scientific-skills/iso-13485-certification/references/mandatory-documents.md
This document provides a complete list of all mandatory documents and records required by ISO 13485:2016 for medical device Quality Management Systems.
ISO 13485:2016 requires organizations to establish and maintain 31 documented procedures along with a Quality Manual and Medical Device Files. Additionally, numerous records must be maintained to provide evidence of conformity.
Important Notes:
Description: Foundational QMS document
Must Include:
Applicable To: All organizations
Description: File for each medical device type or family
Must Include:
Applicable To: All organizations for each device type/family
Description: Requirements for risk management throughout product realization Must Address:
Description: Validation of computer software applications used in QMS Must Address:
Description: Control of all QMS documents Must Address:
Description: Control of all QMS records Must Address:
Description: Systematic review of QMS by top management Must Address:
Description: Communication regarding QMS effectiveness Must Address:
Description: Ensuring personnel competence Must Address:
Description: Maintenance of facilities and equipment (when affecting quality) Must Address:
Description: Control of contaminated or potentially contaminated product (when applicable) Must Address:
Description: Communication with customers Must Address:
Description: Control of design and development process Must Address:
Description: Control of purchasing process Must Address:
Description: Verification that purchased product meets requirements Must Address:
Description: Control of production and service activities Must Address:
Description: Control of product cleanliness (when applicable) Must Address:
Description: Installation activities (when applicable) Must Address:
Description: Servicing activities (when applicable) Must Address:
Description: Validation of processes where output cannot be verified Must Address:
Description: Validation of sterilization processes (when applicable) Must Address:
Description: Identification and traceability throughout realization Must Address:
Description: Control of customer-provided property Must Address:
Description: Product preservation during processing and delivery Must Address:
Description: Calibration and control of measuring equipment Must Address:
Description: Post-production information system Must Address:
Description: Timely handling of complaints Must Address:
Description: Notification to regulatory authorities Must Address:
Description: Conduct of internal audits Must Address:
Description: Monitoring and measurement of QMS processes Must Address:
Description: Monitoring and measurement of product Must Address:
Description: Identification and control of nonconforming product Must Address:
Description: Elimination of causes of nonconformities Must Address:
Description: Elimination of causes of potential nonconformities Must Address:
While not explicitly called out as requiring a "documented procedure," organizations must establish processes for:
| Clause | Document Type | Document Name | Mandatory? | Records Required? |
|---|---|---|---|---|
| 4.2.2 | Manual | Quality Manual | Yes | No |
| 4.2.3 | File | Medical Device File | Yes (per device) | Yes |
| 4.1.5 | Procedure | Risk Management | Yes | Yes |
| 4.1.6 | Procedure | Software Validation | Yes | Yes |
| 4.2.4 | Procedure | Control of Documents | Yes | No |
| 4.2.5 | Procedure | Control of Records | Yes | No |
| 5.5.3 | Procedure | Internal Communication | Yes | No |
| 5.6.1 | Procedure | Management Review | Yes | Yes |
| 6.2 | Procedure | Competence/Training | Yes | Yes |
| 6.3 | Procedure | Infrastructure Maintenance | When applicable | Yes |
| 6.4.2 | Procedure | Contamination Control | When applicable | Yes |
| 7.2.3 | Procedure | Customer Communication | Yes | Yes |
| 7.3.1-10 | Procedures | Design and Development | When applicable | Yes |
| 7.4.1 | Procedure | Purchasing | Yes | Yes |
| 7.4.3 | Procedure | Verification of Purchased Product | Yes | Yes |
| 7.5.1 | Procedures | Production Control | Yes | Yes |
| 7.5.2 | Procedure | Product Cleanliness | When applicable | Yes |
| 7.5.3 | Procedure | Installation | When applicable | Yes |
| 7.5.4 | Procedure | Servicing | When applicable | Yes |
| 7.5.6 | Procedure | Process Validation | When applicable | Yes |
| 7.5.7 | Procedure | Sterilization Validation | When applicable | Yes |
| 7.5.8 | Procedure | Product Identification | Yes | Yes |
| 7.5.9 | Procedure | Traceability | Yes | Yes |
| 7.5.10 | Procedure | Customer Property | When applicable | Yes |
| 7.5.11 | Procedure | Preservation of Product | Yes | Yes |
| 7.6 | Procedure | Control of M&M Equipment | Yes | Yes |
| 8.2.1 | Procedure | Feedback | Yes | Yes |
| 8.2.2 | Procedure | Complaint Handling | Yes | Yes |
| 8.2.3 | Procedure | Regulatory Reporting | Yes | Yes |
| 8.2.4 | Procedure | Internal Audit | Yes | Yes |
| 8.2.5 | Procedure | Process Monitoring | Yes | Yes |
| 8.2.6 | Procedure | Product Monitoring | Yes | Yes |
| 8.3 | Procedure | Control of Nonconforming Product | Yes | Yes |
| 8.4 | Process | Analysis of Data | Yes | Yes |
| 8.5.2 | Procedure | Corrective Action | Yes | Yes |
| 8.5.3 | Procedure | Preventive Action | Yes | Yes |
While not explicitly required by ISO 13485, the following documents are commonly needed for effective QMS operation and regulatory compliance:
Multiple procedures can be combined into single documents, such as:
Not all procedures apply to all organizations. Common exclusions include:
All exclusions must be justified in the Quality Manual.
Remember that applicable regulatory requirements may mandate additional documentation beyond ISO 13485, including:
Per ISO 13485:2016 (4.2.5), records must be retained for:
Organizations must define the "lifetime" of their medical devices and establish retention times that meet or exceed:
With FDA QMSR harmonization (effective February 2, 2026), organizations should prepare for transitioning from separate files to a unified Medical Device File (MDF) that replaces:
The MDF approach aligns with ISO 13485:2016 requirements and provides a more unified documentation structure.