ISO 13485: ISO 13485 – Tutorial (about 60 minutes)

ISO 13485 is the international standard that sets the requirements for a quality management system (QMS) in organisations that design, make, store, distribute, install or service medical devices, and in the suppliers that support them. Regulators in Europe, the United States, Canada, Japan, Australia, Brazil and many other markets build on it, so it is the common quality language of the medical device industry. After this tutorial you will be able to explain what the standard asks for and why, find your way around its clauses, see how design controls, supplier control, complaint handling and corrective action fit together, and understand how organisations are audited and certified against it.

Free tutorial · about 60 minutes · 7 lessons · 5 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: The current edition is ISO 13485:2016, Medical devices — Quality management systems — Requirements for regulatory purposes, the third edition, published by ISO in March 2016 and prepared by technical committee ISO/TC 210 (Quality management and corresponding general aspects for medical devices). It replaced the 2003 edition. At its most recent systematic review, completed around the turn of 2025–2026, it was confirmed without change (ISO stage 90.93, "International Standard confirmed"); certification bodies such as TÜV NORD report that it will remain unchanged until at least 2030. A future revision may realign it with the harmonized management-system structure used by ISO 9001, but no revision draft had been published at the time of writing. In Europe the standard is published as EN ISO 13485:2016 with amendment A11:2021, which only updates the European annexes and is cited as a harmonised standard under the Medical Device Regulation (MDR) and the In Vitro Diagnostic Regulation (IVDR). In the United States, the FDA Quality Management System Regulation (QMSR) has incorporated ISO 13485:2016 by reference since 2 February 2026. Verified 2026-10-29 from the TÜV NORD and Nemko notices on the systematic review (the ISO catalogue page could not be fetched), the eCFR text of 21 CFR Part 820 and the FDA QMSR material.

Who this is for: engineers, software developers, manufacturing and supply-chain staff, quality and regulatory professionals, start-up founders and project managers who are new to the medical device world, and suppliers (electronics, plastics, sterilisation, calibration, software) whose customers have asked them to "work to ISO 13485". It is also useful for anyone who will meet an auditor or an inspector and wants to understand what they will look for.

Prerequisites: none. A general idea of how a company develops and manufactures a product helps, but every quality and regulatory term is explained when it first appears. Knowing ISO 9001 is helpful but not required; where the two differ, this tutorial points it out.

By the end of this tutorial:

You will be able to explain the purpose of ISO 13485 and why it focuses on safety, effectiveness and regulatory compliance rather than customer delight.
You will be able to define the core vocabulary, including medical device file, design transfer, complaint, advisory notice, post-market surveillance and sterile barrier system.
You will be able to describe the structure of clauses 4 to 8 and locate the requirements for documentation, management, resources, product realization and improvement.
You will be able to outline how design and development controls, purchasing controls and process validation work in practice.
You will be able to trace how feedback and complaints lead to regulatory reporting, investigation, corrective action and management review.
You will be able to explain how certification audits, notified-body audits, MDSAP audits and FDA inspections relate to the standard.
You will be able to compare ISO 13485 with ISO 9001, ISO 14971, IEC 62304 and the FDA QMSR.

Lesson 1 – Origins, purpose and scope

Why medical devices need their own quality standard

A medical device is any instrument, apparatus, machine, implant, software, reagent or similar article that the manufacturer intends to be used for a medical purpose, such as diagnosing, preventing, monitoring or treating disease or injury, and that does not achieve its main effect through drugs or metabolism. The category is huge: tongue depressors, syringes, wheelchairs, glucose meters, MRI scanners, hip implants, contact lenses, laboratory test kits and mobile apps that analyse heart rhythms are all medical devices in most jurisdictions.

What these products share is that a quality failure can harm a patient, a user or a clinician. A cracked sterile pouch, a miscalibrated sensor or a software bug in a dose calculation is not just an unhappy customer; it can be an injury or a death. Governments therefore regulate medical devices, and almost every regulator requires manufacturers to run a quality management system. A quality management system is the set of policies, processes, procedures, records and responsibilities that an organisation uses to make sure its products consistently meet requirements.

