ISO 13485: how does standardization support medical device safety?

What is ISO 13485?

ISO 13485 is an international standard that sets requirements for quality management systems in the medical device sector. Its full title is Medical devices: Quality management systems: Requirements for regulatory purposes. It is intended for organizations that need to demonstrate their ability to provide devices and related services that meet customer requirements and applicable regulatory requirements. 1 

Organizations use it at different stages of the device life cycle, including design, manufacturing, installation and servicing. It can also be useful to suppliers and service providers working with manufacturers. 1  2 

ISO 13485:2016 is the current edition at the verification date. ISO states that it reviewed and confirmed the standard in 2025. Confirmation does not mean a new edition called "ISO 13485:2025" was published. 1 

Why does the way people work affect device safety?

Testing a finished product does not reveal its entire production history. The manufacturer also needs to know which material was accepted, which instruction people followed and whether the process ran under approved conditions.

ISO 13485 structures the processes needed to supply devices consistently. It covers management responsibility, resources, product realization, and measurement, analysis and improvement, among other areas. Compared with the general ISO 9001 standard, it places more emphasis on regulatory requirements specific to medical devices. 1  3 

One practical benefit is the ability to reconstruct decisions. If a company detects a nonconformity, it should be able to establish its extent and choose a response. A record that identifies the batches made under a particular instruction can narrow the investigation. Without that connection, determining which devices need checking becomes harder. This is an example of process control in use, rather than a claim that the standard alone will eliminate errors.

How does the standard relate to MDR obligations?

The law requires a quality management system

Article 10(9) MDR requires manufacturers of devices other than investigational devices to establish and maintain a quality management system. It defines the system’s scope, including the strategy for regulatory compliance, risk management, clinical evaluation, suppliers and post-market surveillance. 4 

ISO 13485 can provide a basis for organizing that system. The manufacturer must still check that it has addressed all applicable MDR requirements. Presenting a certificate to the standard does not demonstrate that a particular device’s documentation is complete or that its clinical data are sufficient.

A harmonised standard provides a limited presumption of conformity

The list of harmonised standards supporting MDR includes EN ISO 13485:2016 together with EN ISO 13485:2016/AC:2018 and EN ISO 13485:2016/A11:2021. The references were published under Commission Implementing Decision (EU) 2021/1182, which has subsequently been amended. 5 

Under Article 8 MDR, use of the relevant harmonised standards provides a presumption of conformity with the requirements of the Regulation covered by those standards or parts of them. The European informative Z annexes show the relationship. This is not a presumption of conformity with MDR as a whole. 4  6 

What should be controlled in practice?

The relationship between a quality system and safety is easiest to trace through processes that provide device data and allow the organization to respond to deviations. The examples below are practical applications of a process approach. Detailed requirements should be read in a licensed copy of the standard. 3 

Documents and records

A procedure describes how to carry out a task, while a record confirms what was actually done. A company needs both. A current instruction alone does not confirm that a particular batch was manufactured in accordance with it.

When a document changes, it helps to define the effective date, how the previous version will be withdrawn and who needs training. The operator, the person releasing the device and the auditor can then refer to the same version of the requirements.

Employee competence

An attendance list confirms participation in training. To assess readiness for independent work, it also helps to check whether the employee can perform the task. The method can be simple: observing the activity, discussing a problem scenario or reviewing completed records.

Choose a competence assessment method that fits the work and its risks. For a manual task, observing performance can provide information that a test of procedure knowledge will not show. The organization determines an assessment method appropriate to the task.

Suppliers and outsourced processes

Supplier controls should reflect the impact of the purchased material or service on the device. In practice, this means defining purchasing requirements, the supplier assessment method and the scope of checks on deliveries. A process entrusted to another organization still requires control by the manufacturer. 3  4 

Before changing a supplier, check whether the existing evidence remains appropriate. This is particularly relevant when a characteristic important to safety cannot be fully confirmed through routine checks on every unit.

Nonconformities and CAPA

CAPA stands for corrective and preventive action. Article 10(9)(l) MDR covers these actions and verification of their effectiveness. 4 

Correction of a detected problem might involve amending an incorrect record. Action addressing the cause requires the company to establish why the error occurred and what will prevent it from recurring. The company should then check the result in a way that relates to that cause, for example by reviewing subsequent records after an instruction changes.

What does this mean in practice? How can quality processes be connected?

Reviewing one problem from the initial report through to the effectiveness check helps assess whether processes actually connect. The review can follow this sequence:

Hypothetical example: recurring inspection errors

Which errors weaken the quality system?

A review should check whether the records are sufficient to justify decisions. A supplier assessment may look correct while omitting the very service the company plans to commission. In CAPA, confirmation that a task was completed must be distinguished from evidence that the action achieved the intended result.

During an audit, ask: "What was the basis for accepting this result?" The answer should identify the criterion, the data and the person who made the decision.

Paper, spreadsheets or an electronic system?

The choice of tool should follow the control needs. Paper makes it easy to start on a small scale, but requires controlled distribution. Files and spreadsheets allow efficient data analysis, while permissions, versions and connections need to be deliberately designed. An electronic system can organize the workflow, but needs configuration, implementation and an assessment of its suitability for the intended use.

Before buying, test an actual scenario: a requirement changes, an employee receives the information, and someone finds the evidence that the task was completed. This test helps show whether the solution fits the company’s process.

How does Neximed support selected processes?

The Neximed Training module provides a training plan and register, with effectiveness assessed by the participant and supervisor. The CAPA module covers root cause analysis, action plans, evidence of completion and effectiveness assessment.

These functions help organize work. The manufacturer decides on procedure content, acceptance criteria and whether the evidence is sufficient.

Where should an assessment of your own system begin?

Verified on October 15, 2026. Educational material concerning quality systems and the EU market. This discussion paraphrases publicly available information and does not replace a licensed copy of ISO 13485 or an assessment of a particular system.