FDA Issues Revised Draft Guidance on Remote Regulatory Assessments Across Regulated Products and Establishments

FDA Issues Revised Draft Guidance on Remote Regulatory Assessments Across Regulated Products and Establishments

January 31, 2024, Covington Alert

On January 26, 2024, FDA announced the availability of a revised draft guidance explaining its expectations for the use of remote regulatory assessments (RRAs). FDA originally issued the draft guidance for industry, “Conducting Remote Regulatory Assessments Questions and Answers,” in July 2022. This alert has been updated to reflect these revisions.

The draft guidance describes how FDA deployed RRAs during the COVID-19 pandemic to conduct important regulatory oversight activities. Based on this experience, FDA intends to continue to use both voluntary and mandatory RRAs, as applicable, for all types of FDA-regulated products. The draft guidance confirms that FDA views remote assessments as an additional regulatory tool and that RRAs are not generally intended to replace inspections. The draft guidance was issued to provide further transparency to stakeholders about the circumstances in which FDA plans to use this tool and promote greater consistency in the way the Agency conducts RRAs.

The January 2024 revisions are intended to clarify the Agency’s answers to certain questions regarding RRAs and align the guidance with recent changes to section 704(a)(4) of the FD&C Act made by the Food and Drug Omnibus Reform Act of 2022 (FDORA). FDORA amended section 704(a)(4) in several ways, including by adding device and bioresearch monitoring (BIMO) establishments as establishments that are subject to mandatory requests for records or other information under section 704(a)(4), adding a requirement that FDA provide a rationale for requesting records or other information under section 704(a)(4), and providing that FDA may rely on any records or other information obtained under section 704(a)(4) to satisfy requirements that may pertain to a preapproval or risk-based inspection, or to resolve deficiencies identified during such inspections, if applicable and appropriate.

Aside from changes required in the wake of FDORA, the revisions generally expand FDA’s flexibility in requesting and conducting an RRA. For example, the draft guidance still requires FDA to obtain an establishment’s consent to a voluntary RRA but no longer requires that such consent be provided in writing by the establishment’s top management official or designee. Additionally, the draft guidance no longer requires that FDA work with an establishment subject to a voluntary RRA in advance of the RRA, but merely states that FDA “will typically” do so. Similarly, the draft guidance specifies two categories of “mandatory” RRAs but also asserts that other categories may exist.

Notably, the revisions also expand the list of conduct that may lead to a determination that an establishment has declined to participate in a mandatory RRA, which could be a violation of the FD&C Act and may be the basis for an import refusal. The draft guidance now states that failure to respond to a request for a mandatory RRA may lead to a determination that the establishment has declined to participate. The original draft guidance only mentioned that withdrawing participation from a mandatory RRA and refusing to provide requested records could lead to such a determination.

The following summarizes key issues covered by the draft guidance:

What is a Remote Regulatory Assessment? How do inspections and RRAs differ?

According to the draft guidance, an RRA is “an examination of an FDA-regulated establishment and/or its records, conducted entirely remotely, to evaluate compliance with applicable FDA requirements.” As a general matter, RRAs are tools that “complement” FDA’s statutory inspectional authority but are not intended to replace inspections or limit FDA’s authority to conduct inspections. One notable exception is that Foreign Supplier Verification Program (FSVP) records requests conducted under section 805(d) of the FD&C Act and its implementing regulations are intended to function as inspections.

An RRA is distinct from an inspection in that RRAs are conducted remotely by FDA staff without FDA’s physical presence at the establishment. FDA intends to clearly indicate when it considers an activity to be an RRA and does not intend to issue a Form FDA 482, Notice of Inspection, or Form FDA 483, Inspectional Observations, for an RRA. FDA also does not plan to conduct RRAs and inspections of an establishment simultaneously. However, the guidance states that an RRA could precede, prompt, or be a follow-up to, an inspection.

What is the difference between a mandatory RRA and a voluntary RRA?