In the 1990s, regulators and industry noticed that each country was writing its own QMS rules, and that general-purpose quality standards did not address things regulators cared about, such as sterility, traceability of implants and reporting of adverse events. ISO 13485 was developed so that one internationally agreed set of QMS requirements could support many regulatory systems. The first edition appeared in 1996 as a supplement to ISO 9001; the 2003 edition became a standalone standard; and the 2016 edition strengthened the links to regulatory requirements, risk-based thinking and the whole product life cycle.

The purpose: consistent safety and performance under regulation

The title says "requirements for regulatory purposes", and that phrase explains the standard's personality. ISO 9001, the general quality standard, aims at customer satisfaction and continual improvement. ISO 13485 aims at something narrower and stricter: demonstrating that the organisation can consistently provide medical devices and related services that meet customer requirements and the applicable regulatory requirements, meaning the laws, regulations and official rules of each market in which the device is sold.

Because of this aim, ISO 13485 asks the organisation to keep its QMS effective rather than to prove constant improvement, it expects more documented procedures and records than ISO 9001, and it repeatedly says "if required by applicable regulatory requirements" so that the system flexes to the rules of each market. A company selling only in Brazil and Japan and a company selling in the EU and the US apply the same standard but satisfy different regulatory details.

Who uses it

The standard applies to any organisation involved in one or more stages of a medical device's life cycle. That includes:

legal manufacturers who design devices and place them on the market under their own name;
contract manufacturers who build devices for someone else;
suppliers of components, raw materials, software, sterilisation, packaging, calibration or testing services;
distributors, importers and authorised representatives who store and move devices;
organisations that install, service or refurbish devices.

Suppliers often adopt ISO 13485 voluntarily or because their customers ask for it, since a supplier with a working medical-device QMS is easier for a manufacturer to qualify and monitor.

Scope and permitted exclusions

The organisation decides and documents the scope of its QMS: which products, sites and life-cycle activities are covered, and which roles it plays under each regulation (for example, manufacturer in one market and distributor in another). Two kinds of reduction are allowed, and both must be justified in the quality manual:

Exclusion of design and development is allowed only where the applicable regulatory requirements permit it, for example for an organisation that only makes devices to another company's design.
Non-application of a requirement in clauses 6, 7 or 8 is allowed when the activity is not performed or does not apply to the device, for example sterilisation requirements for a non-sterile product or installation requirements for a device that needs no installation.

If an activity is outsourced rather than not performed, the requirement still applies: the organisation remains responsible and must control the outsourced process.

Lesson 2 – Key concepts and vocabulary

ISO 13485 uses the general quality vocabulary of ISO 9000 (the standard of fundamentals and terms that it cites as a normative reference) and adds terms specific to medical devices. Learning these terms early makes the rest of the standard much easier to read. The definitions below are paraphrased.

Medical device – an article such as an instrument, machine, implant, software or reagent that its manufacturer intends for a medical purpose, whose main intended action is not achieved by pharmacological, immunological or metabolic means.
Manufacturer – the person or company responsible for designing and/or making a device with the intention of making it available under its own name, whether or not it does the physical work itself.
Life cycle – all phases of a device's life, from initial concept through design, production, use and servicing to final decommissioning and disposal.
Medical device file – the collection of documents, kept for each device type or family, that describes the device and defines how it is made, labelled, packaged, installed and serviced; in some regulations the equivalent is called technical documentation or a device master record.
Design and development file – the records that show the design was developed according to plan and that capture each design change; often called the design history file.
Design verification and design validation – verification confirms that design outputs meet design inputs ("did we build the design right?"); validation confirms that the finished device meets user needs and its intended use ("did we build the right device?").
Design transfer – the controlled hand-over of a verified design into reliable, repeatable production.
Complaint – any written, electronic or oral communication alleging a deficiency in a device's identity, quality, durability, reliability, usability, safety or performance after it has been released from the organisation's control.
Advisory notice – a notice issued after delivery that gives extra information or advises action on use, modification, return or destruction of a device; regulators often call this a field safety notice or a recall communication.
Post-market surveillance – the systematic collection and analysis of experience with devices that are already on the market.
Risk and risk management – in ISO 13485, risk refers to the combination of how likely harm is and how severe it would be, and risk management is the systematic application of policies and procedures to analyse, evaluate, control and monitor that risk; ISO 14971 describes the full process.
Sterile barrier system – the minimum packaging that minimises the entry of microorganisms and allows a sterile device to be presented aseptically at the point of use.
Implantable medical device – a device that is introduced into the body or a natural orifice, or replaces an epithelial surface or the surface of the eye, by surgical intervention, is intended to stay for at least 30 days and can only be removed by medical or surgical intervention; such devices carry stricter traceability requirements.
Process validation – establishing documented evidence that a process consistently produces a result that meets specifications, required when the output cannot be fully checked afterwards (for example sterilisation or seal strength).
Corrective action and preventive action (CAPA) – corrective action removes the cause of a nonconformity that has occurred so it does not happen again; preventive action removes the cause of a potential nonconformity before it occurs.

