ISO 13485

« Back to Glossary Index

ISO 13485 — medical device quality management systems

ISO 13485 is the international standard that specifies requirements for a
quality management system (QMS) when an organization needs to demonstrate its
ability to provide medical devices and related services that consistently meet customer and
applicable regulatory requirements. It is the baseline QMS framework used globally across
the medical device supply chain—from design and manufacture to distribution and servicing.

Risk-based QMS
Design & manufacturing controls
Regulatory alignment

Scope & applicability

  • Applies to organizations involved in one or more lifecycle stages: design and development, production, storage & distribution, installation, and servicing.
  • Covers QMS processes such as documentation/records control, management responsibility, resource management, product realization, measurement/analysis/improvement, and vigilance-related activities.
  • Supports regulatory compliance in many markets; certification is frequently required by customers and Notified Bodies during conformity assessment.

Key requirements at a glance

  • Risk management across the QMS (including risk-based decision making and link to product risk per ISO 14971).
  • Design & development controls (planning, inputs/outputs, reviews, verification, validation—including software—transfer, changes).
  • Purchasing & supplier control (qualification, agreements, monitoring, incoming inspection for critical items/services).
  • Production & process control (work instructions, validation of special processes, cleanliness, environmental controls, traceability, status identification).
  • Measurement & monitoring (inspection, test, equipment control, calibration, statistical techniques where appropriate).
  • Nonconformity, CAPA & improvement (complaints/feedback, investigation, corrections, corrective/preventive actions, effectiveness checks).
  • Post-market interaction (complaint handling, reporting obligations coordination with regulatory requirements).

Implementation roadmap (practical steps)

1) Map processes & define responsibilities
Create a process map with owners, inputs/outputs, and risk-based controls; establish a document hierarchy (policies → procedures → records/forms).
2) Plan design & risk management
Integrate design controls and ISO 14971 risk management from concept through transfer; define records and review cadence.
3) Supplier strategy
Classify suppliers by risk; set qualification criteria, quality agreements, and monitoring/reaudits; define incoming acceptance activities.
4) Production controls & validations
Establish DMR/Device Master Records, process validations, equipment maintenance/calibration, identification & traceability, and change control.
5) PMS/complaints & CAPA
Implement complaint handling, vigilance triggers, data analysis, and CAPA with root-cause and effectiveness verification.
6) Internal audits & management review
Run a risk-based audit program; feed KPIs, complaints, CAPA status, and resource needs into management review for continual suitability and effectiveness.

Certification vs. compliance

  • Compliance means your QMS meets ISO 13485 requirements; it can be assessed by regulators/Notified Bodies.
  • Certification is a formal third-party audit by an accredited certification body resulting in an ISO 13485 certificate, typically valid for 3 years with surveillance audits.
  • Many markets and partners expect certification; it also streamlines regulatory assessments by demonstrating a mature, maintained QMS.

Common audit focus & pitfalls

  • Incomplete linkage between risk management, design outputs, and verification/validation.
  • Supplier controls not proportionate to risk; weak incoming inspection or missing quality agreements.
  • Process validation gaps for special processes (where results cannot be fully verified by subsequent inspection/testing).
  • CAPA lacking root-cause analysis or effectiveness verification; repeated findings across audits.
  • Document/record control issues (uncontrolled templates, obsolete documents in circulation, inadequate training evidence).

Quick checklist

  • Process map with owners, metrics, and risk-based controls is current.
  • Design controls & ISO 14971 risk files show clear traceability to V&V and labeling/IFU.
  • Supplier classification, agreements, and monitoring match risk; incoming acceptance is defined and effective.
  • Process validations, equipment calibration/maintenance, and traceability are complete and up to date.
  • Complaints/vigilance data feed CAPA; CAPA has root-cause + effectiveness checks.
  • Internal audits and management reviews are on schedule with actions tracked to closure.

ISO 13485 — FAQs

Is ISO 13485 certification mandatory?
Legally, certification is not always mandatory, but regulators, Notified Bodies, and customers frequently expect it. Many conformity assessments rely on an ISO 13485-certified QMS.
How does ISO 13485 relate to regulatory QMS rules?
ISO 13485 is widely recognized by regulators and aligns with many jurisdictional QMS requirements. In some jurisdictions, quality system regulations are closely harmonized with ISO 13485:2016.
What’s the maintenance cycle?
Certificates are typically valid for 3 years, with annual (or semiannual) surveillance audits and a full recertification audit at the end of the cycle.