ISO 13485-2016

Medical devices — Quality management systems — 
Requirements for regulatory purposes

This International Standard specifies requirements for a quality management system that can be used by
an organization involved in one or more stages of the life-cycle of a medical device, including design and
development, production, storage and distribution, installation, servicing and final decommissioning
and disposal of medical devices, and design and development, or provision of associated activities (e.g.
technical support). The requirements in this International Standard can also be used by suppliers or
other external parties providing product (e.g. raw materials, components, sub-assemblies, medical
devices, sterilization services, calibration services, distribution services, maintenance services) to such
organizations. The supplier or external party can voluntarily choose to conform to the requirements of
this International Standard or can be required by contract to conform.
Several jurisdictions have regulatory requirements for the application of quality management systems
by organizations with a variety of roles in the supply chain for medical devices. Consequently, this
International Standard expects that the organization:
— identifies its role(s) under applicable regulatory requirements;
— identifies the regulatory requirements that apply to its activities under these roles;
— incorporates these applicable regulatory requirements within its quality management system.
The definitions in applicable regulatory requirements differ from nation to nation and region to region.
The organization needs to understand how the definitions in this International Standard will be
interpreted in light of regulatory definitions in the jurisdictions in which the medical devices are made
available.
This International Standard can also be used by internal and external parties, including certification
bodies, to assess the organization’s ability to meet customer and regulatory requirements applicable
to the quality management system and the organization’s own requirements. It is emphasized that the
quality management system requirements specified in this International Standard are complementary
to the technical requirements for product that are necessary to meet customer and applicable
regulatory requirements for safety and performance.
The adoption of a quality management system is a strategic decision of an organization. The design and
implementation of an organization’s quality management system is influenced by the:
a) organizational environment, changes in that environment, and the influence that the organizational
environment has on the conformity of the medical devices;
b) organization’s varying needs;
c) organization’s particular objectives;
d) product the organization provides;
e) processes the organization employs;
f) organization’s size and organizational structure;
g) regulatory requirements applicable to the organization’s activities.
It is not the intent of this International Standard to imply the need for uniformity in the structure of
different quality management systems, uniformity of documentation or alignment of documentation to
the clause structure of this International Standard.
There is a wide variety of medical devices and some of the particular requirements of this International
Standard only apply to named groups of medical devices.

In this International Standard, the following terms or phrases are used in the context described below.
— When a requirement is qualified by the phrase “as appropriate”, it is deemed to be appropriate unless
the organization can justify otherwise. A requirement is considered appropriate if it is necessary for:
— product to meet requirements;
— compliance with applicable regulatory requirements;
— the organization to carry out corrective action;
— the organization to manage risks.
— When the term “risk” is used, the application of the term within the scope of this International
Standard pertains to safety or performance requirements of the medical device or meeting
applicable regulatory requirements.
— When a requirement is required to be “documented”, it is also required to be established,
implemented and maintained.
— When the term “product” is used, it can also mean “service”. Product applies to output that is
intended for, or required by, a customer, or any intended output resulting from a product realization
process.
— When the term “regulatory requirements” is used, it encompasses requirements contained in any
law applicable to the user of this International Standard (e.g. statutes, regulations, ordinances or
directives). The application of the term “regulatory requirements” is limited to requirements.