Current Edition Checked October 24, 2026
It was confirmed at its 2025 systematic review with no revision announced, and since February 2, 2026 it is also the substance of US law through the FDA QMSR.
Next: No new edition is scheduled. A guidance document on applying the standard is in preparation.
What It Covers
The quality management system requirements for organizations involved anywhere in the life cycle of a medical device, written for regulatory compliance rather than customer satisfaction. It keeps the clause structure of ISO 9001:2008 rather than the Harmonized Structure.
Who It Applies To
Device manufacturers and the suppliers and service providers around them — contract manufacturers, sterilizers, distributors, software developers — anywhere a regulator or customer expects a certified system. It underpins EU MDR conformity assessment, MDSAP, and the US QMSR.
Key Requirements
- A documented system: a quality manual (4.2.2) and a medical device file for each device type or family (4.2.3).
- Risk-based control of outsourced processes and suppliers (4.1.5, 7.4).
- Design and development planning, verification, validation, and transfer (7.3).
- Validation of production processes (7.5.6) and of software used in the quality system (4.1.6).
- Feedback, complaint handling, regulatory reporting, corrective and preventive action (8.2.1–8.2.3, 8.5.2–8.5.3).
What an Auditor Asks to See
- The quality manual and the medical device file for a device the auditor picks.
- Complaint records with the reportability decision and the link to CAPA.
- Process validation protocols and reports for the special processes on your floor.
- Supplier evaluation, selection and monitoring records, scaled to the risk of what they supply.
Where Systems Fall Short
- A medical device file assembled from references nobody can follow to the document.
- Software tools — spreadsheets, ERP, the eQMS itself — used in the system and never validated (4.1.6).
- Complaints closed one by one with no trend analysis feeding CAPA.
Structure at a Glance
| Part | Topic | What It Asks For |
|---|---|---|
| 4 | Quality Management System | General requirements, outsourcing, QMS software validation, documentation, quality manual, medical device file, document and record control. |
| 5 | Management Responsibility | Commitment, customer focus, quality policy and objectives, responsibility, management representative, management review. |
| 6 | Resource Management | People and competence, infrastructure, work environment, and contamination control. |
| 7 | Product Realization | Planning, customer requirements, design and development, purchasing, production and service provision, traceability, monitoring and measuring equipment. |
| 8 | Measurement, Analysis, and Improvement | Feedback, complaints, regulatory reporting, internal audit, monitoring, nonconforming product, data analysis, corrective and preventive action. |
Requirements Checklist
Work down the list with the evidence in hand. The PDF has a column for noting where each item is evidenced.
- Roles the organization plays (manufacturer, distributor, importer…) and applicable regulations documented (4.1.1).
- Exclusions and non-applications justified, with design and development excluded only where regulations allow.
- Medical device file contents complete for every device type or family (4.2.3).
- Document and record retention at least the lifetime of the device, and never less than two years (4.2.4–4.2.5).
- Management review inputs and outputs as listed in 5.6, including regulatory changes and complaints.
- Competence determined, provided and its effectiveness evaluated, not only training delivered (6.2).
- Design transfer, design changes, and design history kept for each device (7.3.8–7.3.10).
- Purchasing information and verification proportionate to supplier risk (7.4).
- Cleanliness, installation, servicing, and sterilization requirements where relevant (7.5.2–7.5.5, 7.5.7).
- Traceability, and for implantables the extended traceability records (7.5.8–7.5.9).
- Monitoring and measuring equipment calibrated to traceable standards, with software validated (7.6).
- Complaints, reporting, CAPA, and data analysis linked so a trend reaches a decision (8.2, 8.4, 8.5).
Implementation Roadmap
- 1. Gap assessment Compare the existing system clause by clause and size the work.
- 2. Document Write the quality manual, the required procedures, and the medical device files.
- 3. Implement Run the system for long enough to generate records — typically three months or more.
- 4. Audit and review A full internal audit and a management review before the registrar visits.
- 5. Certify Stage 1 (documentation) and Stage 2 (implementation) audits by an accredited certification body.
How It Fits with Other Standards
ISO 13485 is the backbone of three routes at once: EU MDR conformity assessment (Annex IX), MDSAP, and since February 2026 the US QMSR. It requires risk management throughout, which in practice means ISO 14971. It is not aligned with ISO 9001’s Harmonized Structure, so a combined system needs a clause map.
Findings We See Most Often
- Complaint files without investigation records or reporting decisions.
- CAPA effectiveness never verified, or verified by the same evidence that opened it.
- Process validation missing for a special process, or not revalidated after a change.
- Supplier monitoring that stops after initial approval.
How QES Helps
Quality manuals and procedures written for the person doing the job, a gap assessment against each clause, and a mock certification audit before the registrar arrives.
Related Standards
Sources. ISO — ISO 13485:2016 (opens in a new tab); MD Regulatory — ISO 13485:2016 status (updated October 2026) (opens in a new tab); US FDA — Quality Management System Regulation (QMSR) (opens in a new tab). Status checked October 24, 2026. This page summarizes ISO 13485:2016; it does not reproduce or replace it. Buy the standard from its publisher, or read the regulation in its official text, before relying on a detail. Not legal advice.