FDA has statutory authority to conduct mandatory RRAs for: (1) establishments subject to section 704(a)(4) of the FD&C Act (i.e. drug and device manufacturers as well as sites, entities, and facilities subject to BIMO inspections); and (2) food importers, from whom FDA may request FSVP records under section 805(d) of the FD&C Act, 21 CFR 1.510(b)(3), and 1.512(b)(5)(ii)(C). These two types of RRAs are “mandatory.” The draft guidance states that these “are not necessarily the only types of mandatory RRAs for which FDA has authority”; however, no other examples are provided.

Any RRAs that are not mandated by statute or regulation (or for which FDA decides to not exercise its mandatory RRA authority) are “voluntary.” An establishment can decline to participate in a voluntary RRA or withdraw participation during the RRA. FDA explains, however, that if an establishment declines to participate or withdraws from an ongoing voluntary RRA, FDA may consider other tools for evaluating compliance with FDA requirements.

What circumstances or conditions prompt FDA to use RRAs? May I request one?

FDA intends to use a risk-based approach in deciding when to initiate or request an RRA. Among other considerations, FDA may look at the establishment’s location, inspection history, complexity of product and process, and travel restrictions. The draft guidance states that the decision to deploy an RRA is ultimately a matter of FDA’s discretion and that FDA is not currently accepting requests to perform RRAs. FDA also will not perform an RRA in lieu of an inspection. If FDA determines an inspection (as opposed to an RRA) is necessary, the Agency intends to perform an inspection.

How does FDA initiate or request an RRA?

Each product Center and ORA may have different processes and procedures for initiating RRAs. For voluntary RRAs, if FDA has determined that an RRA is appropriate, FDA expects to identify and reach out to the establishment’s point of contact, obtain the establishment’s consent to the RRA, and, if consent is given, provide an opportunity to discuss, as applicable and appropriate, FDA’s expectations for the establishment’s participation in the RRA, any establishment limitations in participating in the RRA, the scheduling of virtual interviews and meetings, technological capabilities, the process and timeline for requesting records or other information for review, how and when the Agency will provide feedback, and any questions relating to the process or other aspects of the RRA. The draft guidance notes that, where practicable, FDA generally intends to seek consent to the RRA in writing from the establishment’s point of contact after notifying said person of the purpose and planned scope of the RRA.

For mandatory RRAs, FDA will initiate the request in accordance with the applicable legal authority and established procedures. For example, FDA will use Form FDA 4003 to request records or other information from drug, device, and BIMO establishments and Form FDA 482d to request FSVP records from food importers.

What might happen during an RRA?

Depending on the type of RRA, an RRA could involve FDA’s request and review of records and other systems; meetings between FDA and site personnel; use of live streaming or pre-recorded videos for examination of facilities, operations, equipment, or information; or other activities. FDA does not intend to record RRAs conducted via livestream, video, or screen sharing, but may request records it reviews during such sessions. Technological expectations will also vary depending on the type of RRA and its scope. The draft guidance states that FDA “may” provide updates on “observations and outstanding issues” during the course of the RRA, and that the Agency “expects to make reasonable and appropriate efforts” to discuss observations with management. Similarly, FDA generally intends to maintain open communication to discuss any records received over the course of the RRA.

What types of records and information can FDA request? How should I provide requested records and information?

For voluntary RRAs, FDA may request records or other information similar to what FDA would request during an inspection, such as those appropriate to determine whether the establishment, FDA-regulated product, or clinical study is in compliance with applicable FDA requirements. For mandatory RRAs, FDA “will conform to the relevant legal authority.” For example, FDA may request any records that it would request in an inspection under section 704(a) of the FD&C Act. For food importers, FDA may request records required in 21 CFR 1, subpart L.

For mandatory RRAs, FDA will request that records be submitted within a timeframe consistent with the relevant legal authority. For example, persons subject to a request under section 704(a)(4) of the FD&C Act must provide the requested records or other information in a “reasonable” timeframe, whereas persons subject to a request under section 805(d) of the FD&C Act must provide the records “promptly.” The circumstances that relate to FDA’s expectations for reasonable request time frames include the reason for the RRA (such as an application goal date), need for translation, the establishment’s resources and capabilities, and other factors. FDA may provide a suggested timeframe for voluntary RRAs.

