Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    ISO 13485

    Also known as: ISO 13485:2016, EN ISO 13485, Medical device quality management standard

    Definition

    The ISO standard for quality management systems of organisations that design, produce, install or service medical devices, written for regulatory purposes. The current edition is ISO 13485:2016.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/iso-13485

    Scope: Certification is not a requirement of the standard. FDA incorporates the 2016 edition into 21 CFR Part 820 and adds requirements of its own, and the EU lists the EN version as a harmonised standard under the MDR.

    Example for your evaluation: Follow one customer complaint through its record, the investigation, any reporting decision, the corrective action and the changed document.

    Sources checked: . Examples are editorial illustrations.

    What ISO, FDA and the European Commission say about ISO 13485

    ISO 13485:2016, Medical devices, quality management systems, requirements for regulatory purposes, is the third edition, published in March 2016 and developed by ISO/TC 210. ISO's record says it was reviewed and confirmed in 2025, with the latest confirmation on 31 October 2025, and it replaced ISO 13485:2003. ISO says the standard is for organisations involved in the design, production, installation and servicing of medical devices and related services, and that certification bodies can also use it. Like other ISO management system standards, certification is not a requirement of it, ISO does not perform certification, and third-party certification can show regulators that its requirements are met. ISO says the 2016 edition places more weight on risk management and risk-based decisions and on regulatory requirements for organisations in the supply chain. The standard is paid, so this page does not quote its clauses. This is general information, not legal advice.

    In the United States, FDA says its Quality Management System Regulation (QMSR), effective on 2 February 2026, amends the device current good manufacturing practice requirements in 21 CFR Part 820 and incorporates ISO 13485:2016 by reference, with Clause 3 of ISO 9000:2015 for terms. It applies to finished device manufacturers who intend to distribute devices commercially, accessories included, and FDA says it now specifically requires risk management. The rule text names the third edition of 1 March 2016. Section 820.10 requires a documented quality management system that complies with the applicable ISO 13485 requirements and with the part's other requirements, and adds duties for unique device identification, traceability, complaint reporting and advisory notices. Section 820.35 lists what a complaint record must hold. Where an ISO 13485 clause conflicts with the Federal Food, Drug, and Cosmetic Act or its regulations, the Act and regulations control. FDA stopped using its Quality System Inspection Technique on 2 February 2026. None of the FDA pages opened mentions a certificate.

    FDA also says it may continue to accept audit reports from the Medical Device Single Audit Program as a substitute for routine inspections. The program lets a recognised auditing organisation conduct one regulatory audit that satisfies the relevant requirements of participating authorities: Australia, Brazil, Canada, Japan and the United States are members, and the European Union and the United Kingdom are official observers. FDA's page does not mention ISO 13485.

    In the EU, the Commission's page says Regulation (EU) 2017/745 applies from 26 May 2021 and lists harmonised standards in Commission Implementing Decision (EU) 2021/1182, amended ten times between January 2022 and June 2026. The summary list linked there, generated on 17 June 2026, includes EN ISO 13485:2016, with EN ISO 13485:2016/AC:2018 and /A11:2021 listed under it, with legal effect from 5 January 2022 under Decision 2022/6 and no end date shown. The Commission says the summary is for information and has no legal effect of its own. This page did not open the MDR text, because its EUR-Lex site returned an automated-access challenge, nor the IVDR list or UK rules, so it does not restate what they require of a manufacturer.

    Sources opened :

    What an ISO 13485 quality management record holds in software

    • The scope of the system and the medical device file, with the specifications that labelling, packaging and rework are checked against.
    • Design and development records where the rule applies them, such as for class II and III devices.
    • Risk management records linked to the device and its changes.
    • Complaint records: device name, date received, identifiers, complainant, the nature of the complaint, any correction or corrective action, and any reply.
    • Reporting decisions and advisory notices, with the date and the person who decided.
    • Unique device identification for each device or batch, and traceability records.
    • Servicing records and labelling inspection results.

    ISO 13485, ISO 9001, QMSR, MDR and certification

    ISO 13485 is a standard. A certificate is an audit result from a certification body, not from ISO. QMSR is US law, which incorporates the standard and adds duties, and the Act controls where they conflict. In the EU a harmonised-standard listing is a Commission reference, not a certificate. MDSAP is an audit program run by regulators. ISO 9001 is a separate, general standard.

