Introduction

Medical device manufacturers operate in an industry where product quality, patient safety and regulatory compliance are critically important.

Whether producing diagnostic equipment, surgical instruments, implants or other medical technologies, organisations must maintain consistent controls throughout relevant stages of the product life cycle.

ISO 13485 provides a recognised framework for managing these responsibilities.

However, implementing the standard requires detailed understanding of its requirements, appropriate documentation, effective risk management and evidence that processes operate as intended.

This ISO 13485 requirements checklist is designed to help manufacturers, suppliers and quality professionals understand the key requirements and prepare for certification.

What Is ISO 13485:2016?

ISO 13485:2016 is the international standard for Quality Management Systems (QMS) applicable to medical devices and related services.

It specifies requirements for organisations that need to demonstrate their ability to provide medical devices and related services consistently meeting customer and applicable regulatory requirements.

The standard is relevant to device manufacturers and may also apply to organisations involved in design, development, production, installation, servicing or other relevant activities.

The 2016 edition remains current and was confirmed following an ISO review in 2025.

Businesses can explore ISO 13485:2016 certification to understand assessment requirements and certification planning.

Who Needs ISO 13485 Certification?

ISO 13485 can apply to organisations operating in different parts of the medical device supply chain.

Examples include medical device manufacturers, contract manufacturers, component suppliers, sterilisation service providers, device maintenance businesses and certain design organisations.

Applicability depends on the organisation's actual products, services and QMS responsibilities.

Certification may be requested by customers or required within certain regulatory or market-access arrangements.

However, ISO 13485 certification alone does not automatically establish compliance with every medical device regulation.

Businesses must separately identify applicable laws, product classification requirements and market authorisations.

ISO 13485 Requirements: Main Clauses

ISO 13485 contains major requirements across Clauses 4 to 8.

Each addresses an important aspect of medical device quality management.

Clause 4: Quality Management System

Organisations must establish, document, implement and maintain an appropriate QMS.

This includes identifying necessary processes, determining their interactions and maintaining controls over relevant outsourced activities.

Document control and record management are particularly important because medical device organisations often need traceable evidence of product quality and regulatory compliance.

Practical checklist:

• Define the QMS scope.

• Identify applicable regulatory requirements.

• Establish required documented procedures.

• Maintain an appropriate quality manual.

• Establish document and record controls.

• Control outsourced processes.

• Maintain medical device files as applicable.

A medical device file may bring together documents describing product specifications, production requirements and relevant quality arrangements.

The extent of required information depends on the device and organisational responsibilities.

Clause 5: Management Responsibility

Top management must demonstrate commitment to establishing and maintaining the QMS.

This includes defining a quality policy, establishing objectives, assigning responsibilities and ensuring effective communication.

Management reviews should evaluate the ongoing suitability, adequacy and effectiveness of the system.

Practical checklist:

• Establish an approved quality policy.

• Define measurable quality objectives.

• Assign relevant responsibilities.

• Ensure adequate resources.

• Establish internal communication arrangements.

• Conduct management reviews.

• Maintain evidence of management decisions.

Leadership involvement is particularly important when product safety concerns require decisions involving engineering, production, quality and regulatory teams.

Clause 6: Resource Management

Medical device quality depends on competent personnel, suitable infrastructure and controlled working environments.

Organisations must identify resources necessary for meeting product and regulatory requirements.

This may include specialised equipment, clean environments, trained operators and maintenance arrangements.

Practical checklist:

• Identify personnel competence requirements.

• Provide relevant training.

• Evaluate training effectiveness.

• Maintain suitable infrastructure.

• Control working environments where necessary.

• Establish contamination-control arrangements where applicable.

For example, a manufacturer of sterile medical devices may need additional environmental controls, specialised training and process-monitoring activities.

Clause 7: Product Realisation

Product realisation is one of the most significant areas of ISO 13485.

It addresses planning, customer requirements, design and development, purchasing, production, service provision and monitoring equipment.

Manufacturers must establish processes suitable for their products and applicable regulatory requirements.

Practical checklist:

• Plan relevant product-realisation activities.

• Determine applicable product requirements.

• Establish design and development controls where applicable.

• Verify and validate relevant design outputs.

• Evaluate and monitor suppliers.

• Control production and service processes.

• Validate processes where outputs cannot be fully verified later.

• Maintain identification and traceability arrangements.

• Control monitoring and measuring equipment.

Product traceability is especially important when organisations need to investigate defects, complaints or affected production batches.

