Select your ISO 13485 Auditor Course

What is ISO 13485?

ISO 13485 is an international standard that specifies requirements for a quality management system; however, unlike general quality standards, ISO 13485 is tailored to the highly regulated nature of medical devices, aligning quality management practices with global regulatory expectations. These include processes involved in the design, development, production, installation, and servicing of medical devices.

Historically, ISO 13485 was initially published in 1996 as ISO 13485:1996 and revised in 2003.  Associated standards since replaced by ISO 13485 include ISO 13488, EN 46001, and EN 46002.  The EU has adopted the current Standard as a harmonized standard with the title EN ISO 13485:2016. 

How does ISO 13485:2016 differ from ISO 13485:2012?

Compared to ISO 13485:2012, the 2016 version places greater emphasis on risk management and risk-based decision-making for processes outside the realm of product realization.

This version, like its predecessor, requires the application and documentation of risk management to the control of the appropriate processes. This is not to be confused with the ‘risk-based approach’ of ISO 9001:2015.

The focus is on risks associated with the safety and performance of medical devices and compliance with regulatory requirements. In addition, the Standard asks organizations to be more stringent when it comes to outsourcing processes by putting into place controls (e.g., written agreements) for assessing their suppliers, again based on risk.

How else do the ISO 13485:2016 versions differ from the previous one?

ISO 13485:2016 incorporates significant changes to quality management systems requirements for medical devices, including…

• Application to organizations throughout the life cycle and supply chain for medical devices;
• Expanded requirements for…
  • document management,
  • management review, and
  • human resources;
• Emphasis on appropriate infrastructure, work environment, and contamination control, particularly for the production of sterile medical devices, and addition of requirements for validation of sterile barrier properties;
• Additional requirements for…
  • planning, and
  • record keeping;
• Increased linkage and communication with regulatory requirements, particularly for regulatory documentation;
• Additional requirements in design and development on consideration of usability, use of standards, verification and validation planning, design transfer, and design records;
• Harmonization of the requirements for software validation for different software applications (QMS software, process control software, software for monitoring and measurement) in different clauses of the standard;
• Emphasis on complaint handling and reporting to regulatory authorities in accordance with regulatory requirements, consideration of post-market surveillance, and
• Planning and documenting corrective action and preventive action and implementing corrective action without undue delay.

Other changes include more explicit detail related to the nature of the organization and the life-cycle stages covered by ISO 13485 QMS.

It contains requirements related to the control of changes to processes. The standard also addresses new requirements to protect confidential health information.

What is the difference between ISO 13485:2016 and EN ISO 13485:2016?

The harmonized EN edition is identical word-for-word with the international edition. However, it contains three additional annexes identifying where compliance with the Standard does not adequately address requirements in EU Directives.

These three ISO 13485 Annex Z’s provide greater clarity on the applicability and alignment of the current AIMDD (active implantable medical device directive), MDD (medical device directive), and IVDD (in vitro medical device directive) with the Standard.

How can changes in the ISO 13485:2016 versions affect organizations?

The structural relationship between ISO 13485:2016 and ISO 9001:2015 is outlined in Annex B.

The mismatch between the two Standards is clearly to be seen, and those manufacturers and suppliers who require certification to both Standards are advised to have two Quality Manuals, one for each Standard, to show how quality policy will address the differing requirements. An integrated set of procedures can then implement the policies across the common processes.

That said, ISO 13485 training is strongly recommended as effective internal audits are essential to doing a professional job in maintaining your Medical Device Management System and preparing it for Certification Body audits.