ISO 13485

The standard is intended for organizations throughout the entire medical device value chain – manufacturers, component suppliers, and service providers such as sterilization facilities or distribution organizations. It is applicable regardless of industry or size – from small medical technology startups to international corporations – and is expected by nearly all European Notified Bodies to serve as the basis for conformity assessment.

• Risk management: systematic application throughout the entire product life cycle, in accordance with ISO 14971

• Design and development control: documented validation and verification of new and modified products

• Traceability: seamless traceability of batches, components, and test records down to the individual product

• Change control: formal evaluation and approval process for every change to processes or products

• Device History Record (DHR): complete, tamper-proof record of all manufacturing and testing steps

• Regulatory documentation: documentation that is directly incorporated into regulatory approval procedures

ISO 13485 adopts the basic structure of ISO 9001 but deliberately omits certain general requirements – such as the systematic measurement of customer satisfaction – and instead supplements it with industry-specific requirements for risk management, product safety, and regulatory traceability, which are mandatory for medical devices. Compared to the MDR, ISO 13485 is a voluntary standard for quality management systems, whereas the MDR is directly applicable EU law that additionally governs specific product requirements and the conformity assessment procedure for CE marking. ISO 13485 certification does not replace MDR compliance, but in practice it serves as the most important basis for demonstrating such compliance.

Without valid ISO 13485 certification, obtaining CE marking under the MDR is virtually impossible in practice, which completely blocks market access in the EU. For existing certifications, nonconformities identified during surveillance audits lead to corrective actions; in the event of a recurrence, the certificate may be suspended or revoked – with immediate consequences for market authorization and potential field safety corrective actions for products that have already been shipped.

• MDR – EU Medical Device Regulation 2017/745

• ISO 9001 – basic quality management standard

• FDA 21 CFR Part 820 – U.S. quality management requirements for medical devices

• IVDR – EU regulation on in vitro diagnostic medical devices