Medical Device Regulatory and Quality System Requirements
The ISO 13485:2016 skeleton
Clause 4 QMS (documentation, medical device file), 5 management responsibility (policy, objectives, management review), 6 resource management, 7 product realization (7.1 planning, 7.2 customer-related processes, 7.3 design and development, 7.4 purchasing, 7.5 production and service provision, 7.6 monitoring and measuring equipment), 8 measurement, analysis and improvement (8.2.1 feedback, 8.2.2 complaints, 8.2.3 reporting to authorities, 8.2.4 internal audit, 8.2.6 nonconforming product, 8.5.2 corrective action, 8.5.3 preventive action).
Know the ISO 13485-only features: a medical device file for each device or family, a documented advisory-notice procedure, explicit regulatory reporting obligations, validation of QMS software, and the retained preventive action clause that ISO 9001:2015 removed.
Regional overlay
- United States: 21 CFR 820 (820.30 design controls, 820.70 production, 820.75 process validation, 820.100 CAPA, 820.198 complaints), plus 803 (MDR), 806 (corrections and removals), and 830 (UDI). The QMSR final rule incorporates ISO 13485:2016 by reference, effective February 2026.
- European Union: MDR 2017/745 - Annex IX QMS, Annex II/III technical documentation, clinical evaluation, PMS/PMCF, PRRC, UDI and EUDAMED, with notified-body involvement scaled by device class.
- Elsewhere: MDSAP, Health Canada SOR/98-282, Japan PMD Act, China NMPA, UKCA.
Traps
ISO 13485 is a QMS standard, not a product-safety or risk-management standard. Certification is voluntary in most jurisdictions but is being folded into US law via the QMSR. Questions written around the MDD are out of date - modern items assume MDR.
Rule of thumb
For every clause, ask three questions: what is the documented requirement, what record proves it happened, and which regulation makes it mandatory in this market?