Four ideas that run through the whole standard

Regulatory requirements are built in. In ISO 9001 the law is one input among many. In ISO 13485 applicable regulatory requirements sit next to customer requirements at the centre, and many clauses explicitly link to them: reporting adverse events, keeping records for set periods, labelling, unique device identification and so on.

A risk-based approach to controlling QMS processes. The 2016 edition asks organisations to apply a risk-based approach to controlling the processes of the QMS, not just to product design. The depth of supplier control, the extent of software validation and the effort spent on process validation should all be proportionate to the risk to the device's safety and performance. Product risk management itself follows ISO 14971, which the standard points to in a note rather than making it mandatory text.

Documentation is evidence. "If it is not written down, it did not happen" is a common saying in this industry. ISO 13485 requires documented procedures for many activities and records that prove they were carried out. Records must be retained for at least the lifetime of the device as defined by the organisation, and not less than two years from product release, unless a regulation demands longer.

Maintain effectiveness. Where ISO 9001 asks for continual improvement, ISO 13485 asks the organisation to maintain the effectiveness of its QMS and to make the changes needed to keep it suitable and effective. Improvement still happens, mostly through corrective and preventive action, but stability and control are valued because every change to a validated process or a released design carries risk.

Lesson 3 – Structure of the standard

Unlike most newer ISO management-system standards, ISO 13485:2016 does not follow the harmonized clause 4–10 structure. It keeps the older eight-clause layout inherited from ISO 9001:2008, which is one reason a future revision may realign it. Clauses 0 to 3 are introductory and clauses 4 to 8 contain the requirements. Annex A compares the 2016 edition with the 2003 edition and Annex B maps it to ISO 9001:2015.

Figure 1 – The clause structure of ISO 13485:2016, with the main topics each requirement clause covers.

Clause 4 – Quality management system

Clause 4 sets the foundations. The organisation documents its role under the regulations, determines the processes of its QMS and how they interact, applies a risk-based approach to controlling them, and controls any outsourced process. It must validate the software used in the QMS itself, such as an electronic document system, a complaint database or a statistical tool, with effort proportionate to the risk of that use. The documentation section requires a quality manual (describing scope, exclusions and the structure of the documentation), a medical device file for each device type or family, and controls for documents (review, approval, versioning, availability, prevention of use of obsolete versions) and records (identification, storage, protection of confidential health information, retention and retrieval).

Clause 5 – Management responsibility

Top management must show commitment: setting a quality policy and quality objectives, making sure the right resources exist, and communicating the importance of meeting customer and regulatory requirements. Responsibilities and authorities must be defined and documented, including for people whose work affects quality. Top management appoints a management representative, a member of management who reports on the effectiveness of the QMS and promotes awareness of requirements. Management must also run management review at planned intervals, using defined inputs (such as feedback, complaint handling, reports to regulators, audits, process and product monitoring, CAPA, changes and new regulations) and producing decisions on improvement, product changes, regulatory changes and resource needs.

Clause 6 – Resource management

The organisation must provide the people, infrastructure and work environment needed. Staff must be competent on the basis of education, training, skills and experience, and the organisation must document how it establishes competence, provides training and checks that training worked, proportionate to the risk of the work. Infrastructure, including buildings, equipment and IT, needs documented maintenance requirements where maintenance affects product quality. The work environment and contamination control section covers things like health and cleanliness of personnel, clean-room conditions, and preventing contamination of other products, the work environment or people, especially for sterile devices.

