ISO 13485 — Medical Device Quality Management Systems
- ClassificationCategoryCompliance / Assurance StandardDomainQuality & SafetyFramework FamilyISO Industry Standards
- Regulatory ContextTypeStandardLegal InstrumentStandardSectorHealthcare SectorIndustryHealthcare & Life Sciences
- Region / PublisherRegionGlobalRegion DetailInternationalPublisherInternational Organization for Standardization (ISO)
- VersioningVersionISO 13485:2016Effective DateMarch 1, 2016 (third edition published; ISO sets no separate effective date)Issue DateMarch 1, 2016
- AdoptionAdoption ModelCertificationImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: No
ISO 13485:2016 is copyrighted by the International Organization for Standardization and sold through ISO and its national member bodies. License not included with platform.
Framework text is licensed by its publisher and is included only where stated above.
- ISO 13485:2016 is the international quality management system standard for organizations in the medical device life cycle.
- ISO/TC 210 published the third edition on March 1, 2016, replacing ISO 13485:2003 and ISO/TR 14969:2004.
- The organization identifies its regulatory roles and builds the applicable requirements into its quality management system.
- The FDA's Quality Management System Regulation, effective February 2, 2026, incorporates it by reference into 21 CFR Part 820.
- EN ISO 13485:2016 is a harmonized standard under Regulation (EU) 2017/745.
Overview
ISO 13485:2016 is the international standard for quality management systems of organizations involved in one or more life-cycle stages of a medical device, from design and development to servicing. ISO's technical committee ISO/TC 210 published it as the third edition on March 1, 2016, replacing ISO 13485:2003 and ISO/TR 14969:2004.
It specifies requirements for regulatory purposes: the organization identifies its role or roles under applicable regulatory requirements, identifies the requirements that apply to those roles and builds them into its quality management system (introduction, 0.1). Suppliers and other external parties can use it too (clause 1). It is a stand-alone standard based on ISO 9001:2008, and conformity to it does not by itself claim conformity to ISO 9001 (0.4).
Regulators use it directly. The U.S. FDA's Quality Management System Regulation, effective February 2, 2026, incorporates ISO 13485:2016 by reference into 21 CFR Part 820. EN ISO 13485:2016, with its AC:2018 and A11:2021 amendments, is a harmonized standard under Regulation (EU) 2017/745 (Implementing Decision (EU) 2021/1182).
Why does it matter?
ISO 13485:2016 is the quality management system standard that medical device regulators build on. It requires a documented system that covers design, production, traceability, complaint handling and reporting to regulators, and it ties that system to the organization's regulatory role.
Key benefits include:
- A regulatory basis
The FDA's QMSR incorporates ISO 13485:2016 into 21 CFR Part 820 from February 2, 2026, and EN ISO 13485:2016 is listed as a harmonized standard for Regulation (EU) 2017/745.
- A medical device file for each device
One or more files per device type or family contain or reference the documents that show conformity to the standard and to regulatory requirements (clause 4.2.3).
- Design records that stay current
A design and development file per device type or family includes or references conformity records and records of design changes (clause 7.3.10).
- Regulator-facing processes
Complaint handling (8.2.2), reporting to regulatory authorities (8.2.3) and control of nonconforming product detected after delivery (8.3.3) are written into the system.
- One audit for several markets
MDSAP audits against ISO 13485:2016 and the requirements of the participating regulators, so one audit can serve several of them.
How does it work?
ISO 13485:2016 has eight clauses. Clauses 1 to 3 give the scope, the normative reference to ISO 9000:2015 and the terms, including manufacturer, importer, distributor and authorized representative. Clauses 4 to 8 hold the requirements: quality management system, management responsibility, resource management, product realization, and measurement, analysis and improvement. Annex A compares the edition with ISO 13485:2003 and Annex B shows its correspondence with ISO 9001:2015.
The standard uses a process approach (0.3). A requirement qualified by "as appropriate" is deemed appropriate unless the organization can justify otherwise, and "documented" means established, implemented and maintained. The word "risk" refers to the safety or performance requirements of the device or to meeting applicable regulatory requirements (0.2).
If a requirement in clauses 6, 7 or 8 does not apply because of the organization's activities or the device, the organization does not need to include it and records the justification as described in 4.2.2. Where regulatory requirements permit it, design and development controls can be excluded, and any claim of conformity must reflect that exclusion (clause 1).
Key Elements
- Quality management system and documentation (clause 4)
General requirements, the quality manual (4.2.2), the medical device file (4.2.3), control of documents (4.2.4) and control of records (4.2.5).
- Management responsibility (clause 5)
Management commitment, customer focus, quality policy, planning, the management representative (5.5.2) and management review (5.6).
- Resource management (clause 6)
Provision of resources, human resources, infrastructure, and work environment and contamination control (6.4).
- Product realization (clause 7)
Planning, customer-related processes, design and development (7.3), purchasing (7.4), production and service provision (7.5) and control of monitoring and measuring equipment (7.6).