    A hypothetical example: nine complaints on a handheld device

    Everything in this case is invented and describes no real company. A 25-person maker of a handheld device receives nine complaints in a quarter. Six concern a loose connector, two a damaged pack and one a user error, which is 6 plus 2 plus 1, or 9. Each complaint is recorded with the device name, date received, identifier, complainant, nature and any reply.

    The quality lead checks every complaint against the reporting criteria that section 820.10 refers to. One meets them and is reported, and the other eight do not. The six connector complaints lead to a corrective action: the cause is a supplier's revised part, the drawing and incoming inspection are changed, and a later check records no new case. A distributor asks for an ISO 13485 certificate. The owner treats that as a separate decision with a certification body, and the documented system is unchanged.

    Common misunderstandings about ISO 13485

    • ISO 13485 is not ISO 9001 with another number. ISO says it is tailored to regulatory and safety requirements, with more weight on risk management and process validation.
    • A certificate is not required by the standard. ISO says certification is not a requirement, and the FDA pages opened ask for a documented system.
    • ISO 13485 alone is not US compliance. Part 820 adds requirements, and the Federal Food, Drug, and Cosmetic Act controls where they conflict.
    • The QMSR did not remove other FDA rules. Section 820.10 points to the reporting, advisory notice, traceability and identification parts.
    • A harmonised-standard listing is not a certificate. The Commission says its summary generates no legal effects of its own.
    • Old inspection checklists may be out of date. FDA says it stopped using its Quality System Inspection Technique on 2 February 2026.

    How ISO 13485 relates to other glossary terms

    ISO 13485 is a quality management system standard for one sector, so it sits beside the general system terms and the records they rely on.

    • QMS: the system the standard sets requirements for, whatever its software.
    • ISO 9001: the general quality management standard, which ISO says differs in scope and emphasis.
    • CAPA: the cycle from cause to effectiveness check that complaints often start.
    • Non-conformance: the record raised when a product or process misses its requirement.
    • SOP: the written procedure behind complaint handling and labelling checks.

    Records and evidence that usually exist for ISO 13485

    • The documented system, with the medical device file and controlled procedures.
    • Complaint records with the investigation, any reporting decision and the reply.
    • Design and development records, where applicable.
    • Risk management records linked to each device.
    • Unique device identification and traceability records.
    • Labelling and packaging inspection results, signed and dated.
    • Internal audit and management review records, and any certification or MDSAP audit report.

    What a software tool needs to capture for ISO 13485

    • Complaint fields that match the record content the rule lists, with the reporting decision and its date.
    • Links from a complaint to its nonconformity, cause, corrective action and changed document.
    • Revision control that keeps superseded versions readable, with approver and effective date.
    • Unique device identification and batch fields tied to complaints, servicing and labelling checks.
    • A field for the standard or regulation each record answers, with its edition.
    • Risk records linked to the design change or complaint that prompted them.
    • Export of a record's full history for an auditor or inspector.

    Catalog profiles documenting QMS, nonconformance, CAPA or document-control records

    The list follows the QMS, nonconformance, CAPA or document-control rule used by the quality management software guide. It does not show that a product supports medical device complaint reporting, unique device identification or a given regulation, which should be tested with your own records.

    Same rule for every product: tagged “Quality Management”, with a sourced QMS, nonconformance, CAPA or document-control capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 33 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Is ISO 13485 mandatory?

    ISO says certification is not a requirement of the standard. A legal duty comes from regulation: FDA's QMSR incorporates ISO 13485:2016 by reference for finished device manufacturers, and the EU lists EN ISO 13485:2016 among harmonised standards under the MDR. Whether a regulator, customer or notified body asks for a certificate is for them to say.

    How is ISO 13485 different from ISO 9001?

    ISO says ISO 9001 applies across industries, while ISO 13485 is tailored to the regulatory and safety requirements of medical devices. It puts more emphasis on regulatory requirements, risk management and process validation. It is a separate standard, not an ISO 9001 certificate with a new number.

    Which edition of ISO 13485 applies?

    ISO 13485:2016, the third edition, is current: ISO's record shows it confirmed on 31 October 2025. FDA's rule at 21 CFR 820.7 incorporates that edition, dated 1 March 2016. Check the edition your regulator or customer names.

    More standards terms

    Related guides