methods that correct or prevent the problem from recurring.” 

• ISO 9001:2015 Clause 3 is now incorporated by reference to cover certain definitions included therein (so, it is worth having on hand as a reference in addition to ISO 13485). Both standards are accessible for free via the ANSI Incorporated by Reference Standards Portal.

• The question when to initiate design change control comes up often with our client base, and the below Final Rule content is very helpful in answering that question (we typically see design change control run commensurate with ‘design freeze’ – after design outputs are finalized and/or design verification begins). 

• Additional labeling requirements are included as proposed by the draft rule and consistent with current drug labeling regulations. 

• The FDA further reiterated that it will not rely upon, require, or utilize ISO 13485 certification, and FDA inspections will not result in the issuance of certificates. The FDA also confirmed that combination products are outside of the scope of MDSAP. 

AUTHOR

Jonathan Amaya-Hodges, Director, Technical Services, Suttons Creek, Inc. – Jonathan has over 16 years of multidisciplinary experience in regulated medical products (drugs, biologics, medical devices, and combination products) at multiple global companies. He has practical experience in Development/Engineering, Quality Assurance, and Regulatory Affairs for various types of combination products with a focus on drug delivery. Additional background includes digital health (including smart packaging/connected devices and software as a medical device, or SaMD) and in vitro diagnostics, along with clinical development (bridging) and lifecycle management for combination products. Jonathan engages with the global combination product community by speaking at conferences, lecturing in courses, serving key roles within prominent industry organizations, and interfacing with regulators on a variety of topics.