Clause 7 – Product realization

Clause 7 is the largest clause and covers the path from idea to delivered and serviced device:

7.1 Planning of product realization – plan the processes, including documented risk management in product realization.
7.2 Customer-related processes – determine and review requirements, including regulatory requirements and user training needs, and communicate with customers and regulators.
7.3 Design and development – planning, inputs, outputs, review, verification, validation, transfer, control of changes and the design and development file.
7.4 Purchasing – evaluate and select suppliers using criteria that consider risk, specify what is purchased, and verify purchased product.
7.5 Production and service provision – controlled production, cleanliness, installation, servicing, particular requirements for sterile devices, validation of processes (including sterilisation and software used in production), identification, traceability, customer property and preservation of product.
7.6 Control of monitoring and measuring equipment – calibration, adjustment, protection and validation of measurement software.

Clause 8 – Measurement, analysis and improvement

Clause 8 closes the loop. It covers feedback (gathering data from production and post-production as an early warning of quality problems), complaint handling with documented procedures and timely investigation, reporting to regulatory authorities when a complaint or event meets reporting criteria, internal audit, monitoring of processes and product, control of nonconforming product before and after delivery (including rework), analysis of data, and improvement through corrective and preventive action.

How the clauses fit together as a process model

The standard describes a process approach: inputs, including customer and regulatory requirements, flow through management, resources and product realization to produce a device; measurement and feedback then flow back to management. Every clause is part of that loop.

Figure 2 – The process loop behind ISO 13485: requirements drive management and realization, and market feedback flows back through measurement and improvement.

Lesson 4 – How it works in practice

Reading the clauses tells you what must exist. This lesson shows how the most important processes actually run inside a device company and how they connect.

Starting a QMS

A typical implementation follows these steps:

Identify roles and markets. Decide which roles you play (manufacturer, contract manufacturer, distributor, supplier) and which regulations apply in each target market. This determines exclusions, reporting duties and record-retention periods.
Define scope and processes. List the processes you run, from design to servicing, and the ones you outsource. Map how they interact.
Write the top-level documents. Quality policy, quality objectives, quality manual and the required documented procedures, kept short and usable.
Set up the core controls. Document and record control, training and competence, supplier control, nonconforming product, complaint handling, CAPA, internal audit and management review. These are needed before any product is shipped.
Build product-specific files. Risk management file, design and development file and medical device file for each device or family.
Run, record and review. Operate the system for a few months, audit it internally, hold a management review, fix gaps, and only then invite a certification body.

Design and development controls

Design controls are the heart of ISO 13485 for any manufacturer that designs devices. They exist because most device failures that reach patients can be traced back to design decisions: unclear user needs, missing requirements, untested edge cases or poorly managed changes.

Planning sets out the stages, reviews, verification, validation and transfer activities, responsibilities and how traceability from inputs to outputs will be kept. Design inputs capture functional, performance, usability and safety requirements, applicable regulatory requirements and standards, outputs of risk management and information from previous similar designs. Inputs must be complete, unambiguous, verifiable and free of conflicts. Design outputs are the specifications, drawings, software, labelling and production and purchasing information that define the device; they must meet the inputs and reference acceptance criteria.

Design reviews are formal, recorded meetings at planned stages that include people representing the functions concerned. Verification checks outputs against inputs through tests, inspections, analyses and calculations. If the device must connect to other devices, verification includes confirming the outputs still meet inputs when connected. Validation checks the finished device, or a representative production-equivalent unit, against user needs and intended use, and may include clinical evaluation or, for in vitro diagnostics, performance evaluation, where regulations require it. The sample choice must be justified.

Design transfer makes sure the outputs are suitable for manufacturing before they become final production specifications, and that production can reliably meet them. Design changes must be identified, reviewed for their effect on function, performance, usability, safety, regulatory status and on products already delivered, then verified or validated and approved before implementation. All of this is kept in the design and development file.

Purchasing and outsourcing

Few device makers build everything themselves. ISO 13485 requires documented criteria for evaluating and selecting suppliers based on their ability to supply product that meets requirements, their performance, and the effect of the purchased product on the quality of the device, all proportionate to risk. The organisation plans monitoring and re-evaluation of suppliers, deals with supplier problems in proportion to risk, and keeps records. Purchasing information should state product specifications, acceptance requirements, personnel qualifications and QMS requirements, and where appropriate a written agreement that the supplier will notify the organisation of changes before they are made. Purchased product must be verified, by inspection or other means, to the extent appropriate to risk. For important outsourced processes such as sterilisation, a quality agreement (a written contract describing quality responsibilities on both sides) is the normal tool.

