Regulatory Open Forum

If an FDA class I device is, by regulation, exempt from GMP, then it is exempt from all of the GMP (including design controls) except for general requirements concerning records (820.180) and complaint files (820.198), as long as the device is not labeled or otherwise represented as sterile.  A GMP exemption in a device’s corresponding classification regulation presides over the requirements in the FDA’s Quality System Regulation (hereinafter “QS Reg”) codified at 21 Part CFR 820.  The QS Reg requirements do not apply unless a device’s classification regulation first requires GMP.

If one approached 820.30(a)(2) without first applying the aforesaid GMP-exemption filter, then the conclusion would indeed be that design controls are required for all class 1 software devices, even those exempt by regulation from GMP.  But this is not the intent of 820.30(a)(2), nor of the QS Reg in general.  If it were, then by the same rationale, 820.1(a)’s application of the QS Reg to “all" finished devices would likewise demand that we apply part 820 to ALL finished devices, even those exempt by regulation from GMP.  Once again, this is not the intent of the QS Regulation.

Here is some objective background confirming these assertions:

• In comment group 4 of the preamble to the QS Regulation proposed rule (58 FR 61957), the record shows that several comments opposed extending GMP requirements to devices that were presently exempt.  In response, FDA said that the proposed revised GMP requirements [i.e., the QS Reg] would apply, as did the original 1978 GMP, to manufacturers of finished devices distributed in the United States, UNLESS SPECIFICALLY EXEMPT BY REGULATION.  FDA clarified that firms exempt by regulation from the 1978 GMP would continue to be exempt from the revised GMP of the QS Regulation.  Remember that the most significant aspect of the revised GMP is the addition of design control requirements in 820.30.

• To see FDA's practical implementation of this, consider FDA’s current inspection program for medical device establishments.  Therein, FDA inspectors are instructed that, if an inspection was originally planned for a class I “QS non-exempt”, class II, or class III firm, and the inspection finds that the firm no longer makes class I QS non-exempt, class II, or class III devices, then the investigator is to review the complaint handling system and MDR practices and terminate the inspection.  If FDA intended that all class 1 software devices be subject to design controls (or, based on the same rationale, that "all" finished devices be subject to the QS Reg) regardless of a device’s presiding regulatory exemption from GMP, then FDA would certainly not exclude design controls and terminate the inspection when discovering that a firm only makes class I QS (i.e., GMP) exempt devices.

Hope this helps,

My strong recommendation is that we be very sensitive about the context in which any compliance interpretation is made.  For example, in 820.1(a), FDA/CDRH makes a blanket statement that Part 820 governs ALL finished devices for human use.  But when taken in the proper context of what FDA said when promulgating Part 820, the actual requirement is that Part 820 applies to all finished devices for human use unless specifically exempted by regulation.

The notion of applying Part 820 (i.e., the GMP) and the requirements therein doesn't arise until an originating device classification regulation calls for GMP.  Remember what happens during the process of promulgating any particular classification regulation:  If a classification panel recommends class I, then the panel also states whether the device should be exempted from section 520(f) (i.e., FDA’s specific legal authority for the good manufacturing practice requirements of the quality system regulation) of the FD&C Act.  And if the panel's recommendation persists into the final promulgated regulation, then it means that the FDA Commissioner officially concurred.

An example of a class I GMP-exempt device that often nowadays includes software is a visual acuity chart.  For the visual acuity chart classification regulation (886.1150), FDA states, “This device is also exempted from the GMP regulation, except for general requirements concerning records (820.180) and complaint files (820.198), as long as the device is not labeled or otherwise represented as sterile.”

My personal opinion is that when a group of attendees and faculty attend a training program aimed at detailing the requirements within the Quality System Regulation, it is generally a foregone conclusion that the scope and the discussions therein are in regards to devices for which GMP is a requirement.  And within that context, it is indeed true that class I devices automated with computer software always require design controls.

My strong recommendation is that we be very sensitive about the context in which any compliance interpretation is made.  For example, in 820.1(a), FDA/CDRH makes a blanket statement that Part 820 governs ALL finished devices for human use.  But when taken in the proper context of what FDA said when promulgating Part 820, the actual requirement is that Part 820 applies to all finished devices for human use unless specifically exempted by regulation.

The notion of applying Part 820 (i.e., the GMP) and the requirements therein doesn't arise until an originating device classification regulation calls for GMP.  Remember what happens during the process of promulgating any particular classification regulation:  If a classification panel recommends class I, then the panel also states whether the device should be exempted from section 520(f) (i.e., FDA’s specific legal authority for the good manufacturing practice requirements of the quality system regulation) of the FD&C Act.  And if the panel's recommendation persists into the final promulgated regulation, then it means that the FDA Commissioner officially concurred.

