At a Glance

• The FDA issued a final rule which continues efforts to promote consistency in the regulation of devices and provides timelier introduction of safe and effective high-quality devices for patients.
• Firms that already have an ISO 13485 certification will see few changes necessary to comply with the new rule.
• For firms that do not yet have their ISO 13485 certification, more robust changes may be necessary to operate in compliance with the new rule.

After publishing the proposed regulation nearly two years ago, the FDA has issued its final rule that will make its regulatory framework more closely aligned with the international framework used by many other regulatory authorities around the world. Issued on January 31, 2024, the final rule incorporates the Quality Management System requirements contained in the 2016 version of the International Organization for Standardization, commonly referred to as ISO 13485. This new rule will take effect on February 2, 2026, and is the next step in furthering the FDA’s continued efforts to promote consistency in the regulation of devices and provide timelier introduction of safe and effective high-quality devices for patients.

Under the FDA’s current regulatory framework, medical device manufacturers are required to comply with the Current Good Manufacturing Practice (CGMP) regulations. These regulations provide for systems that assure proper design, monitoring and control of manufacturing processes and facilities. In other words, any company seeking to market a nonexempt, finished medical device in the United States is required to have a quality system in place for — among other things — the design, manufacture, packaging and labeling of the device. There are also requirements concerning data analysis to identify and correct potential quality problems.

The incorporation of the Quality Management System requirements of ISO 13485 into the FDA’s Good Manufacturing practice requirements should streamline the actions and requirements for medical device firms seeking to introduce new products into the market. For firms that already have an ISO 13485 certification, there will be few changes necessary to comply with the new rule, and in many ways, previously certified firms will feel a reduction in regulatory burdens. However, for firms that do not yet have their ISO 13485 certification, more robust changes may be necessary to operate in compliance with the new rule. For example, under the current rule, non-manufacturing firms that were only marketing and/or distributing nonexempt finished medical devices were not required to meet all of the requirements of ISO 13485 or be certified under ISO 13485. But with the introduction of the new rule, all firms manufacturing, marketing or distributing nonexempt finished medical devices must comply with the quality management system requirements of ISO 13485. Incorporating the requirements of ISO 13485 is a long-awaited and substantial step toward providing an integrated approach for medical device firms operating globally and endeavoring to follow both domestic and foreign regulations.

While some changes and additions to existing quality management systems will be required, non-ISO certified firms planning to continue their role in the manufacturing and distribution of medical devices will still be able to continue their operations after the new rule takes effect. Given that the rule does not take effect until February 2026, firms should have adequate time to make the required changes and additions. Our regulatory professionals are well situated to offer guidance to those non-ISO certified firms who wish to continue their operations in this space and to audit existing quality control procedures for those companies that are ISO certified but wish to ensure compliance with the new rule.