ISO 13485 LI cheat sheet

ISO 13485 is a standalone QMS standard for organizations in the medical device lifecycle; it is built on the ISO 9001 process-model structure but is not a subset of ISO 9001, and ISO 9001 certification does not confer ISO 13485 conformity.

The standard's core intent is that the organization consistently meets customer and applicable regulatory requirements; 'applicable regulatory requirements' means the national/regional laws where the device is marketed, which take precedence over the standard where they conflict.

ISO 13485 is written on the process approach: processes are determined, their sequence and interaction defined, criteria and methods established, resources and information supplied, and processes monitored, measured and improved.

Risk is a thread, not a single clause: risk-based approach applies to product realization (7.1) and to the QMS processes themselves (4.1), and risk management outputs feed design, purchasing, production and CAPA.

The standard does not prescribe a specific risk management method; ISO 14971 is the recognized companion framework for medical device risk management, and the QMS must show risk management records are maintained.

Documented information replaces the 2003 terms 'documents' and 'records': a document states requirements or arrangements (can be revised), a record provides evidence of results achieved (must not be altered; corrections must remain legible and traceable).

Validation vs verification: validation confirms requirements for a specific intended use are fulfilled (objective evidence that the process/product consistently produces the intended result); verification confirms specified requirements have been met.

Conformity is not the same as compliance: conformity means fulfillment of a requirement (of the standard, the QMS, or the product specification); regulatory compliance is fulfillment of legal requirements, which is a separate obligation the QMS must control.

The MDQMS must cover all roles affecting product quality, including outsourced processes; outsourcing never transfers the responsibility for conformity to the supplier.

Clause map: 4 QMS general requirements, 5 management responsibility, 6 resource management, 7 product realization, 8 measurement/analysis/improvement - mirroring the ISO 9001 process model with device-specific additions.

Clause 4.2.1 requires a quality manual (or equivalent documented information) that states scope, justifies any exclusion or non-application, describes processes and their interaction, and outlines the document structure.

Exclusions are only allowed for clause 6.4.1 (contamination control) and clause 7.5.5 (sterile barrier systems) when the corresponding requirements are not applicable due to the activities undertaken; exclusions must be recorded and justified.

Clause 4.2.5 requires documented procedures for control of documents and for control of records - these are the two mandatory record/document control procedures; the standard also mandates procedures for CAPA, internal audit, nonconforming product and risk management records.

Clause 5.6 management review inputs include feedback, complaint handling, reporting to regulatory authorities, audits, process monitoring, corrective/preventive action, follow-up actions, changes, and new or revised regulatory requirements.

Clause 6.4.2 requires validation of computer software used in the QMS, and clause 7.5.6 requires validation of software used in production and service provision - the validation approach must be proportionate to risk.

Clause 7.5.2 requires identification of product by suitable means throughout realization and identification of its status with respect to monitoring and measurement requirements; traceability is required for implantable devices and where regulatory requirements apply.

Clause 7.5.9 requires a documented procedure for traceability, including the records needed to trace the device to its batch/serial and to its distribution, and clause 7.5.11 requires preservation of product including identification, handling, packaging, storage and protection.

Clause 8.2.1 requires feedback as an input to the QMS, and the feedback process must include a method for early warning of quality problems and for input into the CAPA process.

Scope definition comes first: identify the device families, the lifecycle activities performed (design, manufacture, sterilization, distribution, servicing) and the regulatory jurisdictions, because scope drives which clauses are applicable and which are excluded.

Gap analysis compares current documented information, processes and records against each ISO 13485 clause; each gap is rated for conformity status and risk, and becomes an input to the implementation plan.

A typical implementation sequence is: scope and gap analysis → management commitment and QMS planning → document architecture (manual, procedures, work instructions, forms/records) → process rollout → internal audit → management review → certification audit.

The document architecture should be tiered (quality manual → procedures → work instructions/specifications → records); each document needs an owner, a review cycle and a defined link to the clause it satisfies.

The implementation plan needs resources, responsibilities, milestones and a realistic timeline; a common failure is treating the QMS as a documentation project rather than a change to how processes are performed.

Regulatory requirements must be captured in the planning phase: applicable regulations (e.g., EU MDR/IVDR, US 21 CFR 820, national device rules) are inputs to the QMS and must be reflected in the manual, procedures and product files.

Personnel competence planning (clause 6.2) must cover the roles that affect product quality, including training on the QMS itself, and must define how competence is evaluated and recorded.

Risk management planning must be aligned with the QMS: the risk management file is a QMS record, and risk management activities must be planned for design, purchasing, production and post-market phases.

Planning must include the internal audit programme (clause 8.2.2) and management review schedule (clause 5.6) so that the organization can demonstrate the QMS is operating before the certification audit.

Management responsibility (clause 5): top management must establish the quality policy and objectives, ensure customer and regulatory requirements are met, appoint a management representative, and conduct management reviews at planned intervals.

