ISO 13485 is the quality management system standard for organisations that design, manufacture, store or distribute medical devices. The current edition is ISO 13485:2016; in Europe it appears as EN ISO 13485:2016/A11:2021 among the standards harmonised under the MDR.
The standard puts product safety and regulatory requirements at the centre of the system. The aim is not to produce paper, but to build an order that lets every production batch reach the market with the same confidence.
When is ISO 13485 needed?
The MDR requires a quality management system from every manufacturer, including class I (Article 10). For class IIa and above that system is audited by a notified body. ISO 13485 is the accepted way of meeting that requirement.
The need also arises beyond regulation. Many distributors, tender authorities and overseas buyers ask their suppliers for an ISO 13485 certificate. If you manufacture under contract or supply critical components, your customers may ask for it too.
What is the difference between ISO 13485 and ISO 9001?
ISO 9001 is a general quality standard for any sector and puts customer satisfaction and continual improvement first. ISO 13485 is written around medical device regulation. Its priority is to maintain the effectiveness of the system and to release safe, compliant product. In practice the differences show up here:
- A medical device file is kept for each device type (clause 4.2.3).
- Risk management runs across the whole of product realisation, together with ISO 14971.
- Process validation, sterile product and contamination control are defined in detail.
- Complaint handling and reporting to regulatory authorities are mandatory parts of the system.
- Validation is required for the software used in the quality system.
If you hold ISO 9001 you have a good base. But ISO 13485:2016 does not use the high level structure (Annex SL) of ISO 9001:2015, and the clause numbers do not map one to one. The transition means reworking the document structure and some processes.
How do you obtain an ISO 13485 certificate?
The certificate is issued after a two-stage audit by an accredited certification body. Stage 1 reviews the documentation and readiness. Stage 2 looks at records to see that the system is genuinely applied on site.
To go into the audit the system must have been running for a while: at least one internal audit and one management review must have taken place and produced records. A typical implementation follows this order:
- Gap analysis of the current state against the standard
- Defining the scope, processes and responsibilities
- Preparing the quality manual, procedures and forms
- Briefing the team and putting the system into use
- Internal audit and management review
- Certification audit and closing of findings
The quality system audit under the MDR is carried out by a notified body. Many notified bodies also issue ISO 13485 certificates, so the two audits can often be combined.
How is an internal audit run?
An internal audit is the organisation auditing itself against the standard and its own procedures (clause 8.2.4). The audit programme is planned according to the risk of the processes and previous findings. An auditor does not audit their own work.
A good internal audit does not stop at checking whether a document exists. It follows one example from end to end: from the record of a complaint to the verification of the effectiveness of the corrective action. EUmediq can run the internal audit for you with an independent eye.
How do you prepare for the certification audit?
Auditors look at records more than at documents. Preparation focuses on:
- What the procedure says matching what is done on site
- Training and competence records being current
- Corrective and preventive actions (CAPA) addressing root causes, with effectiveness verified
- Supplier evaluation and monitoring records being complete
- Design changes having been assessed for their effect on risk and verification
A mock audit run in the format of the real audit gives the team practice in question and answer and reduces surprises.
How is the system maintained after certification?
Certification is a beginning. The system keeps working every day through internal audits, management reviews, CAPA, complaint handling and supplier monitoring. In small teams that load often falls on a single person.
With ongoing consultancy EUmediq can run that calendar with you. The internal audit programme, management review inputs, surveillance audit preparation and closing of findings move to a plan. The audit week then needs no different preparation from the rest of the year.
How often is an ISO 13485 certificate renewed?
The certificate is valid for three years. A surveillance audit takes place each year, and at the end of the third year the certificate is renewed through a recertification audit. Under the MDR, notified bodies also carry out unannounced audits at least once every five years.
Common problems
- A system built from a template. Procedures adapted from another company do not describe your processes. That usually becomes clear in the first questions of an audit.
- A record burden heavier than necessary. A form nobody fills in is itself a nonconformity. The system should be lean enough for the team to actually use.
- CAPA closed without verifying effectiveness. This is the most common reason the same finding returns at the next audit.
- Forgotten software validation. If ERP, document management or measurement software affects the quality system, a validation record is required.
