ISO 13485

ISO 13485 is the international standard specifying requirements for a quality management system (QMS) where an organisation needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and regulatory requirements. The current edition is ISO 13485:2016, and it applies across the lifecycle from design through manufacture, installation and servicing.

It applies not only to device manufacturers but to organisations throughout the supply chain, including component suppliers, sterilisation services, contract manufacturers and distributors, each implementing the parts relevant to their role.

How it differs from ISO 9001

Although derived from the same family, ISO 13485 is deliberately more prescriptive. Where ISO 9001 emphasises continual improvement and customer satisfaction, ISO 13485 emphasises regulatory compliance, risk management and documented evidence. Requirements for design controls, traceability, record retention, validation of processes and complaint handling are considerably more detailed, and the standard expects a risk-based approach throughout.

Core elements

• Management responsibility including a defined quality policy and management review.
• Design and development controls with planning, inputs, outputs, review, verification, validation and transfer.
• Document and record control with defined retention periods.
• Supplier controls including evaluation and monitoring of purchased goods and services.
• Production and process validation where output cannot be fully verified by inspection.
• CAPA: corrective and preventive action driven by complaints, audits and non-conformities.
• Post-market feedback feeding back into design and risk files.

Certification in practice

Certification is issued by an accredited body following a two-stage audit, with annual surveillance audits and a full recertification cycle. In the EU the Notified Body assesses the QMS as part of conformity assessment. Certification is not strictly mandatory in every jurisdiction, but in practice it is expected by Notified Bodies, procurement teams and partners, and building the system early is far cheaper than retrofitting it before an audit.