Clause 5.5.2 requires a management representative with defined authority to ensure processes are established, maintained and improved, to report on QMS performance, and to promote awareness of regulatory and customer requirements.

Clause 6.2 requires competence: education, training, skills and experience must be determined for personnel affecting product quality, and records of competence must be maintained.

Clause 7.1 requires risk management throughout product realization; clause 7.3 requires design controls with design inputs, outputs, review, verification, validation, transfer, changes and a design history file.

Clause 7.4 requires supplier control: evaluation and selection based on the supplier's ability to meet requirements, defined purchasing information, verification of purchased product, and monitoring of supplier performance.

Clause 7.5.1 requires controlled production conditions including documented procedures, qualified equipment, monitoring/measuring devices, defined operations, and defined release/delivery/post-delivery activities.

Clause 7.5.6 requires validation of processes where output cannot be verified by subsequent monitoring or measurement (e.g., sterilization, welding, sealing), including revalidation criteria.

Clause 7.6 requires control of monitoring and measuring equipment: calibration or verification at specified intervals, identification of status, safeguarding from damage, and records of calibration and verification.

Clause 7.2 requires customer-related processes: review of product requirements before commitment, communication with customers, and handling of customer complaints and advisory notices.

Clause 8.1 requires monitoring, measurement, analysis and improvement processes, including determination of applicable methods (including statistical techniques) and the extent of their use.

Clause 8.2.1 feedback must be gathered from production and post-production activities and used as input to risk management and CAPA; it must provide early warning of quality problems.

Clause 8.2.2 internal audits must be planned at intervals, consider the status and importance of processes and areas, be performed by independent auditors, and records must be maintained.

Clause 8.2.3 requires a documented procedure for monitoring and measurement of product at appropriate stages, with evidence of conformity and identification of the person authorizing release.

Clause 8.2.4 requires handling of complaints, including investigation, reporting to regulatory authorities where required, and records; complaint handling is a regulatory obligation, not only a customer-service activity.

Clause 8.3 requires control of nonconforming product: identification, segregation, evaluation, disposition (including concession), and notification to regulatory authorities where required; records of the disposition must be kept.

Clause 8.4 requires analysis of data from feedback, conformity to product requirements, process and product characteristics, and suppliers; results feed improvement and CAPA.

Clause 5.6 management review must be performed at planned intervals and must evaluate QMS suitability, adequacy and effectiveness, with inputs and outputs defined by the standard.

Clause 8.5.2/8.5.3 require documented procedures for corrective and preventive action, including investigating causes, evaluating the need for action, determining and implementing action, and reviewing effectiveness.

Clause 8.5.1 requires the organization to identify and implement any changes necessary to ensure and maintain the continued suitability, adequacy and effectiveness of the QMS, and to improve it.

Improvement inputs include feedback, complaints, CAPA, internal and external audit findings, management review outputs, process and product monitoring data, and changes in regulatory requirements.

The CAPA cycle is: identify the issue → contain → investigate root cause → determine action → implement → verify effectiveness → close; effectiveness verification is the step most often missing.

Root-cause analysis methods (5 Whys, fishbone, fault tree) are tools, not requirements; the requirement is that the cause is identified and the action addresses it, with records.

Change control must assess the impact of changes on the device, the QMS and regulatory status; changes to the device or its intended use may require regulatory notification or new submissions.

Continual improvement is demonstrated by trends in metrics (complaint rates, CAPA recurrence, audit findings, process yield), not by the existence of a procedure.

Post-market surveillance data (complaints, field actions, service reports) must feed back into risk management and design changes, closing the loop between production and design.

Preventive action uses data analysis to eliminate potential nonconformities before they occur; the standard requires the procedure even where no preventive action is currently open.

Improvement must be proportionate to risk: changes to high-risk processes or devices need more rigorous verification, validation and regulatory assessment.

Certification is performed by an accredited certification body; the audit is a sampling exercise against ISO 13485 and the organization's own documented QMS, not against national regulatory approval.

Stage 1 audit reviews readiness: documentation, scope, internal audit and management review evidence, and identification of areas of concern; Stage 2 verifies implementation and effectiveness.

Before Stage 2, the organization must have completed at least one full internal audit cycle covering all clauses and one management review, with records available.

The certification audit samples records: design history files, risk management files, supplier evaluations, calibration records, complaint files, CAPA records, training records and internal audit reports are typical targets.

Nonconformities are graded (major/minor), and a major nonconformity generally requires corrective action and verification before certification is granted; the certification body decides the follow-up method.

Auditors look for evidence of implementation, not just documentation: a procedure with no records of use is a finding, and records that do not match the procedure are a finding.

The audit scope statement on the certificate must match the actual activities; excluding a process that is performed is a nonconformity and can invalidate the certificate.

Preparation includes a documentation review for consistency (manual vs procedures vs records), a mock audit, and briefing of process owners on how to present objective evidence.

Surveillance audits occur at least annually, and recertification audits occur before the certificate expires; the QMS must remain in operation between audits, not only at audit time.