skills/iso-13485-certification/references/iso-13485-requirements.md
Research basis: 2026-07-23. This reference summarizes a preparation process and evidence architecture. It does not reproduce ISO requirements and is not a substitute for the standard.
ISO publications are copyrighted. Obtain ISO 13485 and related standards from ISO, an ISO national member, or another authorized source. ISO states that unauthorized copying, scanning, or distribution is prohibited; see ISO copyright. Do not ask an agent to retrieve, transcribe, summarize clause-by-clause, or store proprietary text.
For the U.S. QMSR incorporation by reference, FDA identifies read-only access through the ANSI IBR portal in its QMSR FAQ. That access does not remove copyright or permit copying.
Record exact publisher, title, edition, amendment/corrigendum, authorized location, access date, source owner, currency-review date, impact decision, and approval.
This skill and its files cannot:
Use outputs as a list of evidence questions for accountable human review.
A certification body audits the defined QMS scope against the authorized standard and its certification scheme. The certificate is limited to its stated organization, sites, activities, products/technical areas, standard edition, and validity. Certification is not FDA approval, an FDA inspection exemption, an MDSAP audit, an EU device certificate, or a legal-applicability decision.
For accredited ISO 13485 certification, verify the certification body's accreditation scope. As of 2026, Global Accreditation Cooperation Incorporated has replaced IAF and ILAC operationally. Its document library carries IAF MD 8:2023 and IAF MD 9:2023 while successor documents are developed. These documents concern accreditation and certification-body practice, not product authorization.
The QMSR became effective 2026-02-02 and FDA began enforcement on that date. The current 21 CFR Part 820 is titled Quality Management System Regulation. It incorporates ISO 13485:2016 and contains FDA scope, definitions, incorporation, QMS, record, and labeling/packaging provisions. Other applicable FDA requirements still matter.
On 2026-02-02 FDA stopped using QSIT and began the inspection process in Compliance Program 7382.850. This is now a post-effective-date implementation state, not a future transition. FDA may inspect QMS records created before the effective date and records that had previously been exempt from routine review under the old regulation, as explained in the QMSR FAQ.
Do not use the former 21 CFR 820 section structure as a current requirements map. Inventory legacy QSR/QSIT references, disposition them under change control, and use the current eCFR, incorporated edition, and linked current FDA regulations.
MDSAP is a regulatory audit conducted by an MDSAP-recognized Auditing Organization for participating jurisdictions. The current official MDSAP Audit Approach is MDSAP AU P0002.010, version date 2026-02-02. It uses a process-based approach and includes jurisdiction-specific requirements.
An ISO certificate alone is not an MDSAP audit. FDA inspections under QMSR do not follow the MDSAP audit plan, and FDA does not issue ISO 13485 certificates. MDSAP participation does not eliminate every possible regulatory inspection or product-specific obligation.
The MDR and IVDR impose legal obligations beyond a generic QMS. Use the current consolidated regulation and current, product-specific conformity route:
Notified bodies are designated by Member States for specified legislation, conformity-assessment tasks, and designation codes. Verify current scope in NANDO. Accreditation or ISO certification does not by itself confer notified-body designation or establish EU product conformity.
Product classification, intended purpose, claims, software, cybersecurity, clinical or performance evidence, biocompatibility, electrical safety, sterilization, UDI, registration, reporting, and other controls depend on the device and jurisdiction. Manage these in a separately approved applicability matrix. Never assume this framework is complete for a product.
The domains below are workflow topics, not clause text. An authorized standard copy and jurisdiction-specific sources remain the audit criteria.
Evidence should identify legal entities, sites, products/families, lifecycle activities, outsourced processes, markets considered, interfaces, top-management authority, management representative, RA/QA ownership, delegates, independence, and escalation. Every applicability or not-applicable decision needs a named owner, rationale, source/version, evidence, date, and approval.
Control authoring, review, approval, effective use, distribution, revision, obsolescence, external sources, retention, integrity, security, retrieval, correction, audit trails, backup/recovery, and disposition. Preserve source/version evidence and license restrictions. Link changes to training and validation before effective use.
Integrate product and process risk with intended use, design, suppliers, production, software, validation, complaints, postmarket data, CAPA, and change control. ISO 14971:2019, Edition 3, was confirmed in 2025. For EU work, distinguish EN ISO 14971:2019/A11:2021; the A11 amendment is European and does not replace a product-specific legal analysis.
Maintain approved planning, responsibilities, inputs, outputs, review, verification, validation, transfer, changes, and traceability. Evidence should show that risk controls and postmarket learning feed the design/change system. A claimed not-applicable design process requires authorized scope and regulatory review.
Use risk-based selection, evaluation, controls, purchasing information, acceptance, change notification, sub-tier flow-down, monitoring, re-evaluation, nonconformity/CAPA, and business-continuity evidence. Outsourcing does not transfer the organization's accountability for its controlled process.
Define infrastructure, work environment, contamination/cleanliness where relevant, controlled instructions, acceptance/release, labeling/packaging, preservation, installation, servicing, process validation, monitoring/measurement equipment, and change/revalidation triggers. Evidence must be product/process-specific.
Record intended use, risk, requirements, configuration, access, data integrity, verification/validation, acceptance, release, incident handling, backup/recovery, supplier controls, and change/revalidation. A software inventory or vendor certificate alone is not validation.
Define the required extent using approved product and jurisdictional decisions. Link materials/components, process records, acceptance/release, distribution, servicing, complaints, corrections/removals, and postmarket records as applicable.
Control intake, evaluation, investigation, product/risk impact, trend analysis, reportability decisions, communications, advisory/field actions, and feedback to risk, design, production, suppliers, CAPA, and management review. Authorized roles must make jurisdiction-specific reporting decisions.
Separate correction/containment from cause-directed action. Preserve scope, risk and reportability review, investigation, supported cause or conclusion, action ownership, change links, implementation evidence, pre-defined effectiveness criteria, independent review, and closure approval. Pending or ineffective checks cannot support closure.
Use a risk-based audit program, objective criteria/scope/sampling, competent and independent auditors, findings, corrections/CAPA, and effectiveness follow-up. Management review should use controlled inputs and record decisions, resources, actions, owners, dates, and follow-up. Neither activity can be replaced by a checklist-generated score.
Define role competence, training need, completion, effectiveness, authorization, and records. Changes should assess source/version, product/risk, validation, software, supplier, document, record, training, postmarket, regulatory, and certification/audit impacts before implementation.
For each domain, require:
Use references/source-ledger.md for the dated official-source baseline.