ISO and GRC standards for pharmaceuticals and medical devices: where to start: video

One quality system, many readers

Pharmaceutical and medical device companies keep one quality system for many readers: the certification body, the notified body, the MDSAP auditor and the medicines inspector. The standards and rules they ask about include ISO 13485 for device quality, ISO 14971 for device risk management, the FDA QMSR for devices sold in the United States, the EU IVDR for diagnostics, GMP for medicines manufacture, GDP for medicines distribution, 21 CFR Part 11 and EU Annex 11 for electronic records, and ISO 22716 for cosmetics good manufacturing practice.

In two minutes and fifteen seconds the film points to where a company should start, with ISO 13485 at the core for device makers and the regulatory provisions written into the procedures they change.

Why quality teams are acting now, and the first step

The rules have moved. The FDA's QMSR, which has applied since 2 February 2026, incorporates ISO 13485:2016 by reference with the FDA's own provisions on top; the FDA inspects, and an ISO certificate does not exempt anyone from inspection. EU IVDR transition dates are approaching for legacy diagnostics, and a notified body is now involved for higher-class tests. Market access dossiers in several countries ask for an ISO 13485 or MDSAP certificate, and partners such as a Qualified Person, a principal or a device brand owner audit a site before they sign.

For device makers, the starting point is usually ISO 13485 with ISO 14971 risk management, built so that device, design and risk files come from real engineering records rather than being assembled the week before an audit. Medicines manufacturers and distributors start from GMP or GDP, with data integrity and electronic records controls alongside. If the order is unclear, the free Select the Standard™ tool maps standards to your products and markets. Regulatory approvals remain decisions of the regulator or notified body.

Sterling's expert and experienced consultants work with QA, engineering, production and warehouse teams in 60+ countries, in one proposal, and stay through the audit and after it.