Documentation Standard

ISO 13485

The quality management system standard for medical device organisations: the framework the other standards plug into.

Full title: Medical devices — Quality management systems — Requirements for regulatory purposes
Current edition: ISO 13485:2016, confirmed without change in ISO’s 2025 review
Applies to: Organisations at any stage of a device’s life cycle: design, production, installation and servicing, and the suppliers to them
Used by: The EU (harmonised as EN ISO 13485:2016+A11:2021), Canada and the other MDSAP countries and, since 2 February 2026, the US FDA, whose Quality Management System Regulation incorporates it by reference

In short

ISO 13485 describes what a manufacturer’s quality system must do, not how a product must perform. It grew out of ISO 9001 but is written for regulators: the emphasis is on documented procedures, records and meeting regulatory requirements. Conformity is shown by third-party audit and certification.

How it is organised

Clause 4, quality management system. Documentation, the medical device file, control of documents and records, and validation of software used in the quality system (4.1.6).
Clause 5, management responsibility. Quality policy, objectives and management review.
Clause 6, resources. Competence and training, infrastructure and work environment.
Clause 7, product realisation. Planning, customer requirements, design and development (7.3), purchasing and supplier control (7.4), production and service (7.5), and control of measuring equipment (7.6).
Clause 8, measurement, analysis and improvement. Feedback, complaint handling, reporting to regulators, internal audit, nonconforming product, and corrective and preventive action.

On a software project

Clause 7.3 is where design controls live. Planning, inputs, outputs, review, verification, validation, transfer, change control and the design and development file. See design controls.
Risk management runs through product realisation (7.1). In practice this means ISO 14971.
Tools that hold quality records need validating. Issue trackers, document and test management systems, and build pipelines that produce release evidence fall under 4.1.6. The effort is meant to be proportionate to the risk of the tool failing.
Suppliers are your responsibility. Contract developers and outsourced processes need evaluation, a written agreement and ongoing control (4.1.5 and 7.4).
Competence is a record. People doing work that affects product quality need documented training or experience (6.2).

Worth knowing

United States. Since 2 February 2026, 21 CFR Part 820 points to ISO 13485 rather than restating its own requirements, with FDA-specific additions on records, labelling and packaging, unique device identification and complaint reporting. Certification does not exempt a manufacturer from FDA inspection.
MDSAP. The Medical Device Single Audit Program lets one audit serve Australia, Brazil, Canada, Japan and the United States. Health Canada requires an MDSAP certificate for Class II, III and IV device licences.
It is not ISO 9001. The 2016 edition did not adopt the structure of ISO 9001:2015. An organisation can hold both certificates, but one does not imply the other.

Official sources

A summary for orientation. It is not regulatory or legal advice, and it is no substitute for the standard or regulation itself. Requirements change: confirm the current edition before relying on anything here. Last reviewed November 2026.