Overview

The quality management system standard for organizations involved in the medical device life cycle, written for regulatory purposes. ISO 13485:2016 is the third edition; a systematic review confirmed it and it remains current.

ISO 13485:2016, Medical devices — Quality management systems — Requirements for regulatory purposes, is the quality management standard for the medical device sector. It is the third edition and cancels and replaces ISO 13485:2003. It applies to organizations at any stage of the device life cycle — design and development, production, storage and distribution, installation, servicing, final decommissioning and disposal — and to suppliers and external parties providing quality-system-related services such as sterilisation, calibration or distribution.

Although it originated from ISO 9001, ISO 13485 deliberately did not adopt the harmonized structure used by ISO 9001:2015. It retains a structure based on the earlier ISO 9001:2008 layout — quality management system, management responsibility, resource management, product realization, and measurement, analysis and improvement. The reasoning is regulatory stability: the standard is written to be referenced by regulators, and frequent structural change would be disruptive. Organizations holding both certificates therefore have to map between two structures.

The regulatory orientation drives the substantive differences from ISO 9001. Requirements for documentation are prescriptive rather than discretionary: a quality manual is required, along with a medical device file for each device type or family containing or referencing the device description, specifications, manufacturing, monitoring and measurement procedures, installation and servicing requirements as applicable. Risk management is required throughout product realization, applying ISO 14971. Design and development requirements are detailed, including design and development files, design transfer to manufacturing, and controlled design changes. Requirements for sterile devices, cleanliness, contamination control, installation and servicing activities, and validation of processes including software used in the quality system are specified explicitly.

Post-market obligations are similarly explicit. The standard requires complaint handling, reporting to regulatory authorities where regulations require notification of adverse events, feedback processes covering production and post-production information, and advisory notices for field actions. Traceability requirements are stricter than in ISO 9001 and are heightened for implantable devices, where records must identify components, materials and work environment conditions.

ISO 13485 is embedded in regulation across major markets. In the European Union it is used as the basis for demonstrating quality management system conformity under the Medical Device Regulation and In Vitro Diagnostic Regulation, with assessment by notified bodies. In the United States, the FDA's Quality Management System Regulation, which took effect on 2 February 2026, replaced the previous Quality System Regulation in 21 CFR Part 820 and incorporates ISO 13485:2016 by reference. The Medical Device Single Audit Program allows a single audit against ISO 13485 plus jurisdiction-specific requirements to satisfy several participating regulators.

Certification is available through accredited certification bodies and, for regulatory purposes, through notified bodies and MDSAP auditing organizations. Because the standard is used for regulatory conformity, the choice of certification body matters: a certificate from an accredited body demonstrates quality system capability, while notified body assessment is what supports CE marking under EU regulation.

A systematic review of ISO 13485:2016 confirmed the standard rather than opening a revision, and no new edition has been published. Topics such as cybersecurity, artificial intelligence and enhanced post-market surveillance have been raised for a future revision, but the 2016 edition remains the standard in force.

Purpose

To specify requirements for a quality management system where an organization needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements, throughout one or more stages of the medical device life cycle.

Key Benefits

• The recognised quality management framework for medical device organizations worldwide
• Referenced by EU MDR and IVDR conformity assessment and incorporated by the US FDA QMSR
• Supports single-audit efficiency across several regulators through MDSAP
• Embeds risk management throughout product realization via ISO 14971
• Prescriptive documentation requirements produce records that withstand regulatory inspection
• Detailed design control, design transfer and design change requirements reduce late failures
• Strong traceability requirements, heightened for implantable devices
• Structured complaint handling, adverse event reporting and advisory notice processes
• Applies to suppliers and service providers as well as manufacturers, strengthening the supply chain

Key Requirements

• Document the quality management system, including a quality manual and the roles of regulatory requirements
• Establish and maintain a medical device file for each device type or family
• Demonstrate management responsibility, including a quality policy, objectives, planning and management review
• Appoint management representative responsibility for the quality management system
• Manage resources, including competence, training, infrastructure, work environment and contamination control
• Apply risk management throughout product realization in accordance with ISO 14971
• Control design and development: planning, inputs, outputs, review, verification, validation, transfer, change control and design files
• Control purchasing, including supplier evaluation, purchasing information and verification of purchased product
• Control production and service provision, including cleanliness, installation and servicing activities where applicable
• Meet the particular requirements for sterile medical devices and for sterile barrier systems
• Validate processes whose output cannot be verified, and validate software used in the quality management system
• Maintain identification and traceability, with heightened requirements for implantable devices
• Preserve product, including handling, packaging, storage and protection
• Control monitoring and measuring equipment
• Operate feedback, complaint handling and reporting to regulatory authorities as required
• Conduct internal audit, monitor and measure processes and product, and control nonconforming product
• Analyse data and take corrective and preventive action; issue advisory notices where needed
• Retain records for the period defined by the organization and applicable regulatory requirements

Who Needs This Standard?

Medical device manufacturers of every class, in vitro diagnostic manufacturers, contract manufacturers and design houses, sterilisation and packaging service providers, calibration laboratories serving the sector, distributors and importers with quality system obligations, and developers of software as a medical device. It is required in practice for market access in the EU, and underpins the FDA QMSR in the United States and MDSAP in participating jurisdictions.

Related Standards