Production, process validation and traceability

Production must be planned and controlled: documented procedures and methods, qualified infrastructure, monitoring and measuring, defined labelling and packaging operations, and a record for each batch or unit that identifies the quantity made and released and gives traceability. Where the result of a process cannot be fully verified by later inspection or testing, the process must be validated before use, for example sterilisation, sealing of sterile barrier systems, injection moulding or adhesive bonding. Validation typically covers installation qualification (equipment is installed correctly), operational qualification (the process works across its operating range) and performance qualification (the process consistently produces acceptable product under normal conditions), though the standard leaves the method to the organisation. Software used in production and in the QMS must also be validated before first use and after changes.

Products must be identified throughout realization, and their status (accepted, rejected, awaiting inspection) must be clear. Traceability rules must be documented and, for implantable devices, must cover components, materials and work-environment conditions that could cause the device to fail, and distributors must keep distribution records. Where a regulation requires a unique device identification (UDI) system, the organisation must document how it assigns and applies UDIs.

Feedback, complaints and CAPA

Once a device is in the field, the organisation must listen to it. The standard expects a feedback process that gathers data from production and from the market, and feeds risk management and product realization. Complaints must be handled under documented procedures in a timely way, including deciding whether the complaint needs investigation, whether it must be reported to a regulator, and what correction or corrective action is needed. If a complaint is not investigated, the reason must be recorded.

Figure 4 – How a field complaint moves through assessment, regulatory reporting, investigation and corrective action into management review and risk management.

Corrective action follows a documented procedure: review the nonconformity, determine its causes, evaluate the need for action, plan and document the action (including updates to documents), verify that it does not harm the ability to meet requirements or the safety and performance of the device, and review its effectiveness. Preventive action follows the same pattern for potential problems revealed by trend analysis. Actions must be proportionate to the effects of the problem; not every minor deviation needs a full CAPA, but the decision must be reasoned and recorded.

Nonconforming product

Product that does not meet requirements must be identified and segregated so that it is not used or delivered by mistake. It can be corrected, rejected, or accepted under concession only with justification, approval and, where needed, confirmation that regulatory requirements are still met. If nonconforming product is found after delivery, the organisation acts in proportion to the effects, which may include issuing an advisory notice. Rework must follow a documented procedure that considers its possible adverse effect on the product.

Lesson 5 – Assessment, certification and compliance

Internal audit and management review

Before any external party looks at the system, the organisation checks itself. Internal audits are run against a planned programme that considers the status and importance of processes and the results of earlier audits; auditors must not audit their own work. Findings lead to correction and corrective action without undue delay. Management review then considers audit results along with every other input and records decisions. A certification body will expect to see at least one full internal audit cycle and one management review before certifying.

Third-party certification

ISO itself does not certify anyone. Independent certification bodies do, ideally accredited by a national accreditation body that checks their competence against ISO/IEC 17021-1 and the International Accreditation Forum's mandatory document for medical-device QMS certification (IAF MD 9). A typical certification cycle runs for three years:

Stage 1 audit – a readiness review of documentation, scope and planning.
Stage 2 audit – an on-site (or partly remote) assessment of whether the system is implemented and effective, with interviews, record sampling and observation.
Surveillance audits – usually yearly, sampling parts of the system.
Recertification audit – a full review before the three-year certificate expires.

Auditors grade findings as major or minor nonconformities (terminology varies slightly between schemes). Major findings, such as a missing complaint-handling process or released product without required validation, must be corrected before a certificate is issued or maintained.

