ISO 13485: Medical Device Quality Management Systems

ISO 13485 is the internationally recognized standard for quality management systems (QMS) specifically designed for medical device organizations. This standard provides a framework for consistent design, development, production, installation, and servicing of medical devices while meeting regulatory requirements. Compliance with ISO 13485 is essential for manufacturers, suppliers, and service providers operating in the global medical device market.

Standard Overview and Scope

ISO 13485:2016 specifies requirements for a quality management system where an organization needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements.

Organizations Requiring ISO 13485

• Medical Device Manufacturers: Companies designing and producing medical devices
• Component Suppliers: Suppliers of materials and components used in medical devices
• Contract Manufacturers: Organizations manufacturing devices for other companies
• Service Providers: Companies providing installation, maintenance, or repair services
• Distributors: Organizations involved in storage, distribution, and handling
• Design Houses: Organizations providing design and development services

Relationship to Other Standards

Standard	Relationship to ISO 13485
ISO 9001	General QMS; ISO 13485 adapted for medical device regulatory environment
21 CFR 820	FDA QSR; harmonized with ISO 13485 through MDSAP
EU MDR/IVDR	Reference harmonized standard for CE marking
ISO 14971	Risk management requirements integrated with QMS
IEC 62304	Software lifecycle processes referenced for software devices

Quality Management System Requirements

Documentation Requirements

ISO 13485 places strong emphasis on documentation as evidence of QMS effectiveness and regulatory compliance:

• Quality Manual: Document describing QMS scope, exclusions, and interaction of processes
• Quality Policy and Objectives: Top management commitment to quality
• Documented Procedures: Required for control of documents, records, nonconforming product, corrective action, preventive action, and internal audit
• Work Instructions: Detailed instructions for specific processes as needed
• Records: Evidence of conformity to requirements and effective QMS operation
• Medical Device File: Technical documentation for each device type

Record Retention Requirements

Record Type	Retention Period
Design and Development Records	Lifetime of device + specified period (minimum 2 years from final delivery)
Product Traceability Records	Lifetime of device + specified period
Training Records	Employment duration + specified period
Management Review Records	Per regulatory requirements (typically 5+ years)
Audit Records	Per regulatory requirements
Implantable Device Records	15+ years (per EU MDR)

Management Responsibility

Top management must demonstrate commitment to the QMS and ensure that quality objectives are established and achieved.

Management Requirements

• Management Commitment: Establish and communicate quality policy, objectives, and conduct management reviews
• Customer Focus: Determine and meet customer and regulatory requirements
• Quality Policy: Appropriate to organization, includes commitment to requirements and continual improvement
• Planning: Quality objectives and QMS planning, including maintaining integrity during changes
• Responsibility and Authority: Define and communicate roles, responsibilities, and authorities
• Management Representative: Appointed individual with defined QMS responsibilities
• Management Review: Periodic review of QMS performance with defined inputs and outputs

Management Review Inputs

• Audit results (internal and external)
• Customer feedback and complaint handling
• Process performance and product conformity
• Preventive and corrective action status
• Follow-up from previous management reviews
• Changes affecting the QMS
• Recommendations for improvement
• New or revised regulatory requirements

Resource Management

Organizations must determine and provide adequate resources for QMS implementation and maintenance, ensuring regulatory compliance.

Human Resources

• Competence: Personnel performing work affecting product quality must be competent based on education, training, skills, and experience
• Training: Determine necessary competence, provide training or take other actions, evaluate effectiveness, and maintain records
• Awareness: Personnel must be aware of their contribution to product quality and safety

Infrastructure Requirements

• Buildings, workspace, and associated utilities
• Process equipment (hardware and software)
• Supporting services (transportation, communication, information systems)
• Maintenance activities for equipment affecting product quality

Work Environment

• Document work environment requirements for conformity
• Monitor and control work environment conditions
• Health, cleanliness, and clothing requirements as appropriate
• Special arrangements for contamination control

Product Realization

Planning of Product Realization

Organizations must plan and develop processes needed for product realization, consistent with QMS requirements:

