What Does ISO 13485 Require?
ISO 13485:2016, Medical devices: Quality management systems: Requirements for regulatory purposes, sets out what a quality management system (QMS) must contain when an organization designs, makes, installs, services, or distributes medical devices, or supplies related services. It has eight clauses. Clauses 1 to 3 cover scope, normative references, and terms. Clauses 4 to 8 hold the requirements that certification bodies and regulators audit.
This article is the clause-level reference. For each clause you get what the text asks for, which documented procedures and records it calls for, and the questions an auditor is likely to put to you. If you need background first, start with the overview of what ISO 13485 is.
Clause numbers and wording below follow ISO 13485:2016. The standard is copyrighted, so I summarize rather than reproduce it. Confirm any detail you intend to rely on against your licensed copy.
Two ideas run through the whole standard. The first is regulatory purpose: the standard exists to support compliance with medical device regulations, which is the main difference from ISO 9001. The second is risk. Clause 4.1.2 requires a risk-based approach to controlling the processes of the QMS, and that one sentence is why a high-risk sterile implant and a low-risk reusable accessory can both conform while running very different levels of control.
How Is ISO 13485:2016 Structured?
| Clause | Title | What it covers |
|---|---|---|
| 1 | Scope | Applicability, exclusion and non-application rules |
| 2 | Normative references | Points to ISO 9000:2015 |
| 3 | Terms and definitions | ISO 9000:2015 terms plus the standard's own |
| 4 | Quality management system | General requirements, documentation, records |
| 5 | Management responsibility | Commitment, policy, planning, management review |
| 6 | Resource management | People, infrastructure, work environment |
| 7 | Product realization | Planning, customer processes, design, purchasing, production, control of monitoring and measuring equipment |
| 8 | Measurement, analysis and improvement | Feedback, complaints, audit, nonconformity, data, CAPA |
Exclusion versus non-application
Clause 1 contains two separate mechanisms, and they are often blurred together.
- Exclusion of design and development controls. Where applicable regulatory requirements permit a manufacturer to leave out design and development controls, clause 1 allows that to justify the omission. The organization remains responsible for making sure its claims of conformity reflect the exclusion.
- Non-application. A requirement in clause 6, 7, or 8 that does not apply because of the organization's activities or the nature of the device does not need to be included in the QMS.
Clauses 4 and 5 are not subject to either route. Whichever one you use, 4.2.2 requires the quality manual to state the scope, including details of and justification for any exclusion or non-application. A process that applies to your device but is carried out by someone else is not excluded. You still account for it through monitoring and control, which clause 1 and 4.1.5 make your responsibility.
Clause 4: Quality Management System
4.1 General requirements
- 4.1.1 Document the processes of the QMS and the role (or roles) your organization takes under applicable regulations, such as manufacturer, authorized representative, importer, or distributor.
- 4.1.2 Apply a risk-based approach to controlling the processes.
- 4.1.3 For each process, determine criteria and methods, make resources available, monitor and measure, and keep records.
- 4.1.4 Evaluate the impact of planned process changes on the QMS and on the devices produced under it.
- 4.1.5 Keep control of outsourced processes. You retain responsibility for conformity. Controls must be proportionate to the risk and to the external party's ability to meet requirements (in line with 7.4), and they must include written quality agreements.
- 4.1.6 Document procedures for validating software used in the QMS. Validate before initial use and after changes, in proportion to risk.
An auditor will ask: Which of your processes are outsourced, and where is the quality agreement? Show me the validation record for your complaint database.
4.2 Documentation requirements
- 4.2.1 General. The QMS documentation includes the quality policy and objectives, the quality manual, the documented procedures and records the standard requires, documents you need for effective planning and operation, and anything else regulations specify.
- 4.2.2 Quality manual. Covers the scope with justification for any exclusion or non-application, the documented procedures or references to them, and a description of how processes interact.
- 4.2.3 Medical device file. One per device type or family. It holds or references the general description, intended use, labeling and instructions for use, product specifications, manufacturing, packaging, storage, handling and distribution specifications or procedures, measuring and monitoring procedures, and, where appropriate, installation and servicing requirements.
