Two-minute brief
ISO 13485 requirements explained: video brief
A two-minute brief on ISO 13485:2016 and why its five clauses, rewritten for devices, differ from the structure of other management system standards.
Key takeaways
- ISO 13485 uses clauses 4 to 8, not the harmonised structure of newer ISO standards.
- Each device family needs a medical device file.
- Risk is about device safety, performance and regulatory requirements.
- Complaint handling includes decisions on reporting to regulatory authorities.
- Certification is separate from device market approval.
Five clauses, written for devices
ISO 13485:2016 does not use the harmonised structure of the other management system standards. Its requirements sit in five clauses, 4 to 8, inherited from ISO 9001:2008 and rewritten for medical devices. It uses the word risk only for device safety or performance and for meeting regulatory requirements, and a requirement it calls documented must also be established, implemented and maintained. This short film walks through the five clauses.
Clause 4, the quality management system, asks you to define and control the system's processes, including outsourced ones, on a risk-based approach, and to document it with a quality manual, procedures, a medical device file per device family, and controlled documents and records. In practice that means a process map that shows what suppliers do and a device file holding the description, intended use, labelling, specifications and manufacturing and monitoring procedures. Clause 5, management responsibility, asks for commitment to the system and to regulatory requirements: a quality policy, measurable objectives, defined responsibilities, a management representative with real authority and management review.
Resources, realisation and measurement
Clause 6 covers resources, competence, infrastructure and the work environment. Clause 7, product realisation, holds most of the device-specific work: planning, customer requirements, design and development controls, purchasing and supplier control, production and service provision, process validation, identification and traceability, and the control of monitoring and measuring equipment. Clause 8 covers measurement, analysis and improvement: feedback, complaint handling, reporting to regulatory authorities, internal audit, control of nonconforming product and corrective and preventive action.
The standard applies at every life-cycle stage and to the whole supply chain: designers, contract manufacturers, sterilisers, software developers, importers, distributors and servicers. ISO 13485:2016 is the current edition, confirmed by ISO in October 2025. Certification is decided by an independent, accredited certification body; device approval remains a separate decision by the regulator or notified body.
ISO 13485 at a glance
- Purpose
- A device quality management system for regulatory purposes: design controls, risk management, traceability, complaint handling and regulatory reporting
- Relevant to
- Manufacturers, designers, contract manufacturers, sterilisers, software developers, importers, distributors and servicers
- Edition
- ISO 13485:2016, confirmed by ISO in October 2025; no amendment and no transition running
- Certification
- Assessed and decided by an independent, accredited certification body; device approval is a separate decision by the regulator or notified body
- Sterling's role
- Consulting with your team, Effivity, training, internal audit, certification readiness and then Sustain™
- Cost and timing
- Total investment for an ISO 13485 medical device QMS depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 6 to 12 months
ISO 13485: questions people ask
Is ISO 13485 certification mandatory for medical device companies?
The standard is voluntary; the regulations that reference it are not. In the EU, the MDSAP countries, the Philippines, Saudi Arabia, Australia and India, and in the United States through the QMSR, regulators expect a device quality management system measured against ISO 13485. Whether a certificate is demanded outright depends on the market and device class; most manufacturers are asked for one.
Does an ISO 13485 certificate give us CE marking or FDA clearance?
No. The certificate confirms that an accredited certification body found your system conforming to the standard. CE marking is a conformity assessment under the MDR or IVDR, with a notified body involved above basic Class I; the FDA inspects manufacturers itself; national registrations are decided by the national regulator. The certified system supports those decisions; it does not make them.
What is the difference between a certification body, a notified body and an MDSAP auditing organisation?
A certification body is accredited to ISO/IEC 17021-1 with IAF MD 9 and certifies your system against ISO 13485. A notified body is designated by an EU member state to assess devices and quality systems against the MDR or IVDR and issues the certificates behind the CE mark. An MDSAP auditing organisation is authorised by the regulators of Australia, Brazil, Canada, Japan and the United States to conduct one audit, on ISO 13485 plus each country's requirements, that all five accept.
We are certified to ISO 9001. How much more is ISO 13485?
Enough to be a project, not an addendum. ISO 13485 keeps the structure of ISO 9001:2008 and adds what a general system lacks: a medical device file, risk management through product realisation, design files, contamination control, sterile particulars, validation, traceability, complaint handling, regulatory reporting, advisory notices and preventive action. Your document control, audit and review discipline transfers; the device content has to be built.
Do distributors, contract manufacturers and software developers need ISO 13485?
The standard applies to any organisation at one or more stages of a device's life cycle, and to their suppliers. A distributor's certificate covers storage, distribution, traceability and complaints; a contract manufacturer's covers production, validation and, where relevant, sterilisation; a software developer's covers design and development, usually alongside IEC 62304. The scope matches what you do.
Keep exploring
Related to this video
Read next
The complete guide
Everything on ISO 13485
Start with the ISO 13485 page, or go straight to the guide you need.
On the ISO 13485 page
Guides
- ISO 13485 case study
- The ISO 13485 certification process, step by step
- ISO 13485 certification cost
- ISO 13485 medical device file and design file
- Effivity ISO 13485 guide
- ISO 13485 internal audit
- ISO 13485 and FDA QMSR
- ISO 13485 vs ISO 9001
- MDSAP audit readiness
- ISO 13485 requirements explained
- ISO 13485 training
More videos: Healthcare, medical devices and life sciences
- How to implement ISO 22716Implementation walkthrough · 3 min 24 s
- ISO 22716 requirements explainedTwo-minute brief · 2 min
- ISO 7101 requirements explainedTwo-minute brief · 2 min
- How to comply with ADHICS in Abu DhabiCompliance walkthrough · 3 min 15 s
- ADHICS requirements explainedTwo-minute brief · 2 min
- How to comply with the EU IVDR (Regulation 2017/746)Compliance walkthrough · 3 min 15 s
- EU IVDR requirements explainedTwo-minute brief · 2 min
- How to comply with the EU MDR (Regulation 2017/745)Compliance walkthrough · 3 min 15 s
- EU MDR requirements explainedTwo-minute brief · 2 min
Talk to a consultant
Plan your ISO 13485 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice