Quality Management
Last Updated: 21 August 2026
What is an ISO 13485 Quality Management System?
An ISO 13485 Quality Management system is an international standard used for quality management systems in the design and manufacture of medical devices that have special needs that enable organizations to make sure that the medical devices satisfy the needs of the customers and regulations.
Why Should ISO 13485 Quality Management System Be Implemented?
ISO 13485 is very important for manufacturers and suppliers of medical devices because it enables an organization to ensure that medical devices are developed and delivered in a manner that makes them safe for use. By following these ISO requirements for medical devices, an organization will not only be in compliance with regulations, but will also manage the risk in the manufacturing process.
Scope and Core Quality Management Systems
Any medical device manufacturer based in Europe or America must have an ISO 13485 Quality Management System. Under the U.S. QMSR system, this involves ISO 13485:2016 and Clause 3 of ISO 9000:2015. The ISO 13485 can be applied to all local and foreign firms which manufacture finished devices or accessories. This also applies to contract sterilizers, installers, and specifiers. In case of any ISO 13485 requirement conflicting with the provisions of US Federal Food, Drug, and Cosmetic Act, the provisions of the Act prevail. Foreign manufacturers have to clearly identify their functions like importers or distributors as per foreign law and evaluate the impact of regulatory requirements in the jurisdiction. Design control is an exception allowed if permitted by the foreign law. However, if any other requirement of ISO 13485 Clauses 6, 7 or 8 is not required, the reasons for this need to be stated in writing in the ISO 13485 quality manual.
Initiating Compliance With An ISO 13485 Gap Analysis
Prior to implementation of these frameworks, many organizations perform ISO 13485 gap analysis. This type of analysis allows organizations to assess their process against ISO 13485 standard. When it comes to product realization risk and design control, one should develop continuous risk management that would cover the whole lifecycle of the quality system. In accordance with US QMSR regulation, all class II and class III medical devices and certain class I medical devices which include software automated devices, tracheobronchial suction catheters, non powdered surgeon's gloves, protective restraints, manual radionuclide applicator systems and teletherapy radionuclide sources should comply with design and development controls specified in ISO 13485 clause 7.3. Investigational device exemptions should also be strictly followed in accordance with these design controls; however, in Europe, this system is required to have a clinical evaluation plan with direct connection to post market clinical follow up. Clinical or performance evaluation should be performed during design validation and devices under evaluation cannot be released to customers.
ISO Guidelines For Medical Devices Production Processes, Labeling, And Market Release
For the process of production labeling and control of the release of medical devices, you will need standard operating procedures to deal with any changes in the design or functional changes of the devices or harmonized standards and common specifications. Mandatory ISO 13485 SOP should be documented. For the case of combination products based on drug rules, you need to meet the requirements of the quality system at the same time according to both drug regulation and certain ISO 13485 and 820 provisions on general requirements, design, purchasing, internal audit, and servicing. Check gates must prevent possible labeling errors with specific procedures for inspection, storage, and handling of labels. The labeling and packaging processes need to be evaluated before physical release to confirm that unique processing parameters and unique device identifiers are there. Regardless of any automated scanning systems, there should be a designated person who should manually evaluate samples of all processed labels. You cannot release batches of medical devices to the market without approval of conformity within the QMS. European legislation requires that there should be a designated person responsible for regulatory compliance within the system, although micro and small companies may have an external solution to this. According to US law, rework involves activities performed to a nonconforming product prior to release.
ISO 13485 Quality Management System For Technical Files, Traceability, And Record Controls
For dealing with issues of traceability and record controls of medical files, it is necessary to ensure a complete medical device file with technical description, specification and monitoring of each device family in accordance with ISO standards for medical devices. Quality records should be kept during the time indicated by the requirements of the market regulation, but not less than for two years after the commercial release of the product, whereas compliance records have to be kept during the entire life span of the device. For Europe, a post market surveillance report is required for class I products, and class IIa, IIb and III feed data into a periodic safety update report. These safety reports have to be updated every year for class IIb and class III, and not less than every second year for class IIa. As to the traceability requirements, the quality management system should be verified regarding unique device identification. According to US regulations, manufacturers should provide unique device identifications for their products in accordance with part 830, and tracking of products should be performed in accordance with part 821 if a tracking order is issued. Life sustaining devices are required to comply with specific elements of ISO 13485 clause 7.5.9.2. The United States defines implantable devices as devices that are placed into human body cavities for at least 30 days. Specific captures of complaint files and servicing files are mandatory even for CGMP exempt manufacturers.
We Offer ISO 13485 Consulting, Specializing In Post Market Surveillance (PMS) And Vigilance
A pro active post market surveillance system and channels of direct communication with the local regulatory authority form part of the quality system. It is the responsibility of the manufacturer to report adverse events to the FDA, provided that they qualify according to part 803 of the regulations. The compliance department has to ensure that all advisory notifications in connection with field correction, field actions, and market notices are made according to part 806.