- 4.2.4 Control of documents. Documented procedure. It covers review and approval before issue, updating, identifying changes and current revision, availability at points of use, legibility, control of external documents, and preventing use of obsolete documents.
- 4.2.5 Control of records. Documented procedure. Records must be kept for at least the lifetime of the device as defined by the organization, or as regulations specify, and not less than two years from the date the organization releases the product.
An auditor will ask: Can I see the device file for this product? How do you know this work instruction is the current revision? What is the retention period for this record, and where is it written down?
Clause 5: Management Responsibility
Top management owns this clause, and auditors interview them directly. Expect to be asked for evidence beyond a signed policy.
- 5.1 Management commitment. Top management communicates the importance of meeting customer and regulatory requirements, establishes the quality policy and objectives, conducts management review, and ensures resources are available.
- 5.2 Customer focus. Customer and applicable regulatory requirements are determined and met.
- 5.3 Quality policy. Includes a commitment to comply with requirements and to maintain QMS effectiveness, provides a framework for objectives, and is communicated, understood, and reviewed for suitability.
- 5.4 Planning. Quality objectives (5.4.1) are measurable and consistent with the policy. QMS planning (5.4.2) keeps the system intact when changes are planned.
- 5.5 Responsibility, authority, and communication. Roles are defined, documented, and communicated (5.5.1). Top management appoints a management representative (5.5.2) who ensures processes are documented, reports on QMS performance, and promotes awareness of regulatory and customer requirements. Internal communication (5.5.3) covers QMS effectiveness.
5.6 Management review
- 5.6.1 General. Documented procedures for management review. Reviews take place at documented planned intervals, and records are kept.
- 5.6.2 Inputs. Feedback, complaint handling, reporting to regulatory authorities, audits, monitoring and measurement of processes, monitoring and measurement of product, corrective and preventive action, follow-up from earlier reviews, changes that could affect the QMS, recommendations for improvement, and new or revised regulatory requirements.
- 5.6.3 Outputs. Improvements needed to keep the QMS suitable, adequate, and effective, product improvement related to customer requirements, changes needed in response to regulatory requirements, and resource needs.
An auditor will ask: Show me the last two management reviews. Where is the complaint data? Who decided on the resources listed in the outputs, and did they arrive?
The management review guide covers frequency and agenda design in more detail.
Clause 6: Resource Management
Clause 6 is short, but it is the evidence trail for competence and for the controlled environment that production depends on.
- 6.1 Provision of resources. Determine and provide the resources needed to implement the QMS, maintain its effectiveness, and meet regulatory and customer requirements.
- 6.2 Human resources. People doing work that affects product quality must be competent based on education, training, skills, and experience. Document how competence is established, provide training, ensure awareness, evaluate training effectiveness, and keep records.
- 6.3 Infrastructure. Document requirements for buildings, workspace, process equipment, and supporting services. Where maintenance (or its absence) can affect product quality, document maintenance requirements including intervals, and keep maintenance records.
- 6.4.1 Work environment. Document requirements for the work environment where it can affect product quality, including health, cleanliness, and clothing where personnel contact could affect the product.
- 6.4.2 Contamination control. Plan and document arrangements for controlling contaminated or potentially contaminated product. For sterile devices, document requirements for controlling microbial and particulate contamination and maintain cleanliness during assembly and packaging.
An auditor will ask: How did you decide this operator was competent to run this process? How did you check the training worked? Where are the maintenance intervals for this equipment, and where is the last record?
Clause 7: Product Realization
Clause 7 is the largest clause and holds most of the documented procedures. Remember that non-applicable requirements in this clause can be left out with justification (see clause 1 above).
7.1 Planning of product realization
Plan and develop the processes needed for realization. Document one or more processes for risk management across product realization, and keep records of the risk management outputs. The guide to integrating ISO 14971 with ISO 13485 shows how the two standards connect here.