Regulatory use around the world

Certification against ISO 13485 is voluntary in itself; what matters is how each regulator uses the standard:

European Union. The MDR and IVDR require manufacturers to have a QMS. EN ISO 13485 is a harmonised standard, so conforming to it gives a presumption of conformity with the QMS requirements it covers (the European annexes show which ones). For most device classes a notified body, an organisation designated by an EU country to assess conformity, audits the QMS as part of the conformity assessment; the notified body also performs unannounced audits.
United States. The FDA QMSR (21 CFR Part 820) incorporates ISO 13485:2016 by reference, adds clause 3 of ISO 9000:2015 for terminology, and keeps some FDA-specific provisions, for example on complaint records, labelling and packaging controls and unique device identification. Where ISO text conflicts with US law, the law prevails. The FDA does not issue or require ISO 13485 certificates; it inspects manufacturers itself, and an ISO certificate does not replace an FDA inspection. Since the QMSR took effect, internal audit, supplier audit and management review records are no longer shielded from FDA inspectors as they were under the old regulation.
MDSAP. The Medical Device Single Audit Program lets one audit by a recognised auditing organisation satisfy several regulators: Australia (TGA), Brazil (ANVISA), Canada (Health Canada), Japan (MHLW and PMDA) and the United States (FDA). The audit uses ISO 13485:2016 plus each participating country's specific requirements. Health Canada requires an MDSAP certificate for Class II, III and IV device licences, and the FDA may accept MDSAP reports in place of routine inspections.
Other markets. Japan's QMS ministerial ordinance was aligned with ISO 13485:2016 in 2021, and many other regulators accept or require ISO 13485 certification as part of registration.

Figure 5 – One ISO 13485 quality system can be assessed by several routes: a certification body, an EU notified body, an MDSAP auditing organisation and the FDA.

What auditors look for

Experienced auditors follow evidence trails rather than reading manuals. They pick a complaint and follow it to the investigation, the regulatory reporting decision and the CAPA; they pick a design change and check its review, verification and risk assessment; they pick a supplier and look for qualification, monitoring and a quality agreement; they pick an operator and check training records against the work instruction they are using. A system that looks impressive on paper but cannot produce a consistent trail of records will struggle.

Lesson 6 – Worked example

To see how the pieces fit, follow a fictional company, Brightline Medical, a 60-person firm that designs a handheld wound-imaging device with embedded software and a single-use sterile spacer tip that touches the skin. Brightline plans to sell in the EU and the US. It assembles and tests the handheld device in-house, buys printed circuit boards from a contract electronics maker, and outsources ethylene oxide sterilisation of the spacer tips to a contract steriliser.

Step 1 – Roles, regulations and scope

The quality lead lists Brightline's roles: legal manufacturer in both markets. The regulatory team identifies the EU MDR (with a notified body because of the device class), the FDA QMSR and the US premarket pathway, plus product standards such as electrical safety and software life-cycle standards. The scope covers design, production, release, distribution and servicing of the device family at one site. No design exclusion is possible, because Brightline designs the device. Installation is not applied, because the device needs no installation, and the quality manual says so with the reason.

Step 2 – Core processes and documents

Brightline writes a two-page quality policy that commits to safe, effective devices and to meeting regulatory requirements, and sets measurable quality objectives such as complaint-investigation lead time and first-pass yield. It creates a lean quality manual and around twenty documented procedures, then appoints the head of quality as management representative. A process map shows how design, purchasing, production, complaint handling and CAPA connect. The eQMS software that stores documents and training records is validated with a risk-based approach: the vendor's evidence is reviewed, critical functions like electronic signatures and audit trails are tested, and the validation record is approved.

Step 3 – Design controls with risk management

The project team writes a design and development plan with four stages and a formal review at the end of each. User needs come from interviews with wound-care nurses. Design inputs translate these into measurable requirements: image resolution, measurement accuracy, battery life, cleaning compatibility, biocompatibility of the spacer tip and sterility assurance. A hazard analysis following ISO 14971 adds inputs such as protection against misidentifying a patient's images and limits on surface temperature.

Verification tests confirm accuracy against calibrated targets, electrical safety at an external laboratory and software unit and integration tests. Validation includes a usability study with nurses in a simulated clinic and a clinical evaluation based on literature and a small study. Design transfer includes production test procedures, inspection criteria, work instructions and a pilot build of three lots. Every step is recorded in the design and development file, and the risk management file is updated with the results.

