A major regulatory move is underway this year. The FDA has officially adopted the QMSR (Quality Management System Regulation). This new regulation links 21 CFR 820 with ISO 13485:2016. Let’s take a close look at what this means.

21 CFR 820, which is, in fact, the US regulation, defines current good manufacturing practices. It requires manufacturers to establish a quality management system that monitors the entire process, from design and prototypes to production of the product in its final form. It also encompasses the entire product lifecycle. This is meant to ensure that the product is safe and effective when designed, made, shipped, received and put into use.

ISO 13485:2016 syncs US requirements with international standards. Previously, products sold globally had to comply with 21 CFR 820 in the US and ISO 13485 elsewhere, which meant separate audits, different quality management and documentation, and the associated higher costs (estimated at up to $500 million) due to these redundancies.

What problem does this solve?

Different nations had different requirements for medical device classes, adoption dates, and labeling. The alignment of 21 CFR 820 and ISO 13485:2016 makes the US FDA QMSR the template for most global regulators. There will always be outliers, but this minimizes and simplifies the safety and trace environment substantially. Furthermore, the FDA update requires Total Product Life Cycle (TPLC) on audits, which will now trace the UDI data through the entire design-build-market process. Checking the quality manual is no longer good enough.

What does this have to do with barcode quality and compliance?

It’s no longer good enough that the barcode looks good when printed. The audit now requires it to pass ISO print quality standards and validate the UDI data structure, including the correct item identifier and data field prefixes and other data characteristics. Since the UDI barcode is required to track the product or drug through its entire life cycle, from design and manufacturing to distribution and usage, barcode verification records are required for a TPLC audit.

More About Verification

There are two different FDA-accredited issuing agencies for UDI in the US: GS1 and HIBCC use different numbering conventions. The fact that both systems are FDA-approved does not mean either can be randomly selected. For example, if a TPLC investigator finds that a medical device was registered in the GUDID with an HIBCC structure but the packaging bears a GS1 formatted barcode, that is a traceable compliance failure, not just a printing error.

What Happens if a Barcode Fails?

TPLC produces a framework to trace the failure upstream, to the printer, graphics designer and even the data from the issuing agency. This strongly implicates verification: every step should involve a verifier and a report. This is particularly critical in GS1-compliant systems because the GS1 system is so complex, with data field prefixes, numeric-only and Alpha-numerical data fields and variable lengths. Even a minor encoding error—a wrong AI, missing field separator or truncated data can result in a symbol that looks OK but fails a verification (and audit) test. And of course, a GS1 barcode will not work in an HIBCC environment: know your distribution channel and what it expects.

The Bottom Line

The QMSR update and TPLC raise the stakes for GS1 and HIBCC and, therefore, for the product manufacturer. It’s no longer a matter of barcode quality and compliance only when the label is printed. The FDA requires that you demonstrate barcode quality and compliance throughout its entire life cycle. And you must have the verification data to prove it.

We can help. Contact us here.