ISO 13485 Requirements: A Clause-by-Clause Guide

Who Must Meet ISO 13485 Requirements

ISO 13485 applies to organizations involved in one or more stages of the medical device lifecycle, regardless of size or device type.

It applies to organizations that:

• Design medical devices

• Manufacture medical devices

• Distribute medical devices

• Service medical devices

• Supply critical components

• Provide sterilization or packaging services

Unlike general quality frameworks, ISO 13485 integrates regulatory expectations directly into the management system. The organization must document its role under applicable regulations, such as manufacturer, authorized representative, importer, or distributor, because that role determines which requirements apply.

Not every requirement applies to every organization. Design and development controls can be excluded only where applicable regulations permit, and activities the organization doesn't perform can be marked as not applicable. Each exclusion must be justified in the quality manual.

How ISO 13485 Is Structured

ISO 13485:2016 is organized into eight clauses. Clauses 0 through 3 set out the introduction, scope, normative references, and definitions. Clauses 4 through 8 contain the requirements auditors evaluate:

• Clause 4: Quality management system

• Clause 5: Management responsibility

• Clause 6: Resource management

• Clause 7: Product realization

• Clause 8: Measurement, analysis, and improvement

Unlike ISO 9001:2015, ISO 13485:2016 does not follow the Annex SL high-level structure. Its clause numbers don't map one-to-one to other ISO management system standards, which matters when building an integrated system.

Core ISO 13485 Requirements by Clause

Each clause contains detailed sub-clauses. The summaries below cover the requirement areas that most consistently determine audit outcomes.

Clause 4: Quality Management System

Clause 4 requires the organization to establish, document, implement, and maintain a QMS and keep it effective in line with ISO 13485 and applicable regulatory requirements.

Key requirements include:

• Documenting the organization's role or roles under applicable regulations

• Applying a risk-based approach to the control of QMS processes

• Controlling outsourced processes in proportion to their risk

• Validating software used in the QMS before first use and, as appropriate, after changes

• Maintaining a quality manual that defines the QMS scope, justifies exclusions, and describes process interactions

• Establishing a medical device file for each device type or family

• Controlling documents and records

Records must be retained for at least the lifetime of the device as defined by the organization, and not less than two years from product release, or longer where regulations require it.

Clause 5: Management Responsibility

Clause 5 makes top management accountable for the QMS. Auditors expect executives to show how the system drives decisions and resource allocation, not only to approve the quality policy.

Key requirements include:

• Demonstrating commitment to the QMS and to regulatory compliance

• Establishing a quality policy and measurable quality objectives

• Documenting responsibilities, authorities, and interrelations for personnel who manage, perform, and verify work affecting quality

• Appointing a management representative with authority over the QMS

• Conducting management reviews at documented intervals, using defined inputs such as feedback, complaints, regulatory reporting, audit results, and CAPA status

Clause 6: Resource Management

Clause 6 requires the organization to provide the people, infrastructure, and work environment needed for an effective QMS and for safe, conforming devices.

Key requirements include:

• Defining competence requirements for personnel whose work affects product quality

• Providing training and evaluating its effectiveness

• Keeping records of education, training, skills, and experience

• Documenting infrastructure requirements, including maintenance activities and intervals

• Controlling the work environment where it can affect product quality

• Planning and documenting contamination control where applicable, including microorganism and particulate control for sterile devices

Training and competency records must link directly to the job roles that affect product quality.

Clause 7: Product Realization

Clause 7 is the most operationally intensive part of ISO 13485. It covers the device lifecycle from planning through production, delivery, and servicing.

Key requirements include:

• Planning product realization, including documented risk management activities

• Determining and reviewing customer and regulatory requirements before committing to supply

• Controlling design and development

• Evaluating, selecting, and monitoring suppliers, and verifying purchased product

• Controlling production and service provision, including cleanliness, installation, and servicing where applicable

• Validating processes whose output can't be fully verified, including sterilization and sterile barrier systems

• Identifying product and maintaining traceability, with added requirements for implantable devices

• Preserving product through handling, storage, and distribution

• Controlling and calibrating monitoring and measuring equipment

Traceability and documentation expectations are far stricter than in general quality management systems.

