FDA holds the line on remanufacturing definitions in newly finalized guidance

Background: Servicing and remanufacturing – and why the difference matters

• Medical device regulatory oversight does not end at the point of market access, nor do the manufacturing requirements after distribution. Device manufacturers are required to ensure that their products are working as intended over time. Except single-use devices, they can live with their end-users for many years, during which they may need repair, calibration or maintenance. For example, a hospital is likely to keep an MRI machine until it needs to be replaced, and a power wheelchair user will typically keep the chair until physical needs change, or the product has come to the end of its life.
• Remanufacturing versus servicing: What it is and why it matters. f a medical device that is already in distribution over time can come in a variety of forms. In general, the way that FDA’s oversight mechanisms and regulatory requirements apply to these post-market activities depends on what the maintenance activity is meant to do. “Servicing” of a device is an activity intended to return it to its baseline performance specifications, as defined in an original regulatory application. Examples include sharpening a surgical drill intended for re-use to bring it back to its original sharpness, or swapping out a bent or damaged component part of a device with a compatible part. Alternatively, “remanufacturing” of a device is an activity to “process, condition, renovate, repackage, restore, or any other act” that will alter the device’s safety or performance specification or its intended use. These are activities that would lead to the medical device having different specifications compared to its authorization. Here, examples include replacing a damaged part of a medical device with a new part that has a different size, shape or strength than the original part, or instituting a new process with different temperature specifications than were included in the device’s market authorization. While remanufacturing activities are subject to FDA oversight and compliance with quality system regulations, the FDA takes an “enforcement discretion” approach to servicing activities, meaning it declines to enforce the quality system oversight requirements.
• In 2018, FDA issued a report seeking to differentiate the two activities and clarify the regulatory compliance activities expected for each. The report sought to address medical device manufacturer concerns that third-party servicers and Independent Service Organizations (ISOs) were performing remanufacturing activities on their devices without authorization or regulatory compliance, or going beyond the scope of servicing without accurately categorizing it as remanufacturing. Based on feedback from a 2016 workshop and docket, the agency noted in the 2018 report that “A significant portion of the comments, complaints, and adverse event reports alleging inadequate servicing pertain to activities more accurately described as remanufacturing.” While the FDA at the time stated that that there was not good evidence that unregulated servicing activities were an issue, it did highlight a key concern related to a generalized misunderstanding of when “servicing” actually crosses the line into “remanufacturing,” and therefore should be regulated. Later in 2018, the agency hosted another workshop on the subject to discuss “the distinction between medical device servicing and remanufacturing activities to better inform the development of a future draft guidance.”
• That draft guidance came out in 2021. The draft guidance walked through FDA’s stance on the difference between servicing and remanufacturing. This included a codification of the definitions cited above, clarifying that servicing is intended to bring a device back up to its baseline performance specifications, while remanufacturing activities would likely change the fundamental baseline. It also addressed other key terms related to servicing/remanufacturing policy (performance specifications, safety specifications, and intended use). The agency offered six “Guiding Principles” on differentiating between the two types of activities, including a flow chart on applying them, and an appendix of example activities and scenarios when the different definitions and therefore regulatory requirements would apply.
• Reaction to the draft guidance was mixed. In 2021, AgencyIQ conducted an analysis of the comments submitted to the FDA about the draft guidance. At a high level, respondents fell into two camps: device manufacturers largely held that service performed on behalf of the original equipment manufacturer (OEM) should be exempted from the guidance, while also raising questions about how the FDA would go about enforcing its regulatory requirements for entities that are not currently reporting to the agency, given the enforcement discretion for servicing (for example, an entity that identifies itself as a servicer but conducts activities that would be, in the FDA’s definitions, remanufacturing). Device trade associations also specifically flagged concerns about the FDA’s expectations around information in labeling, highlighting issues related to trade secrets and remanufacturing. On the other side of the spectrum, service providers and health delivery organizations (HDOs) invoked the “right to repair,” asking the FDA to allow more flexibility in the definition of “servicer” and urging OEMs to include more information in their labeling to support servicing activities.
• In particular, the issue of self-policing: As noted above, application of the device regulation depends on the type of activity being undertaken. Remanufacturing activities require regulatory compliance – meaning that the regular medical device regulations like registration (of facilities) and listing (of devices) apply, that entities conducting remanufacturing activities must submit reports to the FDA, and that the facilities themselves are subject to FDA inspections. Under the enforcement discretion for servicing activities, those entities are not required to register, list, maintain an FDA-compliant quality system or report to FDA. Therefore, the entities are not inspected by FDA, raising questions of how FDA would know if any servicers were stepping beyond the bounds of that activity and conducting unregulated remanufacturing, or whether the agency would have enough information to take any action. As highlighted at a July 2021 webinar on the draft guidance, both servicing industry representatives and those from the device industry flagged overlap in the definitions in the guidance – thereby raising concerns for industry that some entities would simply self-identify as servicers and conduct remanufacturing without any oversight.
• How did the FDA respond to the questions? In general, the agency has maintained that the remanufacturing guidance does not represent a change in policy – rather, it simply clarifies the definitions that FDA already uses and the expectations it already has. In general, that means that the agency was not particularly open to feedback on the definitions in the guidance, because from its perspective they were already in use and implemented.
• The final remanufacturing guidance was expected this year. Also this year, the FDA finalized its new rule on overhauling the medical device quality system regulations. That rule, the Quality System Management Regulations (QMSR), was finalized in January 2024. Under that rule, the FDA will replace its existing quality system regulation (QSR) with the QMSR in February 2026; this means that entities conducting remanufacturing activities will need to move to the new system in two years.