Conformity Pathways, Inspection Mechanics, Costs, and ISO 13485 Gap Analysis
For conformity assessment approaches in Europe, these are based on the device risk class according to annex IX. Class III pathways entail a full quality system audit according to chapter I supported by a complete ISO 13485 quality manual and technical documentation according to chapter II. For class IIb, the approach involves chapters I and III together with technical documentation audit of at least one representative device per generic group, except for class IIb implantable devices whose technical audits are done for each individual device. Class IIa entails compliance with chapters I and III and a technical documentation audit of a representative device per each category. Special class I categories such as sterile, measuring, or reusable surgical instruments utilize annex IX chapters I and III processes but only auditing is done concerning the sterility, metrology, or reuse. An alternative is annex XI part a, which is based on a production quality management system. With regard to the US market, the use of QMSR framework was made effective from February 2, 2026, making the old quality system inspection and compliance documents 7382.845 and 7383.001 obsolete. Active US inspections now use only the new procedure explained in the inspection of medical device manufacturers compliance program 7382.850 to evaluate each ISO 13485 SOP and quality process. The estimated annualized compliance learning and transition costs often driven by executing an ISO 13485 gap analysis for already registered organizations amount to about $8.2 million dollars per year. An estimated burden cost for medical device establishments that do not conduct an ISO 13485 gap analysis to comply with ISO 13485 during implementation of the rulemaking amounts to $ 49,871,733 dollars.
Direct Inspection Rules, Audit Enforcement, and ISO 13485 SOP Compliance
FDA, in particular, has clarified that it will not accept any standard ISO 13485 certificates or a standalone ISO 13485 quality manual in place of its own regulation and surveillance inspection carried out under section 704 of FD&C Act. Neither foreign nor domestic manufacturers can be exempted from the FDA’s inspection process based on the ISO 13485 certification. However, the FDA will continue accepting detailed third party audits conducted through voluntary Medical Device Single Audit Program (MDSAP). In Europe, the notified bodies conducting an assessment of the manufacturer are obligated to conduct the quality system assessment using their own permanent internal personnel. It is important to add that the notified body assessments are regulated by national authorities through observed audits, which means that the national authorities will have a chance to observe the notified bodies as they assess and inspect each ISO 13485 SOP and the overall quality management system implementation at the manufacturing site.
Benefits of an ISO 13485 Quality Management System
Improvement of risk management: Offers techniques to detect risks during the entire life cycle of the product, thereby ensuring the safety of patients and users.
Regulatory compliance: Makes it easy to adhere to very strict regulations that have to be met before manufacturing medical devices, and that will facilitate entry into the market and conducting business globally.
Efficiency: Helps to achieve efficiency and effectiveness by streamlining processes.
Market access: Ensures market access in different countries by complying with regulations internationally.
Improved reputation: Establishes the reputation of an organization among various stakeholders through compliance with a widely accepted quality standard.
What Can Morulaa do for ISO 13485 Consulting?
Morulaa Healthtech provides you with ISO 13485 consulting along with QMS software customized specifically for the medical devices sector by industry professionals. Once you choose Greenlight Guru, you get the advantage of fulfilling many of the requirements set out in ISO 13485:2016 right from the software's workflow capabilities.
Too many people in our industry see a QMS as just a box to check for compliance. They miss how it can actually help their business run better. Our team is designed to change that. It helps you run a tighter, more efficient company so you can focus on making high quality products. Most importantly, it helps your business focus on what matters most, doing what is best for the patients who use your devices.
Frequently Asked Questions (FAQs)
When did the new US QMSR framework officially come into effect and what inspection protocols should be followed?
The QMSR framework transition process began from February 2, 2026. On that day, the FDA discontinued the use of the Quality System Inspection Technique when conducting device inspections. At the same time, compliance documents called Inspection of Medical Device Manufacturers (7382.845) and Medical Device PMA Preapproval and PMA Postmarket Inspections (7383.001) have become outdated. Active inspections are now conducted according to the updated program 7382.850.
How much would it cost for an overseas manufacturer to comply with QMSR when entering the US market?
The FDA assumes an estimated industry wide learning and transition compliance cost of around $8.2 million for the existing registration. Processes currently do not comply with an ISO 13485 quality management system; the capital and training cost is estimated to be around $49,871,733.
What are the specific rules that an overseas small business must follow for the European PRRC mandate?
Every company has to ensure that it has an assigned Person Responsible for Regulatory Compliance in its quality system. Yet micro and small companies are structurally exempted, which implies that they are not obliged to have the PRRC physically present in their companies if their quality system provides for a legal setup of always having this specialist available.
Is there any physical limitation as far as qualifications of an individual performing QMS assessment in Europe are concerned, and will the national authority witness this inspection?
Yes, there is a physical limitation on this matter. While assessing the quality system of a manufacturer, the Notified Body can use only permanent employees of its own company. Furthermore, it is expected from the national authorities to witness this inspection, which means that national inspectors will monitor the inspection of Notified Body inspectors.
What are the maintenance timetables for technical file and safety updates for Class IIa, IIb, and III devices sold in Europe?
Data obtained from the quality system has to be used to conduct Periodic Safety Update Report. The quality system has to have strict mandatory maintenance timetables for such technical files, which means that the safety report of Class IIb and Class III must be updated once per year while that of Class IIa once every two years.
What are the absolute limits on clinical testing and device release during design validation?
In order to conduct design and development validation, clinical testing or performance testing needs to be done strictly according to regulatory requirements. Those devices that are being tested through clinical or performance tests are not allowed to be deemed as released.