7.2 Customer-related processes
- 7.2.1 Requirements. Determine requirements specified by the customer, requirements not stated but necessary for intended use, applicable regulatory requirements, user training needed for safe and specified performance, and any additional requirements you set.
- 7.2.2 Review. Review requirements before committing to supply, and keep records.
- 7.2.3 Communication. Plan and document arrangements for communicating with customers about product information, enquiries and orders, customer feedback including complaints, and advisory notices. Communicate with regulatory authorities as regulations require.
7.3 Design and development
7.3.1 requires documented procedures for design and development. The remaining subclauses run in sequence:
| Subclause | Requirement | Typical record |
|---|---|---|
| 7.3.2 Planning | Stages, review/verification/validation at each stage, responsibilities, traceability of outputs to inputs | Design and development plan |
| 7.3.3 Inputs | Functional, performance, usability, safety, regulatory, and risk management inputs | Design input specification |
| 7.3.4 Outputs | Meet inputs, give information for purchasing and production, contain acceptance criteria | Drawings, specifications, procedures |
| 7.3.5 Review | Systematic reviews at suitable stages, with participants including representatives of functions concerned | Review minutes with attendees |
| 7.3.6 Verification | Outputs meet inputs | Test protocols and reports |
| 7.3.7 Validation | Device meets user needs and intended use, on representative product, with recorded rationale for the choice; clinical evaluation or performance evaluation where regulations require | Validation reports |
| 7.3.8 Transfer | Documented procedures; outputs verified as suitable for manufacturing before becoming final production specifications | Transfer records |
| 7.3.9 Control of changes | Identify, review, verify, validate as appropriate, and approve changes before implementation | Change records |
| 7.3.10 Design and development files | One file per device type or family | Design and development file |
An auditor will ask: Trace this user need to a design input, an output, a verification test, and the validation. Who attended this design review besides the design team? Which units were used for validation, and why?
The design controls page goes deeper on how to build this into a working procedure.
7.4 Purchasing
- 7.4.1 Process. Documented procedures to make sure purchased product conforms to specified information. Set criteria for evaluating and selecting suppliers, and for monitoring and re-evaluating them. Criteria are proportionate to the effect on the device and the associated risk. Keep records of evaluation, monitoring, and re-evaluation.
- 7.4.2 Purchasing information. Specify the product to be purchased. This includes, as applicable, a written agreement that the supplier will notify you of changes before implementing changes that affect the product's ability to meet requirements.
- 7.4.3 Verification. Establish and implement inspection or other activities to confirm purchased product meets requirements.
An auditor will ask: Show me the approved supplier list and the last re-evaluation for your sterilizer. How would you learn of a change at that supplier?
7.5 Production and service provision
7.5 is the longest part of clause 7. The subclauses are separate topics, so I list them in the standard's own numbering.
- 7.5.1 Control of production and service provision. Production is planned and carried out under controlled conditions, including documented procedures and methods, infrastructure qualification, monitoring and measurement, defined labeling and packaging operations, and defined release, delivery, and post-delivery activities. Keep a record for each device or batch that provides traceability to the extent specified in 7.5.9 and shows the quantity manufactured and the quantity approved for distribution.
- 7.5.2 Cleanliness of product. Document requirements where product is cleaned before sterilization or use, is supplied non-sterile, or has process agents to be removed.
- 7.5.3 Installation. Document installation requirements and acceptance criteria where installation can affect the device.
- 7.5.4 Servicing. Where servicing is a specified requirement, document servicing procedures and reference materials. Analyze servicing records to decide whether any are complaints and as an input to improvement.
- 7.5.5 Sterile devices. Keep records of the sterilization process parameters for each sterilization batch, traceable to each production batch.
- 7.5.6 Validation of processes. Required when the output cannot be verified by later monitoring or measurement. Document procedures covering review and approval criteria, equipment approval and personnel qualification, methods and acceptance criteria, statistical techniques where appropriate, records, revalidation, and approval of changes. Software used in production or service provision is validated before first use and after changes.
- 7.5.7 Sterilization and sterile barrier systems. Document procedures for validating these processes. Validate before implementation and after product or process changes, and keep results.