In April 2024, FDA finalized the medical device remanufacturing guidance

• First up: The final guidance maintains the FDA’s stance. The agency has not updated the specific policies in the final guidance compared to either the draft guidance or its long-held understanding of the remanufacturing/servicing landscape. While the FDA has made some wording changes (e.g., using “entity” instead of “manufacturer” in some places, replacing words like “altering” with more descriptive terms like “removing, modifying”), and has added in a few examples of the types of changes it’s talking about, the significant majority of the guidance was finalized as drafted.
• This is unsurprising, given the FDA’s longstanding stance on this issue. As described above, the remanufacturing guidance has always been, from FDA’s perspective, a transparent description of a policy that the agency considers to be already in place, and not an actual change or update to the standing policy.
• The final guidance is about five pages longer than the draft version, because the FDA has inserted a new section in the middle: Section VIII, Regulatory Requirements and Considerations for Remanufacturers.
• What’s in the new Section VIII: An overview of the existing medical device requirements. As the guidance describes in a footnote, “The intent of this section is to provide additional insights for entities that may be less familiar with the FDA’s medical device regulatory requirements.” The new pages of the guidance lay out, at a very high level, a general recap of the medical device regulatory requirements – including registration and listing (21 CFR 807), device reporting (MDR) and notification (21 CFR parts 803 and 1003), quality system requirements (21 CFR 820), labeling (21 CFR 801, 809, 830, and 1010) as well as the various pre-market requirements and pathways. They do read as a primer to medical device regulation, and are likely targeted at organizations defining themselves as servicers but undertaking activities that would be considered remanufacturing under the guidance.
• There is also one new note in the labeling provisions: Likely due to the concerns (described above) from the device industry, the FDA now includes a new sentence in section IX (Considerations for Labeling) of the guidance. This section now specifically states that “FDA’s recommendations are not intended to encourage disclosure of trade secrets or confidential commercial information.” This statement clarifies that the guidance continues to recommend that device labeling should include sufficient information for servicers to maintain the device, but specifically calls out that device sponsors are not expected to include any confidential information or trade secrets on their labeling.
• A high level overview of the guidance: The FDA maintains its recommendations from the 2021 draft version of the guidance that servicers and remanufacturing entities apply its six “Guiding Principles” to understand which activity they are undertaking – and therefore what regulatory requirements apply. These principles inform a flow chart (carried over from the draft guidance), and include questions about whether the activity will change the intended use or the safety and performance specifications of the finished device, whether the change would require a new marketing submission, if the change would impact dimensional or performance specifications, using a risk-based approach (e.g., ISO 14971) and documenting the decision making along these steps. The guidance offers narrative discussions on each step along the flow chart and for each guiding principle, and applies the principles in an appendix offering a variety of examples of when specific situations would be remanufacturing or servicing.

