ISO 13485 case study: a medical device manufacturer

The organisation and what it needed

This ISO 13485 case study concerns a company that designs and manufactures medical devices. At the outset it had three linked needs. Its designs had to be robust, its devices had to be safe in the hands of clinicians and patients, and it needed a path through global device regulation that it could rely on rather than renegotiate for every submission.

Those needs pull in the same direction: a regulator reviewing a device wants to see how its design was controlled and how its hazards were reduced, and a manufacturer that cannot show this faces questions and delay.

What was implemented

The quality management system was centred on two areas of the standard.

Design controls

Design and development became a controlled process rather than an informal sequence of engineering decisions. Under ISO 13485 that means planned stages, defined inputs and outputs, recorded reviews, verification and validation, controlled transfer to production and managed design changes, so that each decision about a device can be traced to the reasoning and testing behind it.

Risk management

Risk management was made part of how devices are designed and made, not a document completed once the design is settled. ISO 13485 expects risk management across product realisation, and the method most device companies apply is ISO 14971. Hazards, the controls chosen against them and the evidence that those controls work sit in a file that is kept current as the device evolves.

What changed

The company reports gains on both sides of its business. On the product side, the focus on design controls and risk management improved the safety and functionality of its devices and lowered the risk of failure when they are used on patients.

On the regulatory side, meeting the regulations through a structured system made market approvals smoother and avoided costly delays. It also showed international healthcare providers the company's commitment to quality.

Its VP of regulatory and quality said that the company now designs and manufactures safer, better devices.

About ISO 13485

ISO 13485 sets the requirements for a medical device quality management system for regulatory purposes. Its concern is less customer satisfaction in general than whether every device is safe, performs as intended and can be traced, reported on and recalled when regulation requires it. It applies across the device life cycle, from design and manufacture to sterilisation, distribution and servicing, and reaches into suppliers.

The edition in force is ISO 13485:2016, which ISO confirmed in October 2025 with no amendment, so there is no transition to plan. Its requirements run through clauses 4 to 8: the system and its documentation, including a medical device file for each family; management responsibility; resources; product realisation, including design and development and risk management; and measurement, analysis and improvement, including complaints and regulatory reporting.

An ISO 13485 certificate is issued by an independent, accredited certification body after its Stage 1 and Stage 2 audits. It is not a CE certificate, an FDA clearance or a national registration, although the same system supports each of those decisions.

How Sterling runs a programme like this

What follows describes how Sterling generally structures an ISO 13485 engagement for a device manufacturer; it is not a description of this particular client's project.

Work starts with the scope, the target markets and a gap analysis of existing design, risk and complaint records. The system is then built with the company's engineers, run long enough to produce real records, audited internally and reviewed by management before the certification body's assessment.

Clients choose one of two support levels. With Design™, Sterling develops the system and your team implements it under our expert advice and supervision. With Drive™, Sterling designs and builds it under your approval, fully managed. The two are alternatives, not stages. Every engagement includes Effivity, used in 50+ countries, at no additional cost, and internal auditor training for your audit team, as applicable to your standard. After certification, Sustain™ supports surveillance and recertification audits.

ISO 13485 for device manufacturers: questions buyers ask