Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)
What this domain tests
This domain tests whether you understand what an MDQMS is for and how ISO 13485:2016 differs from product standards and from ISO 9001. The exam expects you to connect patient safety, applicable regulatory requirements, the device lifecycle, and risk-based process control.
Core rules and concepts
- ISO 13485 specifies QMS requirements for organizations that need to demonstrate ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements.
- It is a voluntary, consensus standard; it does not by itself approve a device for market. Regulatory approval and certification are separate.
- The standard uses a process approach and requires a risk-based approach to controlling QMS processes. Risk management is not confined to one clause; it informs design, purchasing, production, feedback, and CAPA.
- The QMS must cover the organization's role in the device lifecycle: design, production, distribution, installation, servicing, or others.
- Exclusions are limited. Design and development (7.3) may be excluded only when applicable regulatory requirements permit and the organization has no design responsibility. The justification must be documented.
- Documented information must be controlled; records must remain legible and retrievable for at least the device lifetime as defined by the organization, and not less than two years from release, unless regulations require longer.
Worked example
A software start-up buys a module and claims clause 7.3 is excluded because it did not write the code. Reasoning: buying code does not remove design responsibility if the company specifies, configures, verifies, or releases the medical device software. If regulations do not permit the exclusion, 7.3 applies. The correct action is to document the regulatory basis, assign design controls, and retain risk-management evidence.
Traps that cost marks
Treating ISO 13485 as a product certificate; assuming all ISO 9001 content is enough; excluding 7.3 without a regulatory justification; and limiting risk management to one procedure.