ISO 13485, Medical devices – Quality management systems – Requirements for regulatory purposes, addresses the development, implementation and maintenance of a quality management system intended for use by medical device manufacturers and suppliers. Originally developed in the 1990s, the standard details requirements for a quality management system that meets both customer requirements and regulations in the European Union (EU), Canada and other major jurisdictions around the world. ISO 13485 is similar in scope and intent to ISO 9001, but it includes additional requirements specific to medical devices while excluding certain ISO 9001 provisions. Therefore, in most jurisdictions, ISO 9001 certification is not an acceptable substitute for certification to the requirements of ISO 13485.
ISO 13485:2016 specifies requirements for a quality management system where an organization needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements. Such organizations can be involved in one or more stages of the life-cycle, including design and development, production, storage and distribution, installation, or servicing of a medical device and design and development or provision of associated activities (e.g. technical support). ISO 13485:2016 can also be used by suppliers or external parties that provide product, including quality management system-related services to such organizations.
Requirements of ISO 13485:2016 are applicable to organizations regardless of their size and regardless of their type except where explicitly stated. Wherever requirements are specified as applying to medical devices, the requirements apply equally to associated services as supplied by the organization.
The processes required by ISO 13485:2016 that are applicable to the organization, but are not performed by the organization, are the responsibility of the organization and are accounted for in the organization’s quality management system by monitoring, maintaining, and controlling the processes.
If applicable regulatory requirements permit exclusions of design and development controls, this can be used as a justification for their exclusion from the quality management system. These regulatory requirements can provide alternative approaches that are to be addressed in the quality management system. It is the responsibility of the organization to ensure that claims of conformity to ISO 13485:2016 reflect any exclusion of design and development controls.
If any requirement in Clauses 6, 7 or 8 of ISO 13485:2016 is not applicable due to the activities undertaken by the organization or the nature of the medical device for which the quality management system is applied, the organization does not need to include such a requirement in its quality management system. For any clause that is determined to be not applicable, the organization records the justification as described in 4.2.2.
The adoption of a quality management system is a strategic decision of an organization. The design and implementation of an organization’s quality management system is influenced by the:
- Organizational environment, changes in that environment, and the influence that the organizational environment has on the conformity of the medical devices;
- Organization’s varying needs;
- organization’s particular objectives;
- product the organization provides;
- processes the organization employs;
- organization’s size and organizational structure;
- Regulatory requirements applicable to the organization’s activities.