Why does 21 CFR 820 need to be modernized to ISO 13485?

On February 23, 2022, the FDA published a proposed rule for medical device quality system regulation amendments. The FDA planned to implement amended regulations within 12 months, but the consensus of the device industry is that a transition of several years would be necessary. In the proposed rule, the FDA justifies the need for amended regulations based on the “redundancy of effort to comply with two substantially similar requirements,” creating inefficiencies. The FDA also provided estimates of projected cost savings resulting from the proposed rule. What is completely absent from the proposed rule is any mention of the need for modernization of device regulations.

Timestamps
0:00 - The proposed change in US quality system requirements
0:57 - I disagree with the rationale
2:41 - What should the impact analysis focus on?
3:24 - What software was used by this industry in 1996?
4:54 - Cybersecurity in 1996?
5:18 - Risk Management in 1996?
5:35 - Human Factors in 1996?
6:05 - Post-Market Surveillance in 1996?
6:53 - Real gap between 21 CFR 820 and ISO 13485 is a "reboot"
7:46 - Risk Management requirements
8:54 - How do we apply human factors?
9:13 - Should we change? and Who will it cost most?
10:18 - Standards that need to be embedded in the quality system requirements
11:51 - Why we need to modernize the US quality system requirements - conclusions

The QSR is 26 years old, and the regulation does not mention cybersecurity, human factors, or post-market surveillance. Risk is only mentioned once by the regulation, and software is only mentioned seven times. The FDA has "patched" the regulations through guidance documents, but there is a desperate need for new regulations that include critical elements. The transition of quality system requirements for the USA from 21 CFR 820 to ISO 13485:2016 will force regulators to establish policies for compliance with all of the quality system elements that are not in 21 CFR 820.

Companies that do not already have ISO 13485 certification should be proactive by 1) updating their quality system to comply with the ISO 13485 standard and 2) adopting the best practices outlined in the following related standards:
AAMI/TIR57:2016 - Principles For Medical Device Security - Risk Management
IEC 62366-1:2015 - Medical devices — Part 1: Application of usability engineering to medical devices
ISO/TR 20416:2020 - Medical devices — Post-market surveillance for manufacturers
ISO 14971:2019 - Medical Devices - Application Of Risk Management To Medical Devices
IEC 62304:2015 - Medical Device Software - Software Life Cycle Processes
ISO/TR 80002-1:2009 - Medical device software — Part 1: Guidance on the application of ISO 14971 to medical device software
ISO/TR 80002-2:2017 - Medical device software — Part 2: Validation of software for medical device quality systems

In this live-streaming video, we discuss the impact of the US FDA requiring software, risk management, cybersecurity, human factors, and post-market surveillance as part of a medical device company's quality system.

[atianadjafi]

Thank you Rob I started as student watch n learn ur videos, cos I dont have money to purchase standard, but u shortly explain them all. I ended up getting a job. I am very grateful. beauty gave u back!

[rickstockton]

Rob, you make a really good point. I could update a '68 Mustang with Anti-lock Breaks and Collision Air Bags becasue I like the way the Mustang looks, but even my 2017 VW already has that and 20 other major features. I loved, "We *did* have the internet..."

[humanfactorsengineering]

I wouldn't complain if the modernized design controls to include human factors engineering since the usability guidance refers to it as 'Human Factors Validation represents one portion of Design Validation', but then doesn't mention usability of human factors in the QSR anywhere I can find it.