• Quality objectives and product requirements
• Process establishment, documentation, and resource needs
• Verification, validation, monitoring, and inspection activities
• Required records for evidence of conformity
• Risk management activities throughout product realization

Design and Development Process

Design and development procedures must ensure that devices meet specified requirements and applicable regulations:

Design Phase	Key Activities	Required Outputs
Planning	Define stages, reviews, responsibilities	Design and development plan
Inputs	Define requirements (functional, regulatory, risk)	Documented input requirements
Outputs	Meet input requirements, provide production/service info	Technical documentation, specifications
Review	Evaluate ability to meet requirements	Review records, action items
Verification	Confirm outputs meet inputs	Verification records
Validation	Confirm product meets intended use	Validation records, clinical data
Transfer	Transfer to production, training	Transfer records

Purchasing Controls

• Supplier Evaluation: Criteria based on ability to meet requirements and device risk
• Purchasing Information: Clear specifications, quality agreements
• Verification of Purchased Product: Inspection and testing as appropriate
• Supplier Monitoring: Ongoing evaluation based on supplier performance
• Records: Supplier evaluations, purchasing data, verification results

Production and Service Controls

• Control of Production: Documented procedures, suitable equipment, monitoring, defined workmanship criteria
• Cleanliness of Product: Requirements for product cleanliness and contamination control
• Installation Activities: Documented requirements and acceptance records
• Servicing Activities: Procedures, records, and feedback analysis
• Sterilization: Validation of sterilization processes per ISO 11135, 11137, or 17665

Measurement, Analysis, and Improvement

Monitoring and Measurement

• Customer Feedback: Process for monitoring information on meeting customer requirements
• Complaint Handling: Documented procedures for timely review of complaints, investigation, and regulatory reporting
• Internal Audits: Planned audits at defined intervals, documented procedures, objective auditors
• Process Monitoring: Methods for demonstrating process ability to achieve planned results
• Product Monitoring: Verification that product meets acceptance criteria

Control of Nonconforming Product

Action	Requirements
Identification	Clear identification to prevent unintended use
Documentation	Records of nonconformity nature and actions taken
Evaluation	Investigation to determine root cause
Disposition	Rework, accept with concession, reject, or regrade
Concession	Authority for concession, regulatory reporting if required
Rework	Documented procedures, verification after rework
Advisory Notices	Procedure for issuing safety/recall notices

Corrective and Preventive Action (CAPA)

CAPA procedures are central to QMS effectiveness and regulatory compliance:

1. Identification: Identify nonconformities from complaints, audits, process data, service records
2. Investigation: Determine root cause of nonconformity
3. Action Determination: Evaluate need for action, determine appropriate corrective/preventive action
4. Implementation: Implement planned actions
5. Verification: Verify that actions were implemented and effective
6. Documentation: Document changes resulting from CAPA
7. Review: Management review of CAPA effectiveness

Certification and Regulatory Recognition

Certification Bodies

ISO 13485 certification is conducted by accredited certification bodies (CBs) or Notified Bodies (for EU market access):

• Certification requires successful completion of Stage 1 and Stage 2 audits
• Annual surveillance audits maintain certification
• Re-certification audit every 3 years
• Unannounced audits may occur

MDSAP (Medical Device Single Audit Program)

MDSAP allows a single audit to satisfy requirements of multiple regulatory authorities:

Participating Authority	Recognition
Australia (TGA)	MDSAP audit report accepted
Brazil (ANVISA)	MDSAP audit report accepted
Canada (Health Canada)	MDSAP mandatory since 2019
Japan (MHLW/PMDA)	MDSAP audit report accepted
United States (FDA)	MDSAP audit report accepted

Related Resources

For additional information on quality management and regulatory requirements, explore these resources:

• Compliance Standards Hub – Regulatory requirements and guidelines
• FDA Medical Device Regulations
• IEC 60601 Electrical Safety Standards
• Documentation Hub – Technical equipment specifications
• Knowledge Base Hub – Healthcare equipment guides