- 7.5.8 Identification. Document procedures for identifying product through realization. Also document a procedure to ensure devices returned to the organization are identified and distinguished from conforming product.
- 7.5.9 Traceability. 7.5.9.1 requires documented procedures defining the extent of traceability in line with regulations and the records required. 7.5.9.2 adds requirements for implantable devices: records of components, materials, and work environment conditions where these could cause the device to miss its specifications, and records of the name and address of the shipping package consignee. Service providers or distributors must also keep distribution records that are available for inspection.
- 7.5.10 Customer property. Identify, verify, protect, and safeguard it, and report loss, damage, or unsuitability to the customer.
- 7.5.11 Preservation of product. Document procedures or work instructions for protecting product during processing, storage, handling, and distribution, including special conditions for items with limited shelf life.
An auditor will ask: Pick a finished lot. Show me everything from receipt of components to the shipping record. How do you tell a returned device from stock on the shelf? When was this sterilization process last revalidated?
The traceability and device history records article and the sterile manufacturing and process validation guide are practical companions for 7.5.7 and 7.5.9.
7.6 Control of monitoring and measuring equipment
- Determine what monitoring and measurement is needed and which equipment provides the evidence of conformity.
- Document procedures to make sure measurements are carried out consistently with requirements.
- Calibrate or verify equipment at specified intervals or before use against standards traceable to international or national standards. Record the basis where no such standard exists.
- Identify calibration status and protect equipment from adjustments or damage that would invalidate results.
- When equipment is found out of tolerance, assess and record the validity of earlier results and take action on the equipment and affected product.
- Validate software used for monitoring and measurement under a documented procedure.
An auditor will ask: What did you do the last time a gauge came back out of tolerance? Which lots were reassessed?
Clause 8: Measurement, Analysis and Improvement
8.1 General
Plan and implement the monitoring, measurement, analysis, and improvement processes needed to show conformity and maintain QMS effectiveness. Determine applicable methods, including statistical techniques, and how far to use them.
8.2 Monitoring and measurement
- 8.2.1 Feedback. Documented procedures for gathering data from production and post-production. The information is a potential input to risk management and to monitoring product requirements and realization processes. If regulations require specific post-production experience, review of it is part of the feedback process. The post-market surveillance article shows how this extends under EU MDR.
- 8.2.2 Complaint handling. Documented procedures for timely handling. They must cover receiving and recording information, evaluating whether it is a complaint, investigating, deciding whether to report to regulators, handling complaint-related product, and deciding whether correction or corrective action is needed. If a complaint is not investigated, document the justification. Keep complaint records.
- 8.2.3 Reporting to regulatory authorities. Where regulations require notification of complaints that meet reporting criteria for adverse events, or of advisory notices, document procedures for notifying the authorities. Keep records of reports.
- 8.2.4 Internal audit. Documented procedures describing responsibilities and requirements for planning and conducting audits, and for records and reporting. The audit program considers the importance of the processes and the results of earlier audits. Criteria, scope, interval, and methods are defined. Auditors must be objective and impartial and must not audit their own work. Management of the audited area acts on findings without undue delay, and follow-up verifies the actions.
- 8.2.5 Monitoring and measurement of processes. Use suitable methods that show the processes can reach planned results. When they do not, correct and take corrective action as appropriate.
- 8.2.6 Monitoring and measurement of product. Verify that product requirements are met at applicable stages, keep evidence of conformity with acceptance criteria, and record who authorizes release. Release and service delivery do not proceed until the planned arrangements are complete. For implantables, also record the identity of the person who performed the inspection or testing.
An auditor will ask: Show me the last complaint you decided not to investigate and the written reason. Who reports to the regulator, and what triggers that decision? How do you make sure auditors are not auditing their own work?
The internal audit checklist is built around this clause.
8.3 Control of nonconforming product
- 8.3.1 General. Documented procedure defining controls, responsibilities, and authorities for identifying, documenting, segregating, evaluating, and dispositioning nonconforming product. Evaluation includes deciding whether an investigation is needed and whether an external party must be told. Keep records of nonconformities, actions, and the rationale for decisions.