- Production controls (clause 7.5)
Validation of processes (7.5.6), sterile device requirements (7.5.5 and 7.5.7), identification (7.5.8) and traceability (7.5.9).
- Measurement, analysis and improvement (clause 8)
Feedback, complaint handling, reporting to regulatory authorities, internal audit, control of nonconforming product (8.3), analysis of data (8.4), corrective action and preventive action (8.5).
What does it cover?
ISO 13485:2016 applies to an organization that needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements. The organization can be involved in design and development, production, storage and distribution, installation or servicing. It applies regardless of size or type, except where the standard states otherwise. Processes the organization does not perform itself remain its responsibility and are controlled through monitoring and maintenance (clause 1).
What are its objectives?
ISO 13485:2016 aims to give regulators and customers confidence that a quality management system meets requirements consistently:
Demonstrate the ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements (clause 1).
Incorporate the regulatory requirements that apply to each of the organization's roles in the supply chain into its quality management system (0.1).
Support global alignment of appropriate regulatory requirements for quality management systems across the device life-cycle (0.4).
Complement, not replace, the technical requirements for product safety and performance (0.1).
Framework in Context
ISO 13485:2016 is stand-alone, and an organization whose system conforms to it cannot claim conformity to ISO 9001 unless it also meets all of ISO 9001 (0.4). Risk management is covered by ISO 14971. EN ISO 13485:2016 carries the AC:2018 and A11:2021 amendments in the EU, and the FDA's QMSR also incorporates clause 3 of ISO 9000:2015. The Medical Device Single Audit Program audits against ISO 13485:2016 and the requirements of its participating regulators: Australia, Brazil, Canada, Japan and the United States.
Common Framework Mappings
Organizations map ISO 13485 to related standards and regulations to harmonize quality, risk, software safety, and market access across device lifecycle.
Mapped frameworks include:
EU Medical Device Regulation (Regulation (EU) 2017/745)
FDA 21 CFR Part 820
IEC 60601 (Medical electrical equipment)
IEC 62304 (Medical device software — Software lifecycle processes)
IEC 81001-5-1 (Health software cybersecurity)
ISO 14971 (Medical devices — Risk management)
ISO 9001 (Quality management systems)
MDSAP (Medical Device Single Audit Program)
How SmartSuite Supports ISO 13485
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Compliance Management, Enterprise Risk Management, Third Party Risk Management and Internal Audit Management to hold procedures, device file references, supplier records, audit findings, nonconformities and corrective actions, with owners and status.
Quality Manual and Document Control
Hold the quality policy, procedures and the justification recorded for any clause not applicable (clauses 1 and 4.2.2).
Medical Device Files
Keep one record per device type or family that links to the documents in its medical device file (clause 4.2.3).
Design and Development Records
Track design stages, reviews, verification, validation, transfer and changes against each device (clauses 7.3.2 to 7.3.10).
Supplier and Purchasing Controls
Record supplier evaluation, purchasing information and verification of purchased product (clause 7.4).
Complaints and Regulatory Reporting
Log complaints and reports made to regulatory authorities with dates and owners (clauses 8.2.2 and 8.2.3).
Nonconformities, Audit and Review Actions
Track nonconforming product, corrective and preventive actions, internal audit findings and management review actions to closure (clauses 5.6, 8.2.4, 8.3 and 8.5).
Frequently Asked Questions For ISO 13485 (Medical Device Quality Management System)
ISO 13485:2016 is the third edition of the ISO quality management system standard for organizations involved in one or more life-cycle stages of a medical device, and for suppliers that provide product or services to them (clause 1). Manufacturers, importers, distributors and others identify their role under the regulations that apply and build those requirements into the system (0.1).
The standard itself does not require certification; it says certification bodies and other parties can use it to assess an organization's system (0.1). Whether a certificate is needed depends on the market. In the United States, the FDA's QMSR incorporates ISO 13485:2016 into 21 CFR Part 820 instead, and MDSAP gives one audit that serves several regulators.
The Quality Management System Regulation took effect on February 2, 2026 and amends 21 CFR Part 820 to incorporate ISO 13485:2016 and clause 3 of ISO 9000:2015 by reference. The FDA states that the rule now specifically requires risk management. Where an ISO 13485 clause conflicts with the Federal Food, Drug, and Cosmetic Act or its regulations, those control.
For each device type or family, clause 4.2.3 requires one or more files that contain or reference documents showing conformity to the standard and compliance with regulatory requirements. Clause 7.3.10 requires a design and development file that includes or references conformity records and records of design changes.
Yes, within limits. A requirement in clause 6, 7 or 8 that does not apply because of the organization's activities or the device can be left out, and the justification is recorded as described in 4.2.2. Design and development controls can be excluded only where regulatory requirements permit, and conformity claims must reflect it (clause 1).
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.