ISO 13485: a device quality system built around the product
Since 2 Feb 2026, FDA's device quality rule points straight at ISO 13485. One quality system can now serve both the US and most other markets.
In Short
- The QMSR incorporates ISO 13485:2016, with some extra US requirements.
- Keep device information organised per device type or family.
- People decide complaint reportability and record why.
The Medical Device Production Guide
Built to revision. Inspected. On record.
- What the QMSR changed in February 2026
- Supplier to finished build
- Inspect, review, correct
- Labels, UDI and traceability
Plus Evidence map and four worksheets.
Get the medical device guideWe ask for your name and email so we can handle this request. The full guide then opens on this site, ready to translate, print or save. Privacy policy. Practical orientation, not legal advice; your quality unit decides which rules apply.
UltimateFree guide
The Medical Device Production Guide
Built to revision. Inspected. On record.
ISO 13485:2016 is the international standard for medical device quality management systems. On its own it is a voluntary standard, but regulators use it: since 2 Feb 2026 the FDA Quality Management System Regulation (21 CFR Part 820) incorporates ISO 13485:2016 by reference, with some additional US requirements, and EU and other notified bodies audit against it. This guide covers the parts quality leads ask about most. The standard text is sold by ISO and was not reproduced here; this guide summarises the main topic areas without quoting clauses, and the QMSR points were checked against the eCFR on 2 Oct 2026.
How the standard is organised
The standard is organised around the quality management system, management responsibility, resources, product realisation, and measurement, analysis and improvement. It is a stand-alone device standard rather than a relabelled ISO 9001, with more weight on regulatory requirements, documented procedures, risk-based decisions and records, so a 9001 system needs real gap work.
ISO 13485:2016: areas auditors review
| Area | Covers | Evidence auditors often ask for |
|---|---|---|
| Quality system | QMS and documentation | Quality manual, procedures, medical device file |
| Management | Management responsibility | Quality policy, objectives, management review |
| Resources | People and infrastructure | Training and competence records, infrastructure, work environment |
| Realisation | Design, purchasing, production | Design file, purchasing controls, production and traceability records |
| Improvement | Measurement and improvement | Complaints, internal audit, CAPA, data analysis |
- Quality system
- Covers
- QMS and documentation
- Evidence auditors often ask for
- Quality manual, procedures, medical device file
- Management
- Covers
- Management responsibility
- Evidence auditors often ask for
- Quality policy, objectives, management review
- Resources
- Covers
- People and infrastructure
- Evidence auditors often ask for
- Training and competence records, infrastructure, work environment
- Realisation
- Covers
- Design, purchasing, production
- Evidence auditors often ask for
- Design file, purchasing controls, production and traceability records
- Improvement
- Covers
- Measurement and improvement
- Evidence auditors often ask for
- Complaints, internal audit, CAPA, data analysis
Documents and the medical device file
Expect to keep a quality manual, documented procedures, controlled documents and records, and an organised file of device information for each device type or family, such as the description, intended use, labeling, specifications and manufacturing procedures. Record retention periods are set by the standard and by each market's regulations; check your licensed copy and local rules.
Design and Development
Design and development covers planning, inputs, outputs, review, verification, validation, transfer to production, changes and the design file. The point of design control is traceability: every requirement has evidence that it was met, and every change is assessed for its effect on what was already verified.
More on design and Development
Risk management under ISO 14971 runs alongside design work rather than after it.
Production Records and Traceability
Production control covers process control, cleanliness, servicing, validation of processes whose output cannot be fully verified, identification and traceability. Expect each batch or lot to have a record that shows what was made and what was approved for distribution.
More on production Records and Traceability
In the US, Part 820 adds specific points; check your licensed copy for any extra requirements for implantable devices.
Feedback, Complaints and CAPA
The standard covers feedback, complaint handling, reporting to regulators and corrective and preventive action. Complaints must be assessed for whether they need regulatory reporting.
Worked Example: One Complaint
- Day 0Complaint C-208: infusion set connector cracked during use; no injury reportedCustomer service
- Day 1Reportability assessed against the MDR rule; decision and reason recordedRegulatory lead
- Day 4Device history records for lot L-5512 reviewed; moulding parameter drift foundQA
- Day 6CAPA opened; risk file reviewed for the cracking hazardQA, R&D
- Day 45Effectiveness check against the measure set on Day 6; CAPA closed by QA managerQA manager
More on feedback, Complaints and CAPA
In the US that decision follows the Medical Device Reporting rule (21 CFR Part 803); in the EU it follows the Medical Device Regulation's vigilance requirements. People make the reportability decision and record why.
Questions
Does the FDA QMSR replace ISO 13485 certification?
No. The QMSR, effective 2 Feb 2026, incorporates ISO 13485:2016 by reference into 21 CFR Part 820 with additional US requirements. FDA does not issue or require ISO certificates; it inspects against Part 820. Certification by an accredited body is a separate, voluntary step that many markets expect.
Is ISO 13485 the same as ISO 9001 for devices?
No. ISO 13485 is a stand-alone standard with more emphasis on regulatory requirements, documented procedures, risk and records. A company certified to ISO 9001 still needs gap work to meet it.
Do we need ISO 14971 as well?
ISO 13485 requires a documented risk management process for product realisation. ISO 14971 is the standard most regulators recognise for medical device risk management, so most manufacturers apply both.
How long must device records be kept?
ISO 13485 sets a minimum retention period linked to device lifetime, and each market's regulations can require longer. This guide did not open the licensed standard, so check your copy and the rules in every market you sell into.
Practical orientation, not legal advice. Rules differ by jurisdiction; your quality and compliance team decides what applies.
Keep reading
21 CFR 820 to ISO 13485 Crosswalk: Re-citing Procedures Under the QMSR
Cosmetic Microbiological Quality (ISO 17516) Readiness Guide
Cosmetic Stability and Preservative Efficacy (ISO 11930)
ISO 14971:2019 Medical Device Risk Management Guide
ISO 17034 Evidence Readiness for RM Producers
ISO 22000:2018 Food Safety Management Readiness Guide