ISO 13485:2016 sets out the requirements for a quality management system (QMS) for organizations involved in the lifecycle of medical devices, including in vitro diagnostics and medical software. This page explains what the standard asks for and how it is structured.
Purpose and scope
The standard has one central goal: to ensure that an organization consistently delivers medical devices that meet customer and regulatory requirements. It applies to manufacturers, but also to design firms, contract manufacturers, component and service suppliers, sterilization providers, distributors and software developers whose work affects device safety.
Unlike ISO 9001, which emphasizes customer satisfaction and continual improvement, ISO 13485 emphasizes regulatory compliance, risk-based thinking and documented evidence. Improvement is still expected, but the priority is maintaining an effective, controlled system.
How the standard is structured
| Clause | Topic | What it requires in practice |
|---|---|---|
| 4 | Quality management system | Define processes and their interactions, apply a risk-based approach, control outsourced processes, validate QMS software, maintain a quality manual, procedures, records and a medical device file for each device type |
| 5 | Management responsibility | Leadership commitment, quality policy and objectives, defined roles and authority, a management representative, and planned management reviews |
| 6 | Resource management | Competent and trained people, suitable infrastructure and work environment, contamination control where relevant |
| 7 | Product realization | Planning, customer requirements, design and development, purchasing, production and service, identification and traceability, control of monitoring and measuring equipment |
| 8 | Measurement, analysis and improvement | Feedback, complaint handling, regulatory reporting, internal audits, process and product monitoring, nonconforming product, data analysis, corrective and preventive action |
Documentation the standard expects
- Quality manual: describes the scope of the QMS, justifies any exclusions and references the procedures
- Documented procedures: the standard explicitly requires dozens, from document control to CAPA
- Medical device file: for each device type, the specifications, manufacturing, labeling, installation and servicing requirements (Clause 4.2.3)
- Records: evidence that procedures were followed, retained at least for the lifetime of the device as defined by the organization, and not less than two years from release
- Controlled documents: reviewed, approved, versioned and available where needed
Exclusions and non-applicable requirements
An organization can exclude design and development controls only where regulations allow it, and can treat other requirements in Clauses 6, 7 and 8 as not applicable when they genuinely do not apply to its activities, such as sterilization for a software company. Every exclusion must be justified in the quality manual.
Risk-based thinking throughout
Risk is not limited to product safety. ISO 13485 expects a risk-based approach to controlling QMS processes, selecting and monitoring suppliers, validating software used in the QMS and deciding how deeply to investigate problems. The level of control should match the risk to the patient and to compliance.
Who needs certification?
Certification is not legally required in every market, but it is the most common way to demonstrate a compliant QMS. In Europe, notified bodies assess the QMS against the IVDR or MDR; in Canada, MDSAP certification is mandatory; and many distributors and hospital customers require an ISO 13485 certificate before doing business.
ISO 13485 guide
Overview · Understanding the Standard · Design and Development Controls · Risk Management (ISO 14971) · CAPA, Complaints and Feedback · Suppliers and Outsourcing · Software, Cybersecurity and AI · The Certification Roadmap · ISO 13485 and the FDA QMSR
Need help? Salto Partners guides diagnostics, genomics and medical device companies through ISO 13485 and IVDR. Send us an email and we will set up a conversation.
For general information only; not legal or regulatory advice. Regulations and deadlines change, so confirm current requirements with your notified body or regulatory counsel. Last updated October 2026.