ISO 13485
One quality system for FDA and the world
ISO 13485:2016 is the international quality management standard for medical devices. Since Feb 2, 2026, FDA’s QMSR incorporates it by reference into 21 CFR Part 820. One well-built ISO 13485 system can now serve FDA, MDSAP, Health Canada and EU MDR. JJCC Group builds and certifies it.
The Standard, Defined.
ISO 13485:2016 specifies requirements for a Quality Management System where an organization needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements. It is the de facto global passport for medical device manufacturers — recognized by Health Canada, the European Union, Japan PMDA, Australia TGA, Brazil ANVISA, and now, materially, by the U.S. FDA.
While ISO 13485 is based on the ISO 9001 process model, it is not a sector-specific variant — it is a regulatory-purpose standard. Where ISO 9001 emphasizes customer satisfaction and continual improvement as ends in themselves, ISO 13485 emphasizes the maintenance of an effective QMS and the safety and performance of medical devices. The two standards diverged deliberately in their 2016/2015 revisions and should not be conflated.
The standard applies across the full medical device lifecycle: design and development, production, storage and distribution, installation, servicing, and final decommissioning and disposal — as well as to suppliers and external parties that provide product or quality-affecting services to the manufacturer.
The QMSR Final Rule is now in force
On January 31, 2024, the FDA published the final rule replacing 21 CFR Part 820 with the new Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference. As of February 2, 2026, U.S. medical device manufacturers must comply with QMSR — making ISO 13485 conformance the operational foundation for FDA compliance, not a parallel exercise.
The Foundational Clauses of ISO 13485:2016
CLAUSE 4 · QUALITY MANAGEMENT SYSTEM
Quality management system, documentation, Medical Device File, records
Establish, document, implement, and maintain a QMS. Define processes, sequence, and interactions. Includes the mandatory Medical Device File (4.2.3) — a dossier per device or device family.
CLAUSE 5 · MANAGEMENT RESPONSIBILITY
Management responsibility and management review
Top management establishes the Quality Policy, ensures regulatory requirements are met, designates a Management Representative, and conducts formal Management Review at planned intervals.
CLAUSE 6 · RESOURCE MANAGEMENT
Resources: people, infrastructure, work environment
Competence, training, and awareness — with documented evaluation of training effectiveness. Controlled work environment, contamination control, and infrastructure suitable to product conformity.
CLAUSE 7 · PRODUCT REALIZATION
Product realization: planning, design, purchasing, production, servicing
The longest clause: design and development controls, purchasing controls, production validation, identification and traceability, customer property, and servicing. The heart of medical device manufacturing.
CLAUSE 8 · MEASUREMENT, ANALYSIS & IMPROVEMENT
Measurement, analysis and improvement: feedback, complaints, audits, CAPA
Customer feedback, complaint handling, reporting to regulatory authorities, internal audit, monitoring and measurement of processes and product, control of nonconforming product, CAPA, and advisory notices.
CLAUSE 4.1.6
Validation of Computer Software [SOFTWARE]
Software used in the QMS — including ERP, eQMS, CAPA tools, design controls software, and production equipment software — must be validated for its intended use. Documented validation, with risk-proportionate rigor.
CLAUSE 7.1 + ISO 14971
Risk Management Throughout the Lifecycle [ISO 14971]
Risk management per ISO 14971 is required from concept through post-market. Risk-benefit analysis, residual risk evaluation, and risk control measures must be documented in the device's Risk Management File.
CLAUSE 7.3
Design & Development Controls [DHF / DMR]
Planning, inputs, outputs, review, verification, validation, transfer, and change control. Design History File and Device Master Record requirements — directly mirrored in 21 CFR 820.30 and now QMSR.
From QSR to QMSR.
For three decades, the FDA’s Quality System Regulation (QSR) under 21 CFR Part 820 governed U.S. medical device manufacturing — overlapping with, but distinct from, ISO 13485. The QMSR Final Rule eliminates that duplication. The comparison below shows what changes, what doesn’t, and what is added on top of ISO 13485 by U.S.-specific regulation.
001
FDA definitions:
that apply where they differ from ISO terms.
[ DEFAULT · SAHCODHA ]
002
Section 820.35 record requirements:
including complaint, servicing and UDI records.
[ RISK-BASED ]
003
Section 820.45 labeling and packaging controls:
including label inspection before release.
[ LOWER-RISK ]
004
Links to other FDA rules:
MDR (Part 803), corrections and removals (Part 806), UDI (Part 830).
