Standards
ISO 13485
In one line
International standard for medical device quality management systems.
Definition
ISO 13485:2016 specifies requirements for a quality management system where an organization needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements.
The standard is structured around QMS documentation, management responsibility, resource management, product realization (including design, purchasing and production) and measurement, analysis and improvement. Unlike ISO 9001, it emphasizes regulatory compliance and documented, risk-based processes over continual improvement. It is the basis for MDSAP audits, is a harmonised standard under the EU MDR and IVDR, and since February 2, 2026 has been incorporated by reference into FDA's QMSR.
Why it matters
ISO 13485 is referenced or required by regulators worldwide, including the EU (under MDR/IVDR) and Health Canada. FDA's Quality Management System Regulation (QMSR), effective February 2, 2026, explicitly incorporates ISO 13485:2016 by reference, replacing the previous 21 CFR Part 820 Quality System Regulation. Certification is issued by accredited third-party registrars and is renewed on a three-year cycle with annual surveillance audits.
Common pitfalls
- •Treating ISO 13485 certification as proof of regulatory approval. Certification confirms QMS conformity; individual products still require the appropriate marketing authorization (510(k), PMA, CE mark, etc.).
- •Copying an ISO 9001 QMS without adding medical-device-specific requirements (design controls, risk management, UDI, post-market surveillance, complaint handling).
- •Weak supplier controls. ISO 13485 expects documented supplier evaluation, monitoring, and re-evaluation proportional to component risk.
- •Under-scoping the QMS. Software design, cybersecurity, and contract-manufacturer activities all fall within scope when they affect the finished device.
Sources