Analysis and what’s next: Oversight, cybersecurity and the right to repair

• Does the new final guidance address the concerns raised about whether or not servicers would know they’re stepping into remanufacturing territory? Not explicitly. The final guidance is largely identical to the draft version in substance, barring a few wording updates, a handful of new examples in specific sections of the document (notably, no new examples were added to the Appendix of examples), and the new five page primer on medical device regulation. Presumably, the new primer on device regulation is intended to help some servicers navigate the expectations.
• CDRH put out a statement along with the guidance that touches on this issue. In the email, CDRH states that “Without access to information and resources to ensure proper servicing, unintentional remanufacturing, which may cause the device to be out of compliance with and in violation of federal law, can occur.” Further, the device center statement explains that its understanding of whether an entity is doing servicing or remanufacturing depends on the definitions in the law and implementing regulations, “but not according to an entity’s self-identified designation as a ‘remanufacturer’ or a ‘servicer.’” As industry has pointed out, though, it’s not clear how the FDA can enforce action against entities that are neither registered/listed nor reporting their activities; further, CDRH officials have previously declined to comment on what investigations they would undertake to address this question.
• What’s not in the guidance: Cybersecurity. The 2021 draft version of the remanufacturing guidance was published alongside a new discussion paper specifically focused on the digital health implications of remanufacturing/servicing policy, and in particular cybersecurity implications. As AgencyIQ discussed at the time, in that paper (not issued as content in the guidance) the FDA grappled with novel cybersecurity risks that arise when more entities and individuals – including servicers – have privileged access to a digital device. The paper weighed those risks against the risks of potential delays to cybersecurity-related updates or fixes by limiting that access. In that paper, the agency proposed that original equipment manufacturers (OEMs) and device users “implement… responsibility agreements,” particularly for legacy devices or those that are no longer supported by their OEM. Notably, digital access remained a key question for both the device industry and servicers in the comments on the draft guidance and at the guidance webinar in 2021.
• Still, the medical device cybersecurity landscape has changed significantly since 2021. Most recently, the FDA gained new statutory authority to require certain cybersecurity information from “cyber device” product sponsors, and issued a series of new guidance documents on the agency’s expectations related to cybersecurity information in pre-market and post-market settings. [See a recent AgencyIQ analysis on these recent activities here.] Those policies specifically call on the medical device manufacturer to have “a plan to monitor, identify, and address, as appropriate, in a reasonable time, postmarket cybersecurity vulnerabilities and exploits” – addressing many of the concerns FDA cited in its 2018 white paper about the positioning of servicers to potentially deploy cybersecurity-related fixes more quickly than the OEM. However, the new policies don’t specifically address the question of general risk associated with wider privileged access, as described above.
• What’s next? The right to repair movement. “Right to repair” refers to the idea – and a policy movement – that people or groups who own products have a right to fix or adjust the products they own at their own discretion. The idea is not specific to medical devices.Some right to repair advocates are primarily focused on consumer electronics like cameras or cell phones, or other sectors like car repair. As a policy movement, advocates call for legal requirements to enhance publicly available information, including digital access, regarding their products and the parts and tools needed to repair them, as well as digital access. The right to repair movement is increasingly active in individual U.S. states; according to a 2023 summary of legislative activity from the National Conference of State Legislatures (NCSL), 33 states (and Puerto Rico) “considered right to repair legislation during the 2023 legislative session,” and four laws were enacted (Colorado: agricultural equipment; California: certain consumer products, stratified by price; New York: new electronic equipment; Minnesota: digital products). Such laws were already on the books in some states prior to 2023 – Massachusetts has policies focused on automobile repair, while Colorado enacted a law in 2022 focused specifically on wheelchair repair.
• 2024 has seen new activity from the Federal Trade Commission (FTC). In January 2024, FTC posted a request for comment on the potential for the Commission to take action on right to repair policies. The FTC had received a “petition for rulemaking from the U.S. Public Interest Research Group [USPIRG] Education Fund and iFixit,” which is a right to repair advocacy group, and was therefore requesting input on “what, if any, action to take” on Right to Repair based on the petition. The docket has collected nearly 2,000 comments, including from device trade association AdvaMed (which urged FTC against rulemaking that would step on the FDA’s medical device oversight authority). Just last month, the FTC and Department of Justice (DOJ) also filed a comment with the U.S. Copyright Office to “advocate for regulations that would facilitate consumers’ and business’ right to repair their own products.”
• Ongoing federal efforts, as well as individual state pushes, to move forward right to repair policies could alter the servicing/remanufacturing landscape. Notably, medical devices (or products specifically under the regulatory authority of the FDA) are sometimes carved out of specific right to repair policies, given that they are highly regulated – for example, medical devices are not within the scope of California’s 2023 Right to Repair Act, cited above, since devices are not consumer goods. What different federal and state policymakers think of these policies going forward, and any potential FTC Right to Repair rulemaking, will remain at issue for device manufacturers, even with this final guidance from FDA providing more policy clarity.

To contact the author of this item, please email Laura DiAngelo ( ldiangelo@agencyiq.com).
To contact the editor of this item, please email Kari Oakes ( koakes@agencyiq.com).

Key documents and dates

• • • • • Remanufacturing of Medical Devices: Guidance for Industry, Entities That Perform Servicing or Remanufacturing, and Food and Drug Administration Staff