ISO 13485 step by step

Step 1: Scope and strategic choices

First determine what falls within your certification scope:

• which products and product families;
• which sites and teams;
• which markets (for example the EU, UK or US);
• which processes you carry out yourself and which you outsource.

A scope that is too broad slows your project down. A scope that is too narrow often causes duplicate work later.

Action: Record the scope and exclusions explicitly and have management confirm them.

Step 2: Gap analysis against ISO 13485

Compare your current way of working with the requirements of the standard and mark each part as:

• compliant;
• partly compliant;
• not compliant.

In this phase, focus mainly on the areas that auditors look at closely: document control, design controls, supplier controls, traceability, complaints and CAPA.

Action: Create a concrete improvement plan with priority, owner and delivery date.

Step 3: Design the QMS architecture

Set up a workable QMS structure:

• quality policy, objectives and governance;
• document hierarchy (policy, SOPs, records);
• division of roles between quality, regulatory and operations;
• change control and training management.

Action: Design it lean, not in theory. Everything must be usable on the shop floor.

Step 4: Build and test core processes

Implement the processes that decide the audit outcome:

• design and development controls;
• supplier qualification and evaluation;
• production and release controls;
• traceability from material to delivery;
• complaints, nonconformities and CAPA.

Action: For each process, run at least one real-life case and archive the evidence.

Step 5: Training and evidence

Without demonstrated implementation, there is no certification. Make sure you have:

• role-specific training;
• signed training records;
• complete and retrievable registrations;
• CAPA files with root cause analysis and effectiveness checks.

Action: Plan to build evidence at least 2-3 months before stage 1 starts.

Step 6: Internal audit and management review

Carry out a complete internal audit across the scope. Then discuss the results in a management review, with decisions, actions and deadlines. A workable setup for that internal audit, with a checklist and audit plan, is on the page internal audit for ISO 13485.

Action: Close major audit gaps before you schedule the external audit.

Step 7: Stage 1 audit

The certification body assesses whether your QMS design and documentation are audit-ready. You receive findings, which you resolve before stage 2.

Action: Formally close open points with evidence and a responsible owner.

Step 8: Stage 2 audit

Here the auditor tests practice: does your system really work in daily operation? If the outcome is positive, certification follows, with possible follow-up on minor findings.

Action: Make sure process owners can clearly explain their role, records and decision-making.