Overview of ISO 13485:2016 Structure
ISO 13485:2016 is structured into eight clauses, with Clauses 1–3 covering scope, normative references, and definitions. The auditable requirements are contained in Clauses 4 through 8, which together define the complete framework for a medical device quality management system.
Clause 4 — Quality Management System
4.1 General Requirements
The organization must establish, implement, maintain, and continually improve a QMS in accordance with the standard. This includes identifying the processes needed for the QMS, determining their sequence and interaction, and ensuring the availability of resources to support their operation and monitoring.
4.2 Documentation Requirements
The QMS documentation must include a quality policy, quality objectives, a quality manual, documented procedures required by the standard, and records needed to demonstrate compliance. Key documentation requirements include:
- Quality Manual: Defining the scope of the QMS, documented procedures or references to them, and a description of the interaction between QMS processes.
- Document Control (4.2.4): Procedures for approving, reviewing, updating, and distributing documents, ensuring that current versions are available at points of use.
- Record Control (4.2.5): Procedures for identification, storage, protection, retrieval, retention, and disposition of records. Medical device records must be retained for a period at least equivalent to the lifetime of the device, but not less than two years from product release.
Clause 5 — Management Responsibility
5.1–5.2 Management Commitment and Customer Focus
Top management must demonstrate commitment to the QMS through establishing quality policy, ensuring quality objectives are set, conducting management reviews, and allocating adequate resources. The organization must ensure that customer and applicable regulatory requirements are determined and met.
5.3–5.4 Quality Policy and Planning
The quality policy must be appropriate to the organization's purpose, include a commitment to compliance and continual improvement, and be communicated throughout the organization. Quality objectives must be measurable and consistent with the quality policy.
5.5–5.6 Responsibility, Authority, and Management Review
Management must define and communicate responsibilities and authorities, appoint a management representative, and conduct management reviews at planned intervals. Management review inputs must include audit results, customer feedback, process performance, CAPA status, and regulatory changes.
Clause 6 — Resource Management
The organization must determine and provide the resources needed for the QMS, including:
- Human Resources (6.2): Personnel performing work affecting product quality must be competent based on education, training, skills, and experience. Training effectiveness must be evaluated and documented.
- Infrastructure (6.3): Buildings, workspace, process equipment, and supporting services must be adequate for product conformity.
- Work Environment (6.4): The work environment must be managed to prevent contamination and ensure product quality. Requirements for health, cleanliness, and clothing must be documented where contact with the product or work environment could affect device safety or performance.
Clause 7 — Product Realization
Clause 7 is the most extensive section, covering the entire product lifecycle from planning through production and delivery.
7.1 Planning of Product Realization
The organization must plan and develop the processes needed for product realization, including quality objectives, documentation requirements, verification and validation activities, and risk management activities throughout the product lifecycle.
7.2 Customer-Related Processes
Requirements related to the product must be determined, including customer-specified requirements, regulatory requirements, and any additional requirements determined by the organization. These requirements must be reviewed before commitment to supply.
7.3 Design and Development
This critical section covers design and development planning, inputs, outputs, review, verification, validation, transfer, and change control. Medical device design controls must ensure that design outputs meet design inputs, and that the finished device meets user needs and intended uses. Design validation must include clinical evaluation or performance evaluation under actual or simulated use conditions.
7.4 Purchasing
Purchased products and services affecting device quality must be controlled. The organization must evaluate and select suppliers based on their ability to supply conforming product. Purchasing information must describe the product or service requirements, and verification of purchased product is required.
7.5 Production and Service Provision
Production must be carried out under controlled conditions, including documented procedures, suitable equipment, monitoring, and defined labeling and packaging activities. Special processes that cannot be verified by subsequent monitoring or measurement must be validated. Requirements for product cleanliness, installation, and servicing activities are also specified.
7.6 Control of Monitoring and Measuring Equipment
Equipment used to verify conformity must be calibrated or verified at specified intervals, adjusted as necessary, identified with calibration status, and protected from damage. Calibration records must be maintained.
Clause 8 — Measurement, Analysis, and Improvement
8.2 Monitoring and Measurement
The organization must establish a feedback system to gather and monitor information on whether it has met customer requirements. This includes complaint handling procedures that comply with applicable regulatory requirements. Internal audits must be conducted at planned intervals to determine whether the QMS conforms to planned arrangements and is effectively maintained.
8.3 Control of Nonconforming Product
Nonconforming product must be identified, documented, evaluated, segregated (where practical), and dispositioned. Rework must be carried out in accordance with documented procedures, and reworked product must be re-verified. Concessions (use-as-is dispositions) require documented justification and regulatory consideration.
8.4 Analysis of Data
The organization must collect and analyze data to demonstrate QMS suitability and effectiveness, including data from monitoring activities, nonconformities, corrective and preventive actions, supplier evaluations, and complaints.
8.5 Improvement
The organization must establish documented procedures for corrective action (8.5.2) and preventive action (8.5.3). CAPA procedures must include investigation of root causes, determination of actions needed, verification of effectiveness, and review of CAPA records by management.
Regulatory Alignment
ISO 13485:2016 is designed to satisfy the quality management system requirements of multiple regulatory frameworks, including the EU Medical Device Regulation (MDR) 2017/745, the US FDA's 21 CFR Part 820, Canada's SOR/98-282 (CMDR), and Japan's MHLW Ordinance 169. For US-specific considerations, see our ISO 13485 for US Manufacturers page.
To discuss ISO 13485 certification or learn more about how the requirements apply to your organization, contact Udem Atlantic.