Industry Update – Guidance Document published by FDA for Small Entities

FDA published a final rule in the Federal Register entitled “Medical Devices; Laboratory Developed Tests” (“LDT Final Rule”), amending FDA regulations to make explicit that in vitro diagnostic products (IVDs) are devices under the Federal Food, Drug, and Cosmetic Act (FD&C Act) including when the manufacturer of the IVD is a laboratory . 

The FDA has published a Guidance document for small entities –  “Small Entity Compliance Guide” to assist small entities to comply with the  requirements established in FDA regulations as they apply to IVDs, including LDTs.

Source: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/laboratory-developed-tests-small-entity-compliance-guide

Industry Update – QMSR for Medical Devices

The Quality Management System Regulation (QMSR) for Medical Devices, released by the FDA on January 31, 2024, is a significant update to the existing Quality System (QS) regulation (21 CFR Part 820). This new rule aims to:

Harmonize with international standards, specifically the ISO 13485:2016 standard for medical device quality management systems. This will streamline processes for manufacturers who export to other countries.

Modernize the requirements, reflecting best practices in quality management and aligning with current technologies and approaches.

Increase flexibility for manufacturers, allowing them to tailor their quality systems to their specific needs while still meeting essential safety and effectiveness requirements.

Key points of the QMSR:

Incorporation by reference of ISO 13485:2016: This means that manufacturers can largely follow the ISO standard to meet the FDA’s requirements, with some additional clarifications and modifications outlined in the QMSR.

Focus on risk management: The QMSR emphasizes a proactive approach to identifying and mitigating potential risks throughout the product lifecycle.

Quality by design: The QMSR encourages manufacturers to build quality into their products from the start, rather than relying on inspections and testing to catch problems later.

Increased transparency: The QMSR requires manufacturers to maintain more comprehensive documentation and make certain information available to the FDA upon request.

Important dates:

Publication date: January 31, 2024

Effective date: February 2, 2026

The rule is effective two years after publication in the Federal Register. Until then manufacturers are required to comply with the QS regulation. The FDA will begin to enforce the QMSR requirements upon the effective date, February 2, 2026.

Source: https://www.fda.gov/

Cybersecurity in Medical Devices

FDA requires medical devices be secured against cyberattacks

Medical devices are increasingly connected to the Internet, hospital networks, and other medical devices to provide features that improve health care and increase the ability of health care providers to treat patients. These same features also increase potential cybersecurity risks. Medical devices, like other computer systems, can be vulnerable to security breaches, potentially impacting the safety and effectiveness of the device.

Under FDA guidance issued this week, all new medical device applicants must now submit a plan on how to “monitor, identify, and address” cybersecurity issues, as well as create a process that provides “reasonable assurance” that the device in question is protected.

Applicants will also need to make security updates and patches available on a regular schedule and in critical situations, and provide the FDA with “a software bill of materials,” including any open-source or other software their devices use.

As part of the new law, the FDA must also update its medical device cybersecurity guidance at least every two years.

Source: https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity