What is ISO 13485?

Why medical devices need a dedicated QMS

Implants, surgical instruments, diagnostic equipment and software that supports clinical decisions are products in which patients and practitioners expect high precision and accuracy every time. A defect is not a minor customer complaint: it can injure a patient, trigger a recall and end a manufacturer's access to a market.

This is why ISO 13485, published by the International Organization for Standardization (ISO), goes further than a general quality standard. It covers the whole device life cycle, from design and development to production, storage, distribution, installation and servicing, and it applies equally to suppliers and other external parties that provide products or services to such organizations.

What is the purpose of ISO 13485?

The purpose of ISO 13485 is to give medical device organizations a QMS that demonstrates their ability to provide devices that are safe and perform as intended, while meeting applicable regulatory requirements. The requirements apply regardless of the size or type of organization, except where the standard explicitly states otherwise.

The standard is flexible: the organization determines which processes it needs and to what extent, based on the risk of its devices and its role. A contract manufacturer, a distributor and a software developer will not implement the same processes, but each has to justify its choices.

In the scope of clause 4.1, the organization is mandated to apply a risk-based approach to the control of the appropriate processes, which is one of the clearest differences from ISO 9001.

Current edition: ISO 13485:2016

The current edition is ISO 13485:2016 (third edition), published in March 2016. According to ISO's page, the standard was last reviewed and confirmed in 2025 and remains current. It replaced ISO 13485:2003, which has been withdrawn.

The 2016 revision brought a stronger focus on risk, clearer management and training responsibilities, closer alignment of design and development requirements with regulations, more emphasis on control of suppliers, traceability and complaint handling, and enhanced product cleanliness requirements. An Annex A table at the end of the standard compares the content of the 2003 and 2016 editions.

Even though ISO 9001 was revised in 2015, ISO 13485:2016 follows the structure of the earlier ISO 9001:2008, because the changes in ISO 9001:2015 were not considered necessary for the medical device sector. Always confirm the current edition with ISO or your certification body before building your system.

The structure: clauses 4 to 8

ISO 13485 has eight clauses. Clauses 1 to 3 cover scope, normative references and terms and definitions. The requirements that are audited sit in clauses 4 to 8.

• Quality management system (clause 4): the general requirements, including risk-based control of processes, control of outsourced processes and validation of QMS software, plus the documentation requirements: quality manual, medical device file, control of documents and control of records. For example, a manufacturer that outsources sterilization still retains responsibility for that process.
• Management responsibility (clause 5): management commitment, customer focus, the quality policy, objectives, planning, responsibility and authority, and management review. Is top management actually reviewing complaint and audit data, or only signing the minutes?
• Resource management (clause 6): provision of resources, competence and training, infrastructure, and the work environment including contamination control for devices that require it.
• Product realization (clause 7): planning, customer-related processes, design and development, purchasing and supplier control, production and service provision, identification and traceability, and control of monitoring and measuring equipment.
• Measurement, analysis and improvement (clause 8): feedback, complaint handling, reporting to regulatory authorities, internal audit, control of nonconforming product, analysis of data, and corrective and preventive action.

Key requirements that auditors look for

In practice, certain requirements are examined most closely by certification bodies and regulators. These are the areas where the organization is mandated to maintain documented evidence.

• Medical device file: for each device type or family, a file with the intended use, specifications, labelling, and the procedures for manufacturing, packaging, storage, distribution, installation and servicing (clause 4.2.3)
• Risk management: a documented process applied across product realization, for example in design inputs and supplier selection (clause 7.1)
• Design and development: planned stages, inputs, outputs, review, verification, validation, transfer and change control, with a design and development file (clause 7.3)
• Process validation: validation of production and service processes whose output cannot be verified by later monitoring, such as sterilization or sealing (clause 7.5.6)
• Traceability: identification of each device and its components to the extent required, which supports recalls and advisory notices (clause 7.5.9)
• Complaint handling: documented procedures to receive, review, investigate and decide whether to report a complaint to the authorities (clause 8.2.2)
• Correction and corrective action: a distinction that auditors check, because correction fixes the immediate issue while corrective action removes the root cause (clause 8.5.2)

ISO 13485 and the regulatory landscape

ISO 13485 is a voluntary standard, but regulators in many markets rely on it. In the European Union, the Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR) require a QMS, and ISO 13485 is the standard most manufacturers use to build it. The European adoption, EN ISO 13485, contains the same requirements as ISO 13485 together with annexes that relate the standard to the EU regulations, so check the version cited in the EU list of harmonized standards.