Design and Development Controls (Clause 7.3)

Design controls are a frequent source of findings in first-time ISO 13485 audits. The standard requires a documented, staged process for each design project.

Required elements include:

• Design and development planning, with defined stages, reviews, and responsibilities

• Design inputs, including functional, performance, usability, and safety requirements, applicable regulatory requirements, and risk management outputs

• Design outputs that can be verified against inputs

• Design reviews at planned stages

• Design verification to confirm outputs meet inputs

• Design validation, including clinical or performance evaluations where regulations require them

• Design transfer to production

• Control of design changes, including their effect on risk and on product already delivered

• A design and development file for each device type or family

Design records should let an auditor trace each requirement from input through verification, validation, and transfer.

Risk Management Across the Lifecycle

ISO 13485 requires documented risk management in product realization and applies a risk-based approach throughout the QMS, from outsourced processes to supplier controls and software validation. The standard doesn't define the risk management process itself. ISO 14971 is the recognized standard for that process.

Risk management activities include:

• Risk identification

• Risk analysis

• Risk evaluation

• Risk control

• Residual risk assessment

• Post-market monitoring

Risk files must stay connected to design, production, and post-market processes so that feedback and complaints update risk estimates over time. For guidance on aligning the two standards, see ISO 14971 risk management.

Supplier Control

Supplier qualification and monitoring are a major audit focus.

Organizations must establish controls for:

• Supplier evaluation

• Approved supplier lists

• Supplier monitoring

• Purchasing documentation

• Verification of purchased products

• Supplier corrective action processes

Critical component suppliers often require detailed evaluation records and periodic performance monitoring.

Clause 8: Measurement, Analysis, and Improvement

Clause 8 requires the organization to monitor, measure, and improve the QMS using evidence, with particular weight on feedback from devices in the field.

Key requirements include:

• Gathering feedback, including post-production data, as an input to risk management and improvement

• Documented complaint handling with timely investigation

• Reporting to regulatory authorities where regulations require it

• Internal audits at planned intervals

• Monitoring and measuring processes and product

• Controlling nonconforming product, including product found nonconforming after delivery

• Analyzing data on feedback, product conformity, process trends, suppliers, audits, and service

• Corrective and preventive action (CAPA) without undue delay

Auditors often test this clause by following a complaint or nonconformance through investigation, CAPA, and verification of effectiveness.

ISO 13485 Documentation Requirements

ISO 13485 requires more documented procedures and records than most ISO management system standards. Clause 4.2 sets the documentation framework, and individual clauses specify where a documented procedure or record is required.

Typical documentation includes:

• Quality manual

• Medical device file for each device type or family

• Documented procedures, including document control, record control, design and development, purchasing, complaint handling, internal audit, nonconforming product, and CAPA

• Work instructions

• Design and development files

• Risk management files

• Process and software validation records

• Production and batch records

• Supplier qualification and monitoring records

• Training and competency records

The medical device file typically includes the device description and intended use, labeling and instructions for use, product specifications, and procedures for manufacturing, storage, handling, distribution, measuring, installation, and servicing. Documentation as a whole must demonstrate traceability and regulatory compliance across the product lifecycle.

ISO 13485 vs ISO 9001

ISO 13485 is based on ISO 9001 but is written for regulatory purposes. ISO 9001 emphasizes customer satisfaction and continual improvement, while ISO 13485 emphasizes maintaining an effective QMS that meets regulatory requirements.

Key differences include:

• ISO 13485 focuses specifically on medical device regulatory compliance

• More documented procedures and records are required

• Risk management is required in product realization

• Design control requirements are more detailed

• Traceability expectations are higher, especially for implantable devices

• ISO 13485 doesn't follow the Annex SL structure, so clause numbers differ

Organizations producing medical devices may maintain both certifications depending on their markets and customers. For a side-by-side breakdown, see ISO 9001 vs ISO 13485.

