GUIDE TO ISO 13485

The ISO 13485:2016 standard governs quality management for medical

devices and related services. It’s published by the International Organization
for Standardization (ISO).

The most recent update to the standard was published in

February of 2016, overriding previously published versions from
WHAT IS ISO 13485? 2003 and 1996. ISO 13485 derived from ISO 9001, a quality
The ISO 13485 standard governs quality management certification that’s available to businesses in a wide
management for medical devices and related variety of industries.
services. It’s published by the International
However, medical device and pharmaceutical companies have
Organization for Standardization. ISO 13485
specialized requirements that made some of the requirements of
addresses:
ISO 9001 difficult to apply. ISO 13485 was developed to address
these needs.
• Quality control
• Risk management ISO 13485 provides a great advantage for organizations
producing medical devices and related services. It assures a
• Legal compliance commitment to quality and increases efficiencies within the
• Operational efficiency organization. Becoming ISO 13485 certified can increase client
base and reduce barriers to entry of foreign markets, product
• Ability to trace and recall liabilities, and production down-time.
products and devices
The auditing process can appear overwhelming, but it does not
• Process and product have to be. For those seeking their first ISO 13485 certification
improvement the following information can serve as a starting place for
implementation.

NQA/ISO13485/V1/MAR21
 THE BENEFITS OF IMPLEMENTING ISO 13485:2016
Businesses that have implemented ISO 13485 cite numerous benefits; many companies seek certification
because of the financial benefits to their business. Certification demonstrates their commitment to building
high-quality medical devices; that allows them to attract more clients than ever before.

1. Ability to Contract with Larger Companies 4. Help Personnel Access Relevant Information
Many large medical device businesses prefer to work The documentation requirements in this standard are
with vendors who are ISO 13485 certified. The 2016 designed to ensure that all members of a development
update to this standard may make this even more team have access to the information they need, when
desirable. The revisions mean that large companies they need it. Having access to the right information can
are responsible for ensuring that any subcontractors reduce the time and expense associated with product
conform to ISO 13485 standards. That means development.
subcontractors who already have the certification are
likely to be prioritized. 5. Expand and Consolidate Business Knowledge
We also hear from clients that documenting the
2. Demonstrate Commitment to High Quality
processes associated with their medical device helps
Both ISO 13485 and ISO 9001 are seen as indicators the business develop a consolidated knowledge
of an organization’s commitment to quality. Achieving base. This knowledge can help to identify problems,
a quality management certification demonstrates to improve the product, and streamline the manufacturing
customers and regulators that your company values process. It also makes the process of on-boarding new
quality. employees easier.

3. Expand Potential Market 6. Make Achieving ISO 9001 Certification Easier

Standards like ISO 13485 are created to ensure that Many businesses hold both ISO 13485 and ISO 9001
medical devices in different places demonstrate the certifications. If your business is ISO 13485 certified,
same reliability and quality. If you’re considering achieving ISO 9001 certification is significantly
exporting products, ISO 13485 certification can lend easier. The requirements of these two standards are
an advantage. Not only is it the first step to regulatory generally harmonised. ISO 9001 does contain a few
approval in major markets like the European Union requirements related to business clauses that
and Canada, but it also demonstrates the quality of the ISO 13485 doesn’t cover.
product to potential buyers.

