ISO 13485 requirements explained: clauses 4 to 8 of the medical device QMS

How ISO 13485 sets out its requirements

ISO 13485:2016, the third edition, is titled "Medical devices — Quality management systems — Requirements for regulatory purposes", and that last phrase explains most of what follows. Clauses 1 to 3 give the scope, the normative reference and the terms; the auditable requirements run from clause 4 to clause 8. ISO confirmed the edition in October 2025 with no amendment.

Readers used to newer standards will find no separate clauses on context or performance evaluation; those ideas are spread through the five clauses. The 2024 climate action amendment was not applied here, and the introduction states that conforming to ISO 13485 is not a claim of conformity to ISO 9001.

Two definitions in the introduction shape every clause. Where a requirement says something must be "documented", it must also be established, implemented and maintained, so a written procedure that nobody follows does not meet it. And risk refers to the safety or performance of the device and to meeting applicable regulatory requirements.

Clause 4: quality management system

Clause 4.1 sets the general requirements: identify the processes the system needs, apply a risk-based approach to controlling them, and keep control of any process you outsource. A contract steriliser or a component moulder therefore sits inside your system, not outside it.

Clause 4.2 carries the documentation requirements, and it is more prescriptive than a general quality standard. It asks for a quality manual (4.2.2), a medical device file (4.2.3), control of documents (4.2.4) and control of records (4.2.5). The medical device file is kept for each device type or device family and brings together the general description, intended use or purpose and labelling, the product specifications, the specifications or procedures for manufacturing, packaging, storage, handling and distribution, the measuring and monitoring procedures and, where they apply, installation and servicing requirements.

The typical weakness: a device file that is only a folder name.

The medical device file and the design file: what goes in them

Clause 5: management responsibility

Clause 5 makes top management answerable for the system. It covers management commitment (5.1), customer focus (5.2), the quality policy (5.3), planning through quality objectives and planning of the system (5.4.1 and 5.4.2), and responsibility, authority and communication (5.5), which includes the management representative (5.5.2) and internal communication (5.5.3). Management review follows in 5.6.

What sets it apart is the constant pairing of customer and regulatory requirements: objectives that never mention regulators or post-market performance miss the point.

Clause 6: resource management

Clause 6 asks for the resources the system runs on: provision of resources (6.1), human resources (6.2), infrastructure (6.3), and work environment and contamination control (6.4). The last is specific to devices. Clause 6.4.1 covers the work environment needed for the product to conform; clause 6.4.2 requires arrangements for contaminated or potentially contaminated product and, for sterile devices, control of microorganism and particulate contamination.

Auditors sample people whose work affects device quality and ask for evidence of competence, not attendance lists, then walk the controlled areas.

ISO 13485 training: who needs what

Clause 7: product realisation

Clause 7, the core of the standard, follows the device from planning to delivery.

Planning and risk management (7.1)

Clause 7.1 requires a documented process, or processes, for risk management in product realisation, with records of the risk management activities. ISO 14971 supplies the method most manufacturers use. The file has to be maintained through the life of the device, not written once when the design is frozen.

Customer-related processes and design (7.2 and 7.3)

Clause 7.2 covers the requirements for the product, their review and communication with customers (7.2.3). Clause 7.3 then sets out design and development in order: planning, inputs, outputs, review, verification, validation, transfer to production (7.3.8), control of changes (7.3.9) and design and development files (7.3.10). An auditor will pick a design change and trace it back through review, verification and the risk file.

Purchasing, production and traceability (7.4 to 7.6)

Purchasing (7.4) calls for supplier controls in proportion to the risk the purchased product carries. Production and service provision (7.5) runs from control of production (7.5.1) through cleanliness of product, installation and servicing (7.5.2 to 7.5.4) to two sterile-device clauses: 7.5.5, which asks for sterilisation process parameters recorded for each sterilisation batch and traceable to each production batch, and 7.5.7, which covers validation of sterilisation and sterile barrier system processes. Process validation in general sits in 7.5.6, identification in 7.5.8 and traceability in 7.5.9, with extra records for implantable devices, including the name and address of the shipping package consignee. Customer property (7.5.10), preservation (7.5.11) and control of monitoring and measuring equipment (7.6) complete the clause.

Unique device identification is often assumed to be an ISO 13485 requirement. It is not in itself: clause 7.5.8 asks for a documented UDI system where the applicable regulation requires one.

Clause 8: measurement, analysis and improvement

Clause 8 is where the post-market side of the standard lives. Monitoring and measurement (8.2) begins with feedback (8.2.1), a documented process that uses production and post-production data and feeds it back into risk management and realisation. Complaint handling (8.2.2) requires documented procedures from receipt and investigation to the reportability decision and any correction or corrective action, with a justification kept whenever no investigation is made. Reporting to regulatory authorities (8.2.3) requires documented procedures for notifying adverse events and issuing advisory notices where regulation calls for them, and records of what was reported.

Internal audit (8.2.4) and monitoring of processes and product (8.2.5 and 8.2.6) follow. Control of nonconforming product (8.3) separates product found before delivery (8.3.2) from product found after it (8.3.3), where the action must suit the actual or potential effect and advisory notices follow a documented procedure; rework has its own sub-clause (8.3.4). Analysis of data (8.4) and improvement (8.5) close the standard. Unlike ISO 9001:2015 and its successor, ISO 13485 keeps both corrective action (8.5.2) and preventive action (8.5.3) as named requirements.

Where systems fail here, it is usually the link: a complaint closed without a recorded reportability decision, or a CAPA that never reaches the risk file.

ISO 13485 internal audit: planning, conduct and reporting

Where the standard ends and regulation begins

ISO 13485 repeatedly points outwards to "applicable regulatory requirements", so the same clause can demand different records in different markets. The United States is the clearest example: the FDA's Quality Management System Regulation, in force since 2 February 2026, incorporates ISO 13485:2016 by reference, yet the final rule says compliance with ISO 13485 alone does not fully satisfy it. In Europe, EN ISO 13485:2016 is a harmonised standard under both the MDR and the IVDR.

ISO 13485 and the FDA QMSR: what to check

ISO 13485 requirements: questions buyers ask