An example of a class I GMP-exempt device that often nowadays includes software is a visual acuity chart.  For the visual acuity chart classification regulation (886.1150), FDA states, “This device is also exempted from the GMP regulation, except for general requirements concerning records (820.180) and complaint files (820.198), as long as the device is not labeled or otherwise represented as sterile.”

My personal opinion is that when a group of attendees and faculty attend a training program aimed at detailing the requirements within the Quality System Regulation, it is generally a foregone conclusion that the scope and the discussions therein are in regards to devices for which GMP is a requirement.  And within that context, it is indeed true that class I devices automated with computer software always require design controls.

My strong recommendation is that we be very sensitive about the context in which any compliance interpretation is made.  For example, in 820.1(a), FDA/CDRH makes a blanket statement that Part 820 governs ALL finished devices for human use.  But when taken in the proper context of what FDA said when promulgating Part 820, the actual requirement is that Part 820 applies to all finished devices for human use unless specifically exempted by regulation.

The notion of applying Part 820 (i.e., the GMP) and the requirements therein doesn't arise until an originating device classification regulation calls for GMP.  Remember what happens during the process of promulgating any particular classification regulation:  If a classification panel recommends class I, then the panel also states whether the device should be exempted from section 520(f) (i.e., FDA’s specific legal authority for the good manufacturing practice requirements of the quality system regulation) of the FD&C Act.  And if the panel's recommendation persists into the final promulgated regulation, then it means that the FDA Commissioner officially concurred.

An example of a class I GMP-exempt device that often nowadays includes software is a visual acuity chart.  For the visual acuity chart classification regulation (886.1150), FDA states, “This device is also exempted from the GMP regulation, except for general requirements concerning records (820.180) and complaint files (820.198), as long as the device is not labeled or otherwise represented as sterile.”

My personal opinion is that when a group of attendees and faculty attend a training program aimed at detailing the requirements within the Quality System Regulation, it is generally a foregone conclusion that the scope and the discussions therein are in regards to devices for which GMP is a requirement.  And within that context, it is indeed true that class I devices automated with computer software always require design controls.

My strong recommendation is that we be very sensitive about the context in which any compliance interpretation is made.  For example, in 820.1(a), FDA/CDRH makes a blanket statement that Part 820 governs ALL finished devices for human use.  But when taken in the proper context of what FDA said when promulgating Part 820, the actual requirement is that Part 820 applies to all finished devices for human use unless specifically exempted by regulation.

The notion of applying Part 820 (i.e., the GMP) and the requirements therein doesn't arise until an originating device classification regulation calls for GMP.  Remember what happens during the process of promulgating any particular classification regulation:  If a classification panel recommends class I, then the panel also states whether the device should be exempted from section 520(f) (i.e., FDA’s specific legal authority for the good manufacturing practice requirements of the quality system regulation) of the FD&C Act.  And if the panel's recommendation persists into the final promulgated regulation, then it means that the FDA Commissioner officially concurred.

An example of a class I GMP-exempt device that often nowadays includes software is a visual acuity chart.  For the visual acuity chart classification regulation (886.1150), FDA states, “This device is also exempted from the GMP regulation, except for general requirements concerning records (820.180) and complaint files (820.198), as long as the device is not labeled or otherwise represented as sterile.”

My personal opinion is that when a group of attendees and faculty attend a training program aimed at detailing the requirements within the Quality System Regulation, it is generally a foregone conclusion that the scope and the discussions therein are in regards to devices for which GMP is a requirement.  And within that context, it is indeed true that class I devices automated with computer software always require design controls.

My strong recommendation is that we be very sensitive about the context in which any compliance interpretation is made.  For example, in 820.1(a), FDA/CDRH makes a blanket statement that Part 820 governs ALL finished devices for human use.  But when taken in the proper context of what FDA said when promulgating Part 820, the actual requirement is that Part 820 applies to all finished devices for human use unless specifically exempted by regulation.

The notion of applying Part 820 (i.e., the GMP) and the requirements therein doesn't arise until an originating device classification regulation calls for GMP.  Remember what happens during the process of promulgating any particular classification regulation:  If a classification panel recommends class I, then the panel also states whether the device should be exempted from section 520(f) (i.e., FDA’s specific legal authority for the good manufacturing practice requirements of the quality system regulation) of the FD&C Act.  And if the panel's recommendation persists into the final promulgated regulation, then it means that the FDA Commissioner officially concurred.