- 8.3.2 Detected before delivery. Eliminate the nonconformity, prevent the original intended use, or authorize use, release, or acceptance under concession. A concession requires justification, approval, and regulatory compliance. Keep records of concessions and the identity of the person who authorized them.
- 8.3.3 Detected after delivery. Take action appropriate to the actual or potential effects, and keep records. Document procedures for issuing advisory notices in line with regulations. These procedures must be capable of being put into effect at any time, and records of the actions are kept.
- 8.3.4 Rework. Follow documented procedures that account for the possible adverse effect of the rework. Those procedures get the same review and approval as the original. Verify reworked product against acceptance criteria and regulatory requirements, and keep records.
8.4 Analysis of data
Documented procedures to determine, collect, and analyze data that show the QMS is suitable, adequate, and effective. The analysis covers feedback, conformity to product requirements, characteristics and trends of processes and product, suppliers, audits, and service reports where appropriate. Results are recorded and used as input to improvement.
8.5 Improvement
- 8.5.1 General. Identify and implement the changes needed, using the quality policy, objectives, audit results, post-market surveillance, data analysis, corrective and preventive action, and management review.
- 8.5.2 Corrective action. Documented procedure covering review of nonconformities including complaints, determining causes, evaluating the need for action, planning and implementing it (including updating documents), verifying it does not adversely affect regulatory compliance or device safety and performance, and reviewing effectiveness. Keep records.
- 8.5.3 Preventive action. Documented procedure with the same steps applied to potential nonconformities and their causes. Keep records.
An auditor will ask: Show me a closed corrective action and the evidence you checked effectiveness. Which data analysis fed the last management review?
Which Procedures Does ISO 13485 Explicitly Require?
This table collects the documented procedures named in clauses 4 to 8. Applicable regulations and your role in the supply chain can add to it, so treat it as a minimum prompt. Verify each row against the standard text.
| Area | Documented procedure for | Clause |
|---|---|---|
| Quality system | QMS software validation | 4.1.6 |
| Quality system | Control of documents | 4.2.4 |
| Quality system | Control of records | 4.2.5 |
| Management | Management review | 5.6.1 |
| Design | Design and development | 7.3.1 |
| Design | Transfer to manufacturing | 7.3.8 |
| Purchasing | Purchasing process | 7.4.1 |
| Production | Process validation, including production software | 7.5.6 |
| Production | Sterilization and sterile barrier validation | 7.5.7 |
| Production | Identification, including returned devices | 7.5.8 |
| Production | Traceability | 7.5.9.1 |
| Production | Preservation of product (procedures or work instructions) | 7.5.11 |
| Equipment | Monitoring and measuring equipment, including software | 7.6 |
| Feedback | Feedback process | 8.2.1 |
| Feedback | Complaint handling | 8.2.2 |
| Feedback | Regulatory reporting, where required by regulation | 8.2.3 |
| Checking | Internal audit | 8.2.4 |
| Nonconformity | Control of nonconforming product | 8.3.1 |
| Nonconformity | Advisory notices | 8.3.3 |
| Nonconformity | Rework | 8.3.4 |
| Data | Analysis of data | 8.4 |
| Improvement | Corrective action | 8.5.2 |
| Improvement | Preventive action | 8.5.3 |
Concessions under 8.3.2 do not need a separate procedure, but they do require records of justification, approval, and the authorizing person.
How Does FDA's QMSR Relate to ISO 13485?
FDA's Quality Management System Regulation amended 21 CFR Part 820 and incorporates ISO 13485:2016 by reference. The final rule was published in the Federal Register on February 2, 2024 (89 FR 7496, docket FDA-2021-N-1303) and took effect on February 2, 2026. The incorporation sits in 21 CFR 820.7, and 21 CFR 820.10 sets out the requirement to establish and maintain a QMS meeting the incorporated standard.
Incorporation by reference has limits worth understanding:
- Only ISO 13485:2016 is incorporated, along with the ISO 9000:2015 definitions it relies on. Where Part 820 defines a term, read that definition alongside the ISO one.