Generally, records should be submitted to FDA in an electronic format through a secure mechanism that FDA will provide. Establishments responding to RRAs should identify any external access limitations on electronic records/documents and provide a means for FDA to access them. Documents that are maintained in paper format can be converted to searchable PDFs; if paper documents cannot be provided as PDFs, FDA will provide contact information for the person requesting the records. For records that are not in English, FDA may request translation. (For FSVP food importer RRAs, records must be provided in English and electronically under 21 CFR 1.510(b)(1),1.512(b)(5)(C)(ii)(A), 1.510(b)(3), and 1.512(b)(5)(ii)(C)).

What are the potential outcomes when FDA completes an RRA?

According to the draft guidance, FDA can use the information requested in an RRA for a variety of regulatory purposes, including but not limited to assessing marketing application submissions; determining compliance with the FD&C Act or PHS Act; assessing the need for an inspection or prioritizing establishments for inspections; and supporting regulatory actions, market actions, or enforcement actions. Following an RRA, FDA may conduct an inspection. FDA may also take any other appropriate actions, including an enforcement action, when significant issues are discovered.

Should I respond to an RRA?

At the conclusion of an RRA, FDA may hold a meeting with the establishment’s management. If such a meeting does not occur, FDA will notify the establishment that the RRA is concluded. FDA will likely not present a form FDA 483, but it may provide a list of written observations from the RRA. FDA considers RRA observations to be “conditions and/or practices observed during the RRA that indicate, in the judgment of the FDA employee(s) conducting the RRA, a potential violation of the laws enforced by FDA.” (Note that in the case of FSVP food importer RRAs, FDA will use a Form FDA 483a, FSVP Observations.)

FDA “encourages” responses to RRAs; if establishments provide written responses within 15 business days, FDA indicates that it will “generally” consider such responses “before further Agency action or decision.” Although FDA will not prepare a formal EIR as it does with inspections, the draft guidance indicates that FDA will typically prepare a report of the RRA to summarize information reviewed, conditions and practices found, and the observations identified. FDA generally expects to provide a written copy of the narrative portion of the RRA report to the establishment, following the determination that the RRA is closed.

Stakeholders should note that while FDA does not consider a written list of RRA observations to be a final agency action or decision, such lists could be requested under the Freedom of Information Act and be made publicly available, as could any written responses that the establishment provides to FDA during or after the RRA, along with FDA’s narrative report of the RRA.

What if I decline to participate or withdraw?

While declining a voluntary RRA will not result in any enforcement action by the Agency based on the declination, the draft guidance indicates that declining to participate may push FDA to consider other activities to exercise oversight, such as inspection. FDA will determine whether to utilize such other measures based various considerations, including when the establishment was last inspected, the Agency’s assessment of risks, and “other relevant factors.” If an establishment declines FDA’s request to conduct a voluntary RRA, however, FDA may be unable to complete an assessment of the establishment’s activities until it exercises other oversight tools. This might result in the Agency’s inability to timely assess an establishment or decide on a product marketing application.

As explained in the draft guidance, declining to participate in a mandatory RRA could be a violation of the FD&C Act and may be the basis for an import refusal. Failing to respond to a request for a mandatory RRA, withdrawing participation from a mandatory RRA, or refusing to provide requested records in response to a mandatory RRA request may lead to a determination that the establishment has declined to participate.

What actions should I take next?

Stakeholders who wish to comment on FDA’s draft guidance should do so by March 26, 2024. While FDA works to finalize the guidance, stakeholders should assess existing internal procedures and processes regarding FDA interactions to ensure they adequately address FDA’s expectations for participating in and responding to RRAs. Stakeholders may consider reviewing existing or planned technological capabilities for livestreaming, document management/retrieval, and other systems in preparation for participation in remote assessments.

If you have any questions concerning the material discussed in this client alert, please contact the members of our Food, Drugs, and Devices practice.