[ DOCUMENTED RATIONALE ]
The evidence FDA actually asks to see.
FSVP inspections are documentation-heavy. FDA investigators rarely ask theoretical questions — they ask for the record, by name, for a specific food and supplier, with the rationale behind every decision. The list below is what a program must produce on demand.
21 CFR Part 830 · What It Actually Requires
21 CFR Part 830 mandates that most medical devices distributed in the U.S. bear a Unique Device Identifier (UDI) on labels and packages, and in human- and machine-readable form. The UDI is composed of a Device Identifier (DI) — static, identifying the device version and labeler — and a Production Identifier (PI) — dynamic, including lot, serial, expiration, and manufacturing date as applicable.
Manufacturers must also submit and maintain device information in the Global Unique Device Identification Database (GUDID). UDI compliance is a labeling and data-management obligation that intersects with — but is not absorbed by — ISO 13485 or QMSR. It must be governed by its own controlled procedures, integrated with design controls (DHF), production records (DHR), and complaint/MDR processes.
UDI ANATOMY · THE TWO COMPONENTS
| Device Identifier Element | Description |
|---|---|
| Device Identifier (DI) | Mandatory, static portion. Identifies the labeler and the specific version or model. Issued under an FDA-accredited issuing agency (GS1, HIBCC, ICCBBA). |
| Production Identifier (PI) | Conditional, dynamic portion. Includes one or more of: lot/batch number, serial number, expiration date, manufacturing date, distinct identification code for HCT/Ps. |
| GUDID Submission | Each DI must be submitted to FDA’s Global UDI Database with 60+ attributes per device record — kept current throughout the commercial life of the device. |
| Direct Mark (DM) | Certain reusable devices require the UDI to be marked on the device itself, not only the packaging. Implementation governed by Class and intended use. |
The Integrated U.S. Medical Device Compliance Stack
One QMS. Three regulations. Zero duplication.
| Foundation Layer | FDA Regulatory Layer | Identification & Reporting Layer |
|---|---|---|
|
ISO 13485:2016 Document control, training, design controls, production controls, CAPA, internal audit, management review. The operating system everything else runs on. |
QMSR 21 CFR 820 Incorporates ISO 13485 by reference. Adds: DMR/DHR/DHF terminology, complaint files, MDR cross-references, labeling controls under 21 CFR 801. |
UDI 21 CFR 830 UDI assignment, GUDID submission, label marking. Linked to design outputs, production records, and complaint files via DI/PI traceability. |
The integration test. A mature, integrated medical device QMS will allow an auditor or investigator to trace any single complaint or field action backward through the MDR record, to the DHR, to the UDI/lot, to the DMR, to the DHF, to the original risk analysis — without leaving the same controlled system. If your current setup requires hopping between disconnected files, spreadsheets, or shared drives to do that, integration is your priority project for 2026.
Who Needs ISO 13485.
Unlike ISO 9001, the scope of ISO 13485 is narrowly defined: organizations involved in one or more stages of the medical device lifecycle, or providing associated services. If you are inside this universe, certification is not a competitive differentiator — it is, in most markets, the price of admission.
| # | Stakeholder / Group | Description |
|---|---|---|
| 01 | Device Manufacturers (OEM) | Class I, II, and III medical device OEMs — from surgical instruments to implantables. Required for U.S. (QMSR), EU (MDR), Canada (MDSAP), Japan, Brazil, Australia. |
| 02 | In-Vitro Diagnostics (IVD) | Laboratory test kits, reagents, instruments, software. Governed by EU IVDR, FDA QMSR, and ISO 13485 — typically combined with ISO 15189 for service labs. |
| 03 | Software as a Medical Device (SaMD) | Standalone medical software, AI/ML diagnostic algorithms, mobile health platforms. ISO 13485 paired with IEC 62304 (software lifecycle) and IEC 82304-1. |
| 04 | Contract Manufacturers (CDMO / CMO) | CDMOs and CMOs producing devices, components, or sterile assemblies under another firm’s brand. ISO 13485 is non-negotiable for customer audits and tender qualification. |
| 05 | Sterile Packaging & Sterilization | Sterile barrier systems, tray sealers, EtO and gamma sterilization providers. Combine ISO 13485 with ISO 11135, ISO 11137, ISO 11607. |
| 06 | Active Implantable Devices | Pacemakers, neurostimulators, drug-delivery implants. Highest regulatory rigor — ISO 13485 plus ISO 14708, IEC 60601 series, and rigorous design controls. |
| 07 | Critical Components Suppliers | Suppliers of polymer parts, electronic assemblies, machined components, and packaging that affect device safety. OEMs increasingly require supplier certification, not just qualification. |
| 08 | Distribution & Servicing | Authorized representatives, importers, distributors, and field service organizations. Required under EU MDR Article 13–14 and explicitly in scope of ISO 13485. |
The Certification Path.