NQA/ISO13485/V1/MAR21
KEY DIFFERENCES IN REASONS FOR THE UPDATE
ISO 13485 (FROM ISO 9001) When the 2003 standard was reviewed, ISO staff
discussed potential revisions with a variety of regulatory
• 
Additional requirements for preventing contamination
bodies. The consensus was that the old standard no
• 
Monitoring focuses on meeting customer requirements, longer reflected current quality management needs.
rather than on subjective customer satisfaction
According to Eamonn Hoxey, former chair of ISO’s
measures
technical committee for quality management:
• 
Multiple documentation requirements at all stages of
product development
When we did the last review, we had
• 
Focus on maintaining the effectiveness of the
discussions with the regulatory authorities
quality management system instead of continuous
and we — both industry and the
improvement (as required for ISO 9001)
authorities — felt that it was time to revise
• 
Risk management during design and production the standard … Since 2003, a number
• 
Additional requirements for regulatory reporting, of jurisdictions have either revised or
advisory notices, and recalls. introduced regulations for medical devices,
so we want to make sure the quality
management system requirements align
fully with those regulatory requirements.
APPLICATIONS OF
ISO 13485 The requirements within ISO 13485 have been adopted
into a number of different countries’ regulatory programs.
ISO 13485 specifies quality management for Regulators in Australia, Canada, the European Union,
medical device manufacturers and related Japan, and the United States use it. It is used with
organizations. This means a variety of companies modifications in the United Kingdom and by the Medical
in the medical device industry and pharmaceutical Device Single Audit Program.
supply chain use ISO 13485 standards.
Organizations that use this standard include: Many of the revisions made to ISO 13485 reflect its
importance to regulatory bodies. Among these revisions
• 
Manufacturers of medical devices are:
• 
Organizations that supply products or raw • 
Increased alignment with regulatory requirements
materials to medical device manufacturers
• 
Adjustment of software standards for measurement
• 
Quality management organizations that contract and reporting
to medical device manufacturers
• 
Additional requirements for verification and validation
• 
Organizations that provide services to medical planning
device manufacturers
• 
Increased emphasis on addressing consumer
• 
Makers of sterile medical devices complaints
• 
Manufacturers of surgical medical devices • 
Additional requirements for reporting to regulatory
A significant change in the 2016 update addressed authorities.
outsourcing. This update requires the organization These revisions are expected to ensure that
to ensure that companies it contracts with meet ISO 13485:2016 aligns more fully with regulatory
ISO 13485 standards when outsourcing the requirements for medical devices while still making certain
development, design, or servicing of a medical that ISO 13485 includes quality management requirements
device. from the ISO 9001 standard.
ISO standards are voluntary, so being certified as
ISO 13485 compliant isn’t always necessary. Europe
and Japan offer alternative national standards. On
the other hand, Canada requires class I, II and III
medical device manufacturers to achieve ISO 13485
certification.
Although certification isn’t required, it can provide
an advantage. Many countries base their regulatory
standards for medical devices on this standard.
Achieving either ISO 13485 or ISO 9001 certification
is seen as the first step to approval for a medical
device in Europe.

NQA/ISO13485/V1/MAR21
GETTING CERTIFIED FOR It’s also important to choose the right auditor to conduct
the audit. Since an audit is fundamentally an on-site
ISO 13485 verification of your quality management processes, look
for an auditor with a local presence. This can speed up
Getting certified for an ISO standard can be a difficult the auditing process and reduce problems that arise from
process. Preparation and good organization can make it language or cultural barriers.
less stressful.
Your auditor should also be experienced. For instance,
Understanding the requirements of ISO 13485 is a NQA has conducted more than 50,000 certifications in
good place to start. Your auditor will be referring to 90 different countries. This means that, when questions
these standards as they evaluate your organization. about logistics or the audit process arise, our experienced
Documenting and organising your quality management auditors can help you find the answer.
procedures is another important step.
When NQA audits a business, we work with your
Next, make sure employees as well as management processes and procedures. That means you won’t be
know the organization’s quality management processes. required to add processes that don’t work for your
Keeping everybody on the same page will help the audit business. Dedicated Customer Service representatives will
process go smoothly. ensure that you have feedback throughout the registration
It is often required to conduct an internal audit before process so that you can address questions that arise
conducting the external audit for certification. An internal during the auditing process quickly, and get back to work
audit can help you determine whether any changes need sooner.
to be made to your quality management system before
certification.

To speak to a member of the team or to get a quote

for certification visit www.nqa.com

50,000
CERTIFICATES
GLOBALLY
TRANSPARENT 90
www.nqa.com
NQA/ISO13485/V1/MAR21