Step 4 – Suppliers and outsourced processes

Brightline rates the contract steriliser as a high-risk supplier because sterility cannot be checked on every unit. It audits the steriliser, signs a quality agreement covering validation, change notification, cycle records and release responsibilities, and takes part in the sterilisation validation. The PCB supplier is rated medium risk: qualification is based on a questionnaire, first-article inspection and incoming functional testing. A low-risk supplier of shipping cartons is qualified on documentation alone. The supplier list records each rating and the planned re-evaluation frequency.

Step 5 – Production and release

The tip sealing process cannot be fully verified without destroying the pouch, so it is validated through installation, operational and performance qualification, with routine monitoring of seal parameters afterwards. Each production lot has a batch record showing materials, operators, equipment, test results and UDI labels applied, so any device can be traced back. Final release is signed by an authorised person only when all records are complete.

Step 6 – A complaint arrives

Eight months after launch, a hospital in Germany reports that a spacer tip pouch arrived open. The complaint is logged the same day. The team assesses whether the event meets the EU vigilance or US reporting criteria: no patient was harmed and the nurse noticed the open pouch before use, so the team records its reasoning and the decision that it is not reportable, keeping the decision under review if similar events appear. The investigation finds that one carton design allowed pouches to be crushed at a corner during transport. A corrective action changes the carton insert, is verified by a transport simulation test, and is checked for side effects on sterility and labelling. Three months later, trend data show no further open-pouch complaints, so the CAPA is closed as effective. The event, its analysis and the risk-file update all feed the next management review.

Step 7 – Audit and certification

Before the stage 1 audit, Brightline runs a full internal audit by trained staff from other departments and holds a management review. The notified body, which Brightline also uses as its ISO 13485 certification body, raises one minor nonconformity at the stage 2 audit, because two operators' training records did not show the latest revision of a work instruction, and Brightline corrects it and broadens its training check. The certificate is issued, surveillance audits are planned yearly, and the quality team prepares for an eventual FDA inspection under the QMSR, knowing that the same records will be reviewed by a different assessor with a different legal basis.

The lesson from Brightline is that ISO 13485 is not a document set prepared for auditors; it is a chain of connected controls. The open pouch was caught, assessed, reported or not reported for a stated reason, fixed at its cause and fed back into design and risk management, which is exactly what the standard intends.

Lesson 7 – Relationship to other standards and frameworks

ISO 13485 rarely stands alone. Device companies combine it with risk, software, usability and product-safety standards, and with each market's regulations. The table summarises the most common relationships.

Standard or framework	What it covers	How it relates to ISO 13485
ISO 9001	General quality management requirements for any organisation, focused on customer satisfaction and continual improvement	ISO 13485 began as a supplement to it. ISO 13485 drops the emphasis on customer satisfaction and continual improvement, adds regulatory, documentation and medical-device requirements, and keeps the older clause layout. Certification to one does not give certification to the other.
ISO 14971	Application of risk management to medical devices across the life cycle	ISO 13485 requires documented risk management in product realization and points to ISO 14971 in a note; in practice the two are used together, and the risk management file feeds design inputs, verification, purchasing and post-market activity.
IEC 62304	Software life-cycle processes for medical device software	Assumes the manufacturer runs a QMS such as ISO 13485 and adds detailed software development, maintenance, configuration and problem-resolution requirements.
IEC 62366-1	Usability engineering for medical devices	Supplies the method for the user-related design inputs and validation that ISO 13485 design controls require.
FDA QMSR (21 CFR 820)	US legal requirements for device manufacturers' quality systems	Incorporates ISO 13485:2016 by reference and adds some FDA-specific provisions; compliance is checked by FDA inspection, not certification.
EU MDR and IVDR	EU law on medical devices and in vitro diagnostics	Require a QMS; EN ISO 13485 is harmonised and gives a presumption of conformity for the covered requirements, but the regulations add duties such as post-market surveillance plans and a person responsible for regulatory compliance.
MDSAP	A single audit programme recognised by several regulators	Uses ISO 13485:2016 as the audit core and adds the participating countries' specific requirements.

