_1762866128417-DS2_OO1j.png)
How ISO 13485 differs from ISO 9001
ISO 13485 is the international standard for quality management systems in the medical device industry. It applies to manufacturers as well as to suppliers, contract manufacturers, sterilisation service providers or distributors that are part of the supply chain. Unlike ISO 9001, it does not aim at continual customer satisfaction but at safe and effective products and meeting regulatory requirements.
The current edition, ISO 13485:2016, does not yet follow the Harmonized Structure of other ISO standards, so its clause numbers differ from ISO 9001. In many respects it is stricter: more procedures must be documented, risk management runs through the entire product lifecycle, and computerised systems used in the QMS must be validated.
| Topic | ISO 9001 | ISO 13485 |
|---|---|---|
| Goal | Customer satisfaction and improvement | Safe, effective products and regulatory compliance |
| Documented procedures | Few explicitly required | Many procedures explicitly required |
| Risk management | Risk-based thinking | Product risk management across the lifecycle, usually per ISO 14971 |
| Software in the QMS | No specific requirement | Validation of computerised systems (4.1.6) |
| Medical device file | Not applicable | Required per product or product family (4.2.3) |
Key requirements
- 4 Quality management system: define the organisation's role, control processes based on risk, validate software, maintain the medical device file, control documents and records.
- 5 Management responsibility: quality policy, quality objectives, management representative, management review with defined inputs.
- 6 Resource management: competence and training with evidence of effectiveness, infrastructure, work environment and contamination control.
- 7 Product realisation: risk management, design and development with verification, validation and design transfer, purchasing, production, labelling and traceability.
- 8 Measurement, analysis, improvement: feedback, complaint handling, reporting to authorities, internal audit, control of nonconforming product, corrective and preventive action.
How docxpert supports your ISO 13485 system
Documented procedures auditors expect
ISO 13485 requires a documented procedure in many places. This selection shows the procedures auditors ask about most often:
| Procedure | Clause |
|---|---|
| Control of documents and records | 4.2.4, 4.2.5 |
| Validation of software used in the QMS | 4.1.6 |
| Competence, training and awareness | 6.2 |
| Design and development including design transfer and changes | 7.3 |
| Purchasing and supplier evaluation | 7.4 |
| Traceability | 7.5.8 |
| Complaint handling and reporting to regulatory authorities | 8.2.2, 8.2.3 |
| Internal audit | 8.2.4 |
| Control of nonconforming product | 8.3 |
| Corrective and preventive action | 8.5.2, 8.5.3 |
Thinking ISO 13485, EU MDR and ISO 14971 together
For manufacturers placing products on the EU market, ISO 13485 is the usual way to implement the QMS required by Article 10 of the EU MDR. Product risk management in practice follows ISO 14971. In docxpert, templates contain shared sections for this: a medical device file template covers both clause 4.2.3 of ISO 13485 and Annexes II and III of the MDR.
For the US market, the same templates are mapped to FDA regulation 21 CFR 820, which references ISO 13485 since the QMSR transition. That way you build one system that serves several markets.
From project to certificate
- 1
Define role and scope
Manufacturer, supplier or service provider? Which products, sites and outsourced processes are included? Non-applicable requirements are excluded with a justification.
- 2
Run a gap analysis
Upload or import existing documents and check them against the requirements of the standard.
- 3
Build procedures and files
Create missing procedures from templates, set up medical device files and assign owners.
- 4
Implement and collect evidence
Deliver trainings, evaluate suppliers, record deviations and complaints – run the system for at least a few months before the audit.
- 5
Internal audit and management review
Both are mandatory before the certification audit. Findings are handled as CAPAs.
Practical tips
- Group product families: one medical device file per product family reduces effort when products differ only slightly.
- Assess complaints early: define when a complaint is reportable and document the decision even when no report is made.
- Control suppliers based on risk: critical suppliers need stricter controls than suppliers of non-critical parts.
- Plan training effectiveness: decide how you will demonstrate effectiveness when you plan the training.
Medical technology companies will also find the industry page Medtech useful.
Frequently asked questions
Do I need ISO 13485 if I comply with the MDR?
The MDR requires a QMS but does not explicitly mandate ISO 13485. As a harmonised standard, however, it is the usual way to demonstrate conformity, and notified bodies expect it in practice.
Do I have to validate docxpert myself?
Yes. ISO 13485 4.1.6 requires validating software used in the QMS for your specific intended use. docxpert supports you with a template; the validation itself is your responsibility.
Can suppliers use ISO 13485?
Yes. Suppliers, contract manufacturers and service providers can also be certified and define their role in the supply chain.
Does docxpert support electronic signatures under 21 CFR Part 11?
docxpert records approvals with person, time and audit trail. Whether that is sufficient for your Part 11 requirements is part of your validation; a template on electronic records and signatures helps with the assessment.
How are ISO 13485 and ISO 14971 related?
ISO 13485 requires risk management in product realisation; ISO 14971 describes how to carry it out. In practice both are applied together.
How should an organisation define the scope of its ISO 13485 system?
Start with your actual role in the supply chain: design, manufacture, sterilisation, distribution and other activities can bring different requirements. Then describe product families, sites, outsourced processes and the boundaries of your responsibility. Include externally performed work when you still control or verify its outcome. Justify exclusions against applicable requirements rather than making them for organisational convenience. Agree the scope with product and regulatory owners, and use the same boundaries in objectives, procedures and external statements. Revisit the description when your portfolio, outsourcing or responsibilities change. A precise scope helps teams collect relevant evidence without uncritically taking on requirements intended for a different role.