How ISO 13485 Requirements Relate to FDA and EU MDR

ISO 13485 is a voluntary standard, but regulators in major markets build on it:

• United States: The FDA's Quality Management System Regulation (QMSR), effective February 2, 2026, amends 21 CFR Part 820 to incorporate ISO 13485:2016 by reference, with additional FDA-specific requirements. FDA does not issue ISO 13485 certificates and continues to inspect manufacturers directly.

• European Union: Under the EU Medical Device Regulation (EU) 2017/745, manufacturers must operate a QMS, and for most device classes a notified body assesses it during conformity assessment. The harmonized version of ISO 13485 is the usual way to demonstrate QMS conformity.

• MDSAP: The Medical Device Single Audit Program uses ISO 13485 as the basis for a single audit covering the requirements of participating regulators in the United States, Canada, Brazil, Australia, and Japan.

Because regulations add requirements beyond the standard, the QMS should document which regulatory requirements apply in each market served. For market-specific support, see FDA QMSR consulting and EU MDR 2017/745 compliance.

Certification and Audit Expectations

ISO 13485 certification requires an independent certification body to evaluate the organization's quality management system against the standard.

The audit process typically includes:

• Stage 1 audit — documentation and readiness review

• Stage 2 audit — operational effectiveness evaluation

• Surveillance audits — annual system monitoring

• Recertification audits — full reassessment every three years

Auditors evaluate whether the QMS consistently ensures safe and compliant medical device production.

An ISO 13485 gap analysis before Stage 1 compares current processes and records to each requirement, so gaps are closed before the certification body records them as nonconformities.

Benefits of Implementing ISO 13485

Organizations adopting ISO 13485 gain several operational and regulatory advantages.

Key benefits include:

• Improved medical device safety and reliability

• Stronger regulatory compliance

• Enhanced supplier control

• Improved product traceability

• Increased credibility with regulators and customers

• Structured risk management

• Better quality governance

For medical device manufacturers operating in regulated markets, ISO 13485 often becomes the foundation of their entire regulatory quality system.

Common Implementation Challenges

Organizations frequently encounter challenges when implementing ISO 13485.

Common issues include:

• Insufficient design control documentation

• Weak supplier qualification processes

• Incomplete risk management integration

• Poor traceability documentation

• Inadequate complaint handling systems

• Weak internal audit programs

• Lack of executive involvement

Successful implementation requires disciplined process design and leadership engagement.

Common Questions About ISO 13485 Requirements

What are the main requirements of ISO 13485?

The auditable requirements sit in Clauses 4 through 8: the quality management system and its documentation, management responsibility, resource management, product realization, and measurement, analysis, and improvement. Across all of them, the standard expects documented procedures, risk-based process control, and records that demonstrate regulatory compliance.

What is the current version of ISO 13485?

The current edition is ISO 13485:2016. In the EU, the harmonized version is published as EN ISO 13485, and the FDA's QMSR incorporates ISO 13485:2016 by reference.

Is ISO 13485 certification legally required?

Not in every market. FDA does not require certification, although the QMSR incorporates the standard's requirements. In the EU, a notified body assesses the QMS for most device classes, and Health Canada requires an MDSAP certificate for Class II to IV device licences, so the answer depends on your device classification and target markets.

Can any ISO 13485 requirements be excluded?

Yes, within limits. Design and development controls can be excluded only where applicable regulations permit, and requirements in Clauses 6, 7, or 8 can be marked not applicable when the organization doesn't perform the activity, such as sterilization. Every exclusion or non-application must be justified in the quality manual.

Does ISO 13485 apply to suppliers and contract manufacturers?

Yes. The standard can be used by suppliers and other external parties that provide products or services to medical device organizations, including component suppliers, contract manufacturers, and sterilization providers. Device manufacturers often ask critical suppliers for ISO 13485 certification as part of supplier qualification.

Next Steps

Organizations working toward ISO 13485 requirements typically move from assessment to implementation to ongoing maintenance:

• ISO 13485 Consultant Services

• ISO 13485 Implementation

• ISO 13485 Internal Audit Services

• ISO 13485 Maintenance

• Medical Device QMS

If you're unsure where your QMS stands against these requirements, a structured readiness assessment is the most efficient starting point. Use the form below to schedule a free consultation.