ISO 13485 LI key terms

An instrument, apparatus, implement, machine, implant, reagent, or software intended by its manufacturer to be used for diagnosis, prevention, monitoring, treatment, or alleviation of disease or injury, whose intended action is not achieved primarily by pharmacological means.

The set of interrelated processes, responsibilities, resources, and documented arrangements an organization uses to direct and control quality, ensuring products consistently meet requirements and applicable regulatory demands.

A management principle in which activities are understood and managed as interrelated processes forming a system, so that inputs, outputs, and interactions are controlled to achieve intended results efficiently.

The principle of directing effort and control proportionate to risk, so that decisions about processes, suppliers, and verification activities are prioritized according to the likelihood and severity of harm.

Information that must be controlled and maintained by the organization, covering both documents that provide guidance and records that evidence results achieved; ISO 13485 uses this single term instead of separate document and record categories.

A document describing the organization's quality management system, including its scope, justified exclusions or non-applicability of clauses, the documented procedures or references to them, and a description of process interactions.

For each medical device or device family, the collection of documents that demonstrates conformity to ISO 13485 and applicable regulatory requirements, typically including description, labeling, specifications, procedures, and records.

The evidence set demonstrating that a device meets applicable regulatory and safety requirements, often including design outputs, risk management outputs, verification and validation results, and labeling, used to support regulatory submissions.

The documented statement of which activities, products, and sites the quality management system covers, including identification of any ISO 13485 requirements that are not applicable and the justification for that determination.

The determination of whether a given ISO 13485 clause applies to the organization's activities; if it does not apply because of the nature of the device or processes, a documented justification must be retained.

A structured comparison of current practices and documentation against the requirements of ISO 13485 and applicable regulations, producing a prioritized list of deficiencies to address during implementation planning.

A time-bound schedule defining the tasks, responsibilities, resources, milestones, and dependencies required to build or upgrade a quality management system so that it meets ISO 13485 requirements.

The laws, regulations, and guidance imposed by jurisdictions where the device is marketed, which the organization must identify and incorporate into its quality management system alongside ISO 13485 obligations.

Visible leadership support in which top management establishes quality policy and objectives, provides resources, communicates the importance of meeting requirements, and reviews system performance.

A short statement from top management expressing the organization's overall intentions and direction regarding quality, providing a framework for setting and reviewing measurable quality objectives.

A measurable target related to product, process, or system performance that is consistent with the quality policy, assigned to responsible functions, and tracked over time.

The demonstrated ability of personnel to apply knowledge and skills to perform assigned work, established through defined education, training, skills, and experience requirements and evaluated for effectiveness.

The controlled arrangement of design stages, required reviews, verification and validation activities, responsibilities, and interfaces, updated as the project evolves and documented for each device.

A planned, documented evaluation of design results against requirements at defined stages, conducted by representative functions to identify problems and propose necessary actions before proceeding.

Objective evidence that design outputs meet design input requirements, typically obtained through inspection, testing, or analysis performed before the device is released.

Objective evidence that the device, as produced, meets requirements for its specified intended use, usually obtained through clinical evaluation or simulated use testing on production-equivalent units.

The documented requirements for a device, including functional, performance, safety, regulatory, and user needs, which form the basis for design outputs and later verification activities.

The activity confirming that design outputs are correctly translated into production specifications, work instructions, and process controls so the device can be manufactured reproducibly.

A systematic process applied throughout the device lifecycle to identify hazards, estimate and evaluate associated risks, control them, and monitor the effectiveness of those controls.

Actions taken to reduce risk to an acceptable level, following a hierarchy from inherently safe design through protective measures in the device or process to information for safety.

The risk remaining after risk control measures have been applied; it must be evaluated against acceptability criteria and disclosed where required by labeling or regulation.

The process of assessing suppliers against defined criteria such as product quality, delivery performance, and quality system capability, determining the type and extent of controls applied to purchased product.

Material, components, or services obtained from external providers that affect product quality, requiring controls proportionate to risk and verification against specified requirements.

Objective evidence that a process consistently produces results meeting predetermined requirements, established through defined protocols, acceptance criteria, and monitoring before routine use.

A process whose output cannot be fully verified by subsequent inspection and testing, such as sterilization or welding, so its capability must be validated and periodically revalidated.

The documented evidence that a sterilization process achieves the required sterility assurance level for the specified device and packaging configuration, including routine monitoring and dose or cycle controls.

The ability to follow the history, application, or location of a device or batch through records, from raw material receipt to distribution, and to identify the route for recalls.

A system assigning a distinct identifier to each device model or batch, recorded so that the device can be traced through distribution and identified in post-market activities.

Information gathered from production, post-production, users, and complaints that is used as input to risk management and to evaluate whether the quality management system is effective.

The controlled process for receiving, recording, investigating, and responding to complaints, including determining whether the issue requires reporting to regulators or action under the vigilance system.

The ongoing collection and analysis of data about a device after release, used to confirm safety and performance, detect trends, and feed decisions on corrective action and risk reassessment.

The regulatory obligation to notify authorities within defined timelines when a device may have caused or contributed to death or serious injury, or when a malfunction could do so.

An independent, planned examination of processes and records against ISO 13485, regulatory requirements, and internal procedures, performed by personnel not responsible for the activity audited.

Action taken to eliminate the cause of a detected nonconformity so it does not recur, including investigation of root cause, determination of needed actions, and review of effectiveness.

A structured investigation method used to identify the underlying reason a nonconformity occurred, distinguishing the cause from its symptoms so that corrective action addresses the real problem.

A failure to meet a specified requirement, whether in product, process, or the quality management system, which must be recorded, evaluated, and controlled to prevent unintended use or delivery.

Documented authorization to accept a product that does not meet specified requirements, granted after evaluation of the deviation and its risk, often subject to regulatory notification.

A planned top-management evaluation of the quality management system's suitability, adequacy, and effectiveness, using defined inputs such as audit results and feedback, and producing decisions and actions.

The routine measurement of defined indicators, such as complaint rates, process yields, and audit findings, to evaluate whether processes and the quality management system achieve planned results.

The recurring activity of enhancing the quality management system and its processes by analyzing data, setting objectives, and implementing changes that increase effectiveness over time.

An independent, third-party assessment of the quality management system against ISO 13485, typically comprising a stage 1 readiness review and a stage 2 on-site evaluation of implementation.

The initial certification audit phase that reviews documentation, scope, readiness, and understanding of requirements to confirm the organization is prepared for the on-site stage 2 evaluation.

The on-site certification audit phase that gathers objective evidence of implementation and effectiveness across all applicable requirements, processes, and sites within the defined scope.

Verifiable data, records, statements of fact, or observations that demonstrate conformity to a requirement and can be examined by an auditor during an assessment.

The set of policies, procedures, standards, and regulatory requirements against which an audit is conducted, forming the reference for judging conformity and reporting findings.

The specific products, processes, and sites a certification body has assessed and will list on the certificate, which must match the organization's declared quality management system scope.

An independent organization designated by a regulatory authority to assess conformity of medical devices and quality management systems, issuing certificates required for market access in some jurisdictions.

A periodic post-certification audit, typically annual, that verifies continued conformity and effective maintenance of the quality management system, including follow-up on prior findings.

The purpose for which a device is intended, according to the manufacturer's specifications, labeling, and instructions, which shapes design requirements, risk analysis, and validation activities.

The removal or correction of a marketed device because it is unsafe or nonconforming, requiring documented action, notification to affected parties and authorities, and effectiveness checks.