Most medical device organizations achieve ISO 13485 certification within 8 to 18 months. The variable is the maturity of design controls, the complexity of the device portfolio, and whether risk management per ISO 14971 is already embedded. Below is the path JJCC Group walks with every medical device client.
Gap analysis
against ISO 13485 and the QMSR.
Plan and scope
the QMS and certification.
Build documentation:
quality manual, procedures, Medical Device File, risk management file.
Implement and train
generating records.
Internal Audit, Management Review & CAPA
Run a full internal audit cycle covering every clause and every applicable CFR section. Conduct the first formal Management Review. Open and close CAPAs to demonstrate the system functions as designed.
Certification audit:
Stage 1 (documents) and Stage 2 (implementation) by an accredited certification body.
Documents & Records.
ISO 13485 is significantly more prescriptive than ISO 9001 about documented information. The standard names specific documents — the Medical Device File, the Risk Management File, the Design and Development File. The list below covers the ISO 13485 core, the QMSR-specific overlay, and the UDI/MDR records needed for the integrated U.S. compliance stack.
Required by ISO 13485:2016 · Core Medical Device QMS Documentation
- Quality Manual — Clause 4.2.2 — explicit ISO 13485 requirement (unlike ISO 9001:2015).
- Medical Device File — Clause 4.2.3 — per device or family: description, specifications, manufacturing, packaging, labeling, installation, servicing.
- Quality Policy & Objectives — Clauses 5.3, 5.4.1 — signed by top management.
- Document & Records Control Procedures — Clauses 4.2.4, 4.2.5.
- Management Review Records — Clause 5.6 — agenda, inputs, decisions, action items, attendance.
- Competence, Training & Awareness Records — Clause 6.2 — with effectiveness evaluation.
- Infrastructure & Work Environment Records — Clauses 6.3, 6.4 — including contamination control.
- Risk Management File (per ISO 14971) — Clause 7.1 — analysis, control measures, residual risk, benefit-risk.
- Design & Development File (DHF) — Clause 7.3 — plans, inputs, outputs, reviews, V&V, transfer, changes.
- Purchasing Information & Supplier Evaluation — Clause 7.4 — approved supplier list with justification.
- Production & Service Provision Records — Clause 7.5 — including cleanliness, sterility, traceability.
- Process Validation Records (IQ/OQ/PQ) — Clause 7.5.6 — where output cannot be fully verified.
- Sterilization Validation Records — Clause 7.5.7 — per ISO 11135, 11137, or applicable standard.
- Software Validation Records — Clause 4.1.6 — QMS software, production software, monitoring software.
- Calibration & Measurement Equipment Records — Clause 7.6.
- Feedback, Complaint Handling & Internal Audit Records — Clauses 8.2.1, 8.2.2, 8.2.4.
- Nonconforming Product & CAPA Records — Clauses 8.3, 8.5.2, 8.5.3.
- Advisory Notices & Field Action Records — Clause 8.2.3 — recalls, corrections, customer notifications.
Additional · U.S. Regulatory Overlay · QMSR, UDI & MDR Records
- Device Master Record (DMR) — QMSR §820.181 — device specifications, production, QA, packaging, labeling, installation/servicing procedures. Often satisfied by the ISO 13485 Medical Device File.
- Device History Record (DHR) — QMSR §820.184 — proof each unit was manufactured per the DMR, including dates, quantities, acceptance records, UDI used.
- Design History File (DHF) — QMSR §820.30(j) — documentation that demonstrates the design was developed per the approved design plan.
- Quality System Record (QSR) — QMSR §820.186 — general procedures not specific to a particular device type.
- Complaint Files — QMSR §820.198 — formally designated unit, FDA-defined content per complaint, MDR evaluation documentation.
- Medical Device Reports (MDR) — 21 CFR Part 803 — reportable death, serious injury, and malfunction reports submitted to FDA.
- Corrections & Removals Records — 21 CFR Part 806 — written records of recalls and corrections, reportable to FDA.
- UDI Assignment & GUDID Records — 21 CFR Part 830 — DI/PI assignment, labeling files, GUDID submission confirmations.