The Medical Device Single Audit Program (MDSAP) uses ISO 13485 as the basis for audits recognized by several regulators. In the United States, the FDA's Quality Management System Regulation has moved the requirements of 21 CFR Part 820 toward ISO 13485, but the FDA keeps additional requirements of its own. Confirm current applicability with your regulatory advisers.

What does this mean for the organization? ISO 13485 certification supports regulatory submissions, but it does not replace them, and every market keeps its own legal requirements.

ISO 13485 vs. ISO 9001

ISO 13485 is a stand-alone standard, but it is based on ISO 9001 and the two are often compared. ISO 9001 applies to any organization in any sector and is built around customer satisfaction and continual improvement. ISO 13485 adds requirements specific to medical devices and is built around regulatory compliance and product safety.

• Purpose: ISO 9001 focuses on customer satisfaction and improvement; ISO 13485 focuses on meeting regulatory requirements and device safety and effectiveness
• Risk: ISO 9001 uses risk-based thinking; ISO 13485 requires a documented risk-based approach, particularly in product realization
• Documentation: ISO 13485 is more prescriptive, with a quality manual, medical device files and a longer list of required procedures and records
• Validation and traceability: stricter requirements for process validation, sterility, installation, servicing and traceability
• Post-market: complaint handling and reporting to regulatory authorities are explicit requirements
• Certification: an ISO 13485 certificate does not prove ISO 9001 conformity, and the reverse is also true

How to implement ISO 13485

A practical sequence helps to avoid creating procedures that nobody uses.

• Gap analysis: compare the current system with the requirements and with the regulations of your target markets
• Scope and role: define the scope, the devices, and your role as manufacturer, supplier, importer or distributor
• Policy, objectives and the quality manual: establish management commitment and the structure of the QMS
• Processes and procedures: document the required procedures and records and map how work flows through them
• Risk management and design controls: build risk management and design and development controls into product realization
• Training and competence: confirm that people are trained for the tasks they perform
• Operate and record: run the system long enough to generate records
• Internal audit and management review: audit all processes, review the results and correct the findings
• Certification audit: arrange a Stage 1 and Stage 2 audit with an accredited certification body

Certification and documents

Certification means an accredited certification body has audited the QMS against ISO 13485 within a defined scope. The audit normally has two stages: a review of documentation and readiness, then a main audit of how the system works in practice. A certificate is followed by surveillance audits and recertification. ISO itself does not issue certificates.

Required documented information includes the quality manual, the quality policy and objectives, documented procedures required by the standard, medical device files, and records of management review, training, design and development, supplier evaluation, validation, traceability, complaints, internal audits and corrective actions. Confirm the exact required list against the published standard. Is the system generating evidence from day-to-day work, or is evidence assembled just before the audit?

How ComplyEncrypt helps with ISO 13485

ISO 13485 is on the ComplyEncrypt roadmap. ComplyEncrypt is built to bring quality manual and procedure drafting, medical device file structures, risk and supplier records, internal-audit preparation and corrective-action tracking into an AI-assisted workflow, so the team works from its real processes instead of a folder of disconnected templates.

AI assistance applies to documentation work. People still design, validate and release devices, assess risk, investigate complaints and implement corrective actions, and certification remains the decision of an accredited body. A vigorous QMS protects patients first and the business second, and it is built by the people who run it. See the ISO 13485 framework page for current availability.