ISO 13485 — Medical devices: quality management systems
What is ISO 13485?
ISO 13485 is the international standard for quality management systems for medical devices. It sets requirements for organisations that design, manufacture, install, service or place medical devices on the market — including importers, distributors and sterilisation service providers.
Unlike ISO 9001, it doesn’t require customer satisfaction to be measured; the focus is on meeting regulatory requirements: traceability, risk management, the medical device file and complaint handling. The standard is voluntary, but regulators and customers often expect it as evidence.
How it differs from ISO 9001
ISO 13485 grew out of ISO 9001, but the two have since gone their separate ways. If you expect ‘ISO 9001 with a medical supplement’, your planning will be off.
- It doesn’t have the same structure. ISO 13485:2016 doesn’t follow the harmonised structure used by ISO 9001, 14001 and 45001, so the clauses don’t map one to one. For the same reason, the February 2024 amendment doesn’t affect it either — the amendment brought climate change into the context review of standards built on the harmonised structure, and ISO 13485 has no such requirement.
- The focus is on regulatory compliance. Customer requirements must still be determined and met, but satisfaction doesn’t have to be measured. Instead, the standard requires feedback from production and the market to be collected and analysed.
- It requires the system’s effectiveness to be maintained, whereas ISO 9001 requires continual improvement. In a regulated field, stability and repeatability take priority over change.
- Risk management is required throughout, not just as risk-based thinking.
- Many more required records. The standard names the documents that must exist rather than leaving it to the organisation.
Who the standard applies to
The standard isn’t limited to manufacturers. It applies to anyone in the chain who affects whether a medical device reaches the user in proper condition:
- medical device manufacturers, including contract manufacturers;
- importers, distributors and authorised representatives;
- companies that provide sterilisation, calibration, servicing and maintenance;
- suppliers of components, materials and software built into the device;
- providers of storage and transport under controlled conditions.
The standard allows individual requirements not to be applied if they don’t relate to the organisation’s role — but every exclusion must be justified and documented.
Implementation stages
- Defining your role and the regulations — where you sit in the chain and which regulatory requirements apply in the markets where you sell.
- Classifying the devices and defining the scope of the system, with a justification for every exclusion.
- Setting up risk management across the whole life cycle.
- A medical device file for each type or family of devices.
- Design and development control, if you develop devices yourself — with planning, inputs, outputs, verification, validation and transfer to production.
- Production control: cleanliness, traceability and identification, and validation of processes whose output can’t be verified afterwards.
- Complaint handling and reporting to the regulatory authorities.
- Internal audit and management review, followed by the certification audit.
How it helps with regulatory approval
An ISO 13485 certificate doesn’t, by itself, give you the right to place a device on the market — that comes from the relevant regulatory procedure. But a quality management system that meets ISO 13485 is usually what that procedure expects to see.
- Your quality system is organised the way certification bodies, notified bodies and the competent authorities expect, so the procedure is less likely to be held up by missing documentation.
- The medical device file and the risk records are in one place, rather than being pieced together after the fact when someone asks for them.
- Traceability means that in a recall you know exactly which batches went where.
- Customers and partners in the supply chain often require it as a condition of working with you.
The medical device file — what it must contain
The standard requires a medical device file for each type or family of devices: a set of documents showing the description and intended use of the device, its specifications, the manufacturing, packaging, storage, handling and distribution procedures, the requirements for measurement and monitoring, installation and servicing instructions where they apply, and the labelling, including any instructions for use.
It isn’t a single file written at the end. It is an index of what is produced anyway during development and production — provided it is kept from the start. When it is done retrospectively, the development decisions weren’t recorded at the time, so you can’t show why the device is the way it is.
Risk management across the whole life cycle
In ISO 9001, risk is a way of thinking. In ISO 13485 it is a requirement with records, across all processes — from development, through purchasing and production, to monitoring after delivery.
For medical devices this is done with ISO 14971, the standard for applying risk management to medical devices, to which ISO 13485 refers. It means that every decision affecting safety leaves a trail: which hazard was identified, how the risk was estimated and evaluated, which risk control measure was implemented, and whether its effectiveness was verified.
How long implementation takes
Implementing ISO 13485 usually takes 30 to 90 days. Exactly how long depends on the size of the organisation, the number of employees and how much of the above is already in place. In organisations that develop their own devices, the design and risk documentation takes the most work. We give an estimate for your case after a short conversation about the scope. On your side, for small and medium-sized organisations it takes 2 to 5 hours a week in total, spread across several people — more on this in our frequently asked questions.
What affects the price
Three things affect the cost of implementation:
- the size of the organisation;
- the number of employees;
- the standard being implemented — the amount of work differs from standard to standard.
We can only give an exact price after you get in touch and we have a short conversation about the scope. Without that, any figure would be guesswork, so we don’t give one here.
Frequently asked questions
Does ISO 13485 replace ISO 9001 for us?
For medical devices, ISO 13485 is the standard that is asked for, and it covers the quality system in that field. Some organisations keep ISO 9001 as well — because they also make products other than medical devices, or because customers ask for it.
Does the certificate give us the right to place a device on the market?
Not by itself. Placing a device on the market goes through a regulatory procedure that depends on the market and the device class. ISO 13485 is the quality system that the procedure requires or expects.
Does it apply to distributors that don’t manufacture anything?
Yes. The standard also covers storage, transport, delivery and complaint handling. Requirements that don’t relate to your role can be excluded, with a justification.
What if we use contract manufacturing?
Responsibility for conformity stays with you. The standard requires outsourced work to be controlled and the requirements to be set out in a written quality agreement — and the control must be proportionate to how much that work affects the safety of the device.
Does ISO 13485 require a management representative?
Yes. Unlike ISO 9001, which dropped this requirement in 2015, ISO 13485 keeps the requirement for top management to appoint a member of management responsible for the system and for reporting on its effectiveness. It is one of the differences most easily overlooked when you start from ISO 9001.
What if a requirement can’t apply to us?
Requirements that don’t relate to your activities — design and development at a distributor, for example — can be left out if the regulatory requirements allow it. The exclusion must be recorded and justified and is stated with the scope of the system.
General questions — cost and duration, who issues the certificate and how long it is valid — are covered in our frequently asked questions.
Related standards
- ISO 9001 — quality management systems; the basis from which ISO 13485 was developed, useful if you also make products other than medical devices.
- ISO 27001 — information security; relevant when the device includes software or when patient data is processed.
- Medical device registration — our service for the regulatory side of the work, separate from the quality system.
- Frequently asked questions about ISO standards — how certification works, how long a certificate is valid, what new editions mean.
- Overview of all standards — if you’re not sure what you need.
How STANDARDISO can help
We guide you through the whole process — from defining your role and the regulatory requirements, through the medical device file, risk management and design control, to complaint handling and the internal audit. The certificate is issued by an independent, accredited certification body.
We work from your real processes: the documentation describes what you actually do, rather than forcing your work into a template. We train your staff so they can keep using the system after the audit. Everyone on our team works in English, and we can prepare your documentation in English, Serbian or both.