- Labeling Records & Specifications — 21 CFR Part 801 — IFU, label artwork, version control, language localization.
- Establishment Registration & Device Listing — 21 CFR Part 807 — annual FDA registration, device listing per FEI.
- 510(k), PMA, De Novo Submissions — Per device classification — kept on file with all supporting V&V data.
- EU Technical Documentation — MDR Annex II / III — where applicable, parallel dossier with PMS, PMCF, PSUR.
- Person Responsible for Regulatory Compliance (PRRC) Records — Required under MDR Article 15 for EU placement.
- Post-Market Surveillance Plan & Reports — ISO 13485 Clause 8.2.1 plus MDR Articles 83–86.
- Servicing Reports — QMSR §820.200 — analyzed for trends, MDR-evaluated, fed back into CAPA.
- Cybersecurity Documentation — Per FDA premarket cybersecurity guidance and IEC 81001-5-1 — for connected and software-driven devices.
One dossier, three audiences. The most efficient medical device organizations build a single, controlled set of documents whose structure satisfies ISO 13485 auditors, FDA investigators, and EU Notified Body assessors simultaneously. JJCC Group’s documentation architecture is purpose-built for this triple-audience reality — eliminating duplicate procedures, redundant records, and the “which version is current?” risk that consumes operating quality teams.
How JJCC Group Helps.
JJCC Group’s medical device practice is built around the integrated reality of modern device regulation: one QMS that simultaneously satisfies ISO 13485, FDA QMSR, EU MDR/IVDR, and the supporting U.S. regulations covering UDI, MDR, and field actions. Our services cover the full lifecycle from concept to post-market surveillance.
| Service | What We Do | Engagement |
|---|---|---|
| Regulatory Strategy & Pathway Mapping | Classification analysis, jurisdiction selection, submission pathway (510(k), De Novo, PMA, EU MDR), and a sequenced compliance roadmap that aligns engineering, quality, and commercial timelines. | Strategy • 3–6 Weeks |
| ISO 13485 & QMSR Gap Analysis | Comprehensive diagnostic against ISO 13485:2016 and the 2026 QMSR. Includes overlays for 21 CFR 830 UDI, 21 CFR 803 MDR, and EU MDR/IVDR Annex II/III. Delivered with a costed remediation plan. | Diagnostic • 4–6 Weeks |
| QMS Build & Medical Device File | End-to-end documentation development: Quality Manual, procedures, Medical Device Files, DMR/DHR/DHF structures, controlled forms, training matrices. Built for triple-audience audit defense. | Build • 12–24 Weeks |
| Risk Management per ISO 14971 | Establish the Risk Management File for each device. Hazard identification, FMEA, risk-benefit analysis, residual risk evaluation, and risk control verification — integrated with design controls and PMS. | Risk • Per Device |
| Design Controls & DHF Authoring | Design planning, input/output management, design reviews, V&V protocols and reports, design transfer, and the auditable DHF that demonstrates regulatory traceability from need to released device. | Engineering • Project Basis |
| Process & Software Validation | IQ/OQ/PQ for production processes, sterilization validation (ISO 11135/11137/11607), and computer software validation (CSV) for eQMS, ERP, MES, and embedded device software per IEC 62304. | Validation • 6–16 Weeks |
| UDI Implementation & GUDID Submission | Issuing-agency selection, DI/PI structure design, label artwork updates, direct-mark planning, and GUDID record creation and maintenance for the full product portfolio. | UDI • 8–12 Weeks |
| MDSAP & Multi-Jurisdiction Audit | Prepare for and host the single MDSAP audit covering U.S., Canada, Australia, Brazil, and Japan. Coordinate Auditing Organizations, manage CAPAs, and represent the organization on-site. | Audit • Per Cycle |
| Post-Market Surveillance & Vigilance | PMS plans, PMCF studies, PSURs (EU), MDR/MDR-EU complaint and adverse event reporting, recall and correction management, and trending feedback into design and CAPA. | PMS • Continuous |
The clock is ticking.
8 to 18 months from start to certificate, depending on your starting point and device class.
Testimonial
What our clients say about JJCC
Professional, knowledgeable team guided us through FDA registration and complete product listing accurately and efficiently.
Frequently Asked Questions About ISO 13485:2016
Have a question we haven't answered?
JJCC Group’s quality and regulatory consultants answer dozens of these every week. If your question isn’t here — or if you’d like to discuss your specific situation — we’d be glad to talk. No obligation, no script.