- In the incorporated text, references to applicable regulatory requirements are read as FDA's requirements for U.S. market devices.
- Part 820 adds provisions beyond the ISO text. These include FDA-specific requirements on records (21 CFR 820.35) and on device labeling and packaging controls (21 CFR 820.45). Read the current regulation for exact wording.
- Several FDA requirements sit outside Part 820 and attach to the ISO clauses above: medical device reporting under 21 CFR Part 803 ties to 8.2.3, reports of corrections and removals under 21 CFR Part 806 tie to 8.3.3, and unique device identification under 21 CFR Part 830 and Part 801 ties to labeling and traceability under 7.5.1 and 7.5.9.
An ISO 13485 certificate is not an FDA clearance, and FDA does not require certification to the standard. It does inspect against Part 820, which now points to the standard's text. If you are planning a premarket submission, see the FDA 510(k) overview and the regulatory submissions page.
A Practical Sequence for Building the QMS
I would not write procedures in clause order. The order below follows dependencies:
- Define scope, regulatory role, and device types, then write the quality policy and objectives (clauses 1, 4.1.1, 5.3, 5.4).
- Set up document and record control (4.2.4, 4.2.5), since every later procedure relies on them.
- Build risk management and design control procedures (7.1, 7.3) before the first design review.
- Write purchasing, production, identification, and traceability procedures (7.4, 7.5).
- Put complaint handling, nonconformity control, and CAPA in place (8.2 to 8.5) before first commercial shipment.
- Run a full internal audit (8.2.4) and a management review (5.6) before the certification body arrives.
Pre-Audit Evidence Pull
Rather than repeat the clause list, use these as sampling trails. Each one asks you to follow a single thread through several clauses, which is how auditors tend to work.
- One complaint, from receipt through investigation, regulatory decision, and CAPA (8.2.2, 8.2.3, 8.5.2).
- One finished lot, from supplier approval through device history record and shipment (7.4.1, 7.5.1, 7.5.9).
- One design change, through impact assessment, verification, validation, and updated device file (7.3.9, 4.2.3).
- One piece of software used in the QMS, with its validation record (4.1.6, 7.5.6, 7.6).
- Your two most recent management reviews, checked against the 5.6.2 input list.
If you want a second set of eyes on a gap analysis or your design controls, Certify Consulting works with device manufacturers on exactly this.
Related Reading
Last updated: 2026-10-28
Frequently Asked Questions
How many clauses does ISO 13485:2016 have?
Eight. Clauses 1 to 3 cover scope, normative references, and terms. Clauses 4 to 8 contain the auditable requirements: quality management system, management responsibility, resource management, product realization, and measurement, analysis and improvement.
Can a manufacturer leave out parts of ISO 13485?
Clause 1 allows two routes. Design and development controls can be excluded where regulatory requirements permit it. Requirements in clauses 6, 7, or 8 that do not apply because of the organization's activities or the nature of the device need not be included. Clauses 4 and 5 cannot be set aside, and 4.2.2 requires the quality manual to justify any exclusion or non-application.
How long must records be kept under ISO 13485?
Clause 4.2.5 requires records to be kept for at least the lifetime of the device as defined by the organization, or as regulations specify, and not less than two years from the date the organization releases the product.
Does the FDA require ISO 13485 certification?
No. The QMSR amended 21 CFR Part 820 to incorporate ISO 13485:2016 by reference, effective February 2, 2026 (final rule at 89 FR 7496, docket FDA-2021-N-1303). FDA inspects against Part 820, which includes some FDA-specific additions, and it does not require a certificate.
Which clause covers corrective and preventive action?
Clause 8.5 covers improvement. Corrective action is 8.5.2 and preventive action is 8.5.3, and each requires a documented procedure, records, and a review of the effectiveness of the action taken.
Jared Clark
Principal Consultant, Certify Consulting
Jared Clark is the founder of Certify Consulting, helping organizations achieve and maintain compliance with international standards and regulatory requirements.