An example of a class I GMP-exempt device that often nowadays includes software is a visual acuity chart.  For the visual acuity chart classification regulation (886.1150), FDA states, “This device is also exempted from the GMP regulation, except for general requirements concerning records (820.180) and complaint files (820.198), as long as the device is not labeled or otherwise represented as sterile.”

My personal opinion is that when a group of attendees and faculty attend a training program aimed at detailing the requirements within the Quality System Regulation, it is generally a foregone conclusion that the scope and the discussions therein are in regards to devices for which GMP is a requirement.  And within that context, it is indeed true that class I devices automated with computer software always require design controls.

In reviewing FDA’s various comments made when promulgating the Quality System Regulation, it doesn’t appear that FDA intended for “GMP” and “Quality System Regulation” to mean different things or have different scopes.  For example, the ultimate statement from the Safe Medical Devices Act (SMDA) which gave rise to the QS Reg design control requirements states that the SMDA, “…Adds pre-production design validation to the stages in which the Secretary may require a device to conform to current good manufacturing practice.”  Also noted is that the FD&C Act places these design control requirements under the header “Good manufacturing practice requirements”.   And to expand on what Laura Halper said; 820.1 states that the Quality System Regulation sets forth GMP requirements, and then it includes design in its immediate listing of those requirements.  Also the preamble to the QS Regulation states that the SMDA gave FDA the authority to add design controls “…to the CGMP regulation…”  So I'm hesitant of the notion that FDA views design controls to be separate from GMP.

That said, the feedback Edwin Bills gave from FDA’s OC personnel at the AAMI courses is compelling.  And David Lim provides a very strong argument by citing the quote from FDA’s software validation guidance.  But along with that guidance, FDA also said that “…It represents the Agency’s current thinking on this topic. It does not create or confer any rights for or on any person and does not operate to bind Food and Drug Administration (FDA) or the public. An alternative approach may be used if such approach satisfies the requirements of the applicable statutes and regulations…” 

In reviewing FDA’s various comments made when promulgating the Quality System Regulation, it doesn’t appear that FDA intended for “GMP” and “Quality System Regulation” to mean different things or have different scopes.  For example, the ultimate statement from the Safe Medical Devices Act (SMDA) which gave rise to the QS Reg design control requirements states that the SMDA, “…Adds pre-production design validation to the stages in which the Secretary may require a device to conform to current good manufacturing practice.”  Also noted is that the FD&C Act places these design control requirements under the header “Good manufacturing practice requirements”.   And to expand on what Laura Halper said; 820.1 states that the Quality System Regulation sets forth GMP requirements, and then it includes design in its immediate listing of those requirements.  Also the preamble to the QS Regulation states that the SMDA gave FDA the authority to add design controls “…to the CGMP regulation…”  So I'm hesitant of the notion that FDA views design controls to be separate from GMP.

That said, the feedback Edwin Bills gave from FDA’s OC personnel at the AAMI courses is compelling.  And David Lim provides a very strong argument by citing the quote from FDA’s software validation guidance.  But along with that guidance, FDA also said that “…It represents the Agency’s current thinking on this topic. It does not create or confer any rights for or on any person and does not operate to bind Food and Drug Administration (FDA) or the public. An alternative approach may be used if such approach satisfies the requirements of the applicable statutes and regulations…” 

Arthur, I have to smile, as your first sentence brought to mind the old line about alcohol, tobacco, and firearms.  Personally, I can never get too much in the way of regulatory opinions, interpretations, and expectations.  But that's me.

Certainly a direct answer is the most useful one when you are in a particular situation and just need to find a way forward.  In this case, however, Michael didn't ask for an answer, but for help in understanding.  Perhaps by now he's sorry he asked, but I think it's more likely he got the understanding he needed several comments back and has now gone back to have a little chat with his consultant, leaving the rest of us to pursue yet more understanding, just because we like to do that.  At least, I do.

I don’t want to resurrect a controversy, but rather clarify the understand I now have about design control for devices with software.

The IF … THEN … ELSE construction is useful, but, in this situation, the ELSE clause seems to be more involved than necessary to determine when design controls apply.

IF (QSR Applies)

THEN

IF (Class I device) AND (Automated with software)

THEN (Design Controls apply)

I would, in my webinars and seminars, show a fault tree on a slide to determine when design controls apply. The fault tree is a combination of AND, OR, and NOT gates.

Looking at the fault tree for when Design Controls apply, the relevant segment is

((QSR Applies) AND ((Class I device) AND (Automated with software)))

I’m working on a presentation on Cybersecurity, which includes design control issues. In addition, at least for some issues, cybersecurity seems to be at the intersection of pre-market submissions, Risk Management, and Software Validation. (A Venn diagram would be useful here.)