Requirements of ISO 13485
ISO 13485:2016 sets out requirements for quality management in the medical device supply chain. The standard is set by ISO , available in the Netherlands through NEN (Netherlands Standardisation Institute) , and is often applied in the context of the EU MDR .
In audits, it is not only about procedures on paper. It is about demonstrable implementation with consistent records.
Requirements of ISO 13485 in brief
| Theme | What does the auditor look at? | Read more |
|---|---|---|
| QMS and documentation | Current, controlled documents and records | Step-by-step plan |
| Management responsibility | Clear roles, resources and review cycle | Audit process |
| Resource management | Competence, training and infrastructure | Who is it for? |
| Product realisation | Design, purchasing, production, traceability | MDR and ISO 13485 |
| Measurement and improvement | Complaints, nonconformities, CAPA, internal audit | Audit process |
The 5 core blocks of ISO 13485
1. Quality management system and documentation
You need a controlled system with:
- a quality policy and objectives;
- version control and document control;
- demonstrable records for each process;
- changes with approval and traceability.
2. Management responsibility
Top management must demonstrably steer quality:
- define roles and responsibilities;
- carry out management reviews;
- free up resources for quality and compliance.
3. Resource management
People, resources and the working environment must be suitable for safe output:
- job profiles and competencies;
- a training plan and training records;
- suitable infrastructure and maintenance.
4. Product realisation (often audit-critical)
This block causes most of the findings:
- design and development controls;
- supplier qualification and monitoring;
- production and release controls;
- identification and traceability.
5. Measurement, analysis and improvement
You must manage deviations in a structured way:
- complaint handling;
- nonconformity management;
- CAPA with root cause analysis;
- internal audits and trend analysis.
What auditors check first under ISO 13485
| Check | Why this carries weight |
|---|---|
| Full traceability | Directly linked to product safety |
| Change management | Prevents uncontrolled product impact |
| Supplier controls | Critical for outsourced quality |
| CAPA effectiveness | Shows structural ability to improve |
| Training evidence | Proves that processes are carried out by competent people |
Practical priorities per maturity stage
Start-up phase
Focus: scope, document control, roles.
- Set up the basic QMS structure.
- Start with core procedures and records.
- Make ownership clear.
Deeper look at each topic
Three parts of the standard deserve extra attention because they are audit-critical. The CAPA process under ISO 13485 describes how to set up corrective and preventive actions step by step and close them effectively. For product safety, ISO 14971 risk management is essential: that standard sets out how you identify, assess and manage risks. And if you want to know exactly what belongs in your product file, read the page on technical documentation under MDR and ISO 13485. For the document structure of the quality system itself, read what an ISO 13485 handbook must contain, and for suppliers, the page on a supplier assessment.
Quick 90-day approach to ISO 13485
- Finalise the scope and responsibilities.
- Set up document control and training records.
- Qualify critical suppliers.
- Test traceability with practice cases.
- Plan and follow up the internal audit.