ISO 13485 and ISO 9001 side by side

Organisations that already hold ISO 9001 often ask whether they can simply add a few procedures. The honest answer is that the overlap is large but the emphasis differs. ISO 9001 encourages flexibility in documentation; ISO 13485 requires specific documented procedures and long record retention. ISO 9001 talks about risks and opportunities to the business; ISO 13485 talks about risk to patients and users and links it to ISO 14971. ISO 9001 measures customer satisfaction; ISO 13485 collects feedback as an early warning of quality problems and must link it to regulatory reporting. ISO 9001 was updated with a 2026 edition, but that does not change ISO 13485's requirements; ISO 13485 is a separate standard with its own revision cycle.

Integrating with other management systems

Many device companies also run an environmental management system (ISO 14001), an information security management system (ISO/IEC 27001) for connected devices and health data, or occupational health and safety (ISO 45001). Integration is possible with a shared document system, combined internal audits and one management review, but the ISO 13485 parts, such as design controls, complaint handling and regulatory reporting, must remain clearly visible because regulators and notified bodies check them closely.

Common pitfalls and best practices

Pitfalls seen again and again in audits and inspections:

Writing procedures nobody follows. Copying a template QMS creates documents that do not match real work, and auditors find the gap within minutes by comparing records with procedures.
Treating design controls as paperwork after the fact. Writing design inputs once the device is finished produces inputs that simply restate the design and cannot be properly verified.
Weak complaint handling. Classifying real complaints as "customer enquiries", failing to record why no investigation was needed, or missing reporting deadlines are among the most common serious findings.
CAPA that only corrects. Retraining an operator or reworking a batch fixes the symptom; without root cause analysis and an effectiveness check the problem returns.
Uniform supplier control. Treating a sterilisation provider and a stationery supplier the same either wastes effort or leaves critical risk uncontrolled.
Forgetting software validation. Spreadsheets, eQMS tools and test software used in quality decisions are frequently left unvalidated.
Ignoring the market's rules. Assuming the certificate alone satisfies every regulator, when each market adds its own reporting, labelling and registration duties.

Practices that make the system work:

Start from your real processes and write the minimum documentation that controls them; keep procedures short, with flowcharts and clear owners.
Link everything to risk. Use the ISO 14971 risk file to decide verification depth, supplier controls, process validation and complaint severity.
Build traceability into tools, connecting user needs, inputs, outputs, tests and risks so that a change shows its impact instantly.
Train people on why, not only how, so that operators understand why a seal parameter or a cleaning step matters for patients.
Review complaint and CAPA trends monthly, not only at the yearly management review, and close actions with objective evidence of effectiveness.
Keep a regulatory watch that tracks changes in each target market and feeds them into management review and the QMS.
Use internal audits as a learning tool, following evidence trails across processes the way an external auditor would.

Summary and key takeaways

ISO 13485:2016 sets the QMS requirements for organisations involved in any stage of the medical device life cycle, including suppliers and service providers; it was confirmed without change at its latest systematic review and remains the current edition.
Its purpose is consistent safety, performance and regulatory compliance, so it emphasises regulatory requirements, documentation and maintaining effectiveness rather than customer satisfaction and continual improvement.
The requirements sit in clauses 4 to 8: QMS and documentation, management responsibility, resources, product realization and measurement, analysis and improvement.
Design and development controls, from planning through verification, validation and transfer, are central for any manufacturer that designs devices, and they work hand in hand with ISO 14971 risk management.
Purchasing, process validation, software validation and traceability controls should be proportionate to risk.
Complaints and feedback must be assessed for regulatory reporting, investigated and fed into corrective action, data analysis and management review.
Certification bodies, EU notified bodies, MDSAP auditing organisations and the FDA all assess against the standard in different ways; an ISO certificate does not replace regulatory inspections.
A working QMS is a chain of connected records that tells a consistent story, not a pile of documents written for auditors.

Reflection questions

Think of a device or component your organisation makes or could make. Which life-cycle roles would you play, which markets would you target, and which requirements of clauses 6, 7 or 8 might not apply, with what justification?
Pick one design requirement for that device and describe how you would verify it and how you would validate the user need behind it. What evidence would end up in the design and development file?
Rank three of your suppliers by risk to the finished device. What controls would you apply to each, and why would they differ?
Describe how a complaint about an intermittent fault would move through your system. Who decides whether it is reportable, and what records would an auditor ask to see?
If your organisation already runs ISO 9001, which three gaps would you expect to close first to meet ISO 13485, and how would you convince management that they matter?