Clause 8: Measurement, Analysis and Improvement

Organisations must monitor relevant QMS processes and product conformity.

They also need processes for handling feedback, complaints, nonconformities and corrective actions.

The goal is to identify issues systematically and ensure appropriate responses.

Practical checklist:

• Establish feedback and complaint-handling procedures.

• Determine applicable regulatory reporting obligations.

• Conduct internal audits.

• Monitor relevant QMS processes.

• Control nonconforming products.

• Investigate quality problems.

• Establish corrective-action procedures.

• Evaluate the effectiveness of corrective actions.

For example, repeated component failures should trigger appropriate investigation rather than simply replacing affected items without determining the cause.

Risk Management in ISO 13485

Risk management is a fundamental aspect of medical device quality.

Organisations should establish processes for identifying and managing risks associated with relevant activities and product requirements.

ISO 14971 is an important related standard for applying risk management to medical devices.

For example, a manufacturer developing a diagnostic device may need to evaluate risks associated with incorrect results, software behaviour, usability and foreseeable misuse.

Risk-control decisions should reflect the intended device use and applicable regulatory requirements.

Risk management is not limited to a single document prepared before certification.

It should inform relevant design, production, supplier and post-production activities.

ISO 13485 Documentation Checklist

The documents and records needed depend on the organisation's scope and activities.

This is a practical overview rather than an exhaustive list of every requirement.

Organisations should refer to the official standard and applicable regulatory obligations.

Supplier Control and Traceability

Medical device quality can be affected by components, materials and outsourced services.

Organisations should establish supplier selection and monitoring arrangements proportionate to product and process risks.

For example, a supplier providing a critical implant component may require more extensive qualification than a supplier providing non-critical office materials.

Purchasing information should clearly define relevant requirements.

Where traceability is required, organisations must maintain sufficient records to identify affected products or batches.

Good traceability supports complaint investigation, field safety action and efficient recall management.

ISO 13485 and Medical Device Regulations

ISO 13485 is internationally recognised, but regulatory frameworks differ between markets.

The European Union Medical Device Regulation establishes requirements for applicable devices placed on the EU market.

The United States Food and Drug Administration has incorporated ISO 13485:2016 into its Quality Management System Regulation framework, which became effective in February 2026.

Businesses should determine which requirements apply to their products, manufacturers and target markets.

The London Cert healthcare and pharmaceutical sector page provides additional information about relevant certification considerations.

ISO 13485 vs ISO 9001

Both standards address quality management, but they are not interchangeable.

ISO 9001 provides general QMS requirements applicable across industries.

ISO 13485 is specifically designed for medical device organisations and places particular emphasis on regulatory requirements, product risk, documentation, validation and traceability.

An organisation already implementing ISO 9001 may have useful existing processes.

However, it must still address ISO 13485-specific requirements before seeking certification.

Preparing for an ISO 13485 Certification Audit

Preparation should begin with a gap assessment comparing existing quality procedures against the applicable requirements.

Next, the organisation should address identified gaps, train personnel and maintain evidence of implementation.

A thorough internal audit should then evaluate relevant processes.

Management review should assess the QMS and determine whether further actions are necessary.

An external certification assessment typically involves Stage 1 and Stage 2 audit activities, followed by any necessary corrective actions and a certification decision.

Certification does not replace product testing, regulatory approval or other market-entry requirements.

Frequently Asked Questions

Is ISO 13485:2016 still valid?

Yes. ISO 13485:2016 remains the current published edition as of October 2026.

Does ISO 13485 require a quality manual?

Yes. Unlike ISO 9001:2015, ISO 13485:2016 explicitly includes a quality manual requirement.

Can medical device suppliers obtain ISO 13485 certification?

Yes, where the standard is applicable to their activities and the certification scope is appropriate.

Does ISO 13485 replace CE Marking?

No. ISO 13485 concerns quality management, while CE Marking concerns conformity with applicable EU product legislation.

Is ISO 13485 certification mandatory worldwide?

No. Regulatory and contractual requirements vary by country, device category and market.

Conclusion

An effective ISO 13485 requirements checklist helps medical device organisations strengthen quality management and prepare for independent certification.

Important priorities include documented processes, risk management, supplier controls, product traceability, complaint handling and continual assessment of QMS effectiveness.

Businesses should focus on implementing controls that genuinely support consistent product quality and patient safety.

Preparing for medical device QMS certification?

Explore London Cert's ISO 13485:2016 certification services for information about audit preparation, scope and certification requirements.