An ISO 13485 quality management system is the documented set of processes a medical device organisation uses to show that its devices consistently meet customer and regulatory requirements. ISO 13485:2016 is still the current edition: ISO reviewed and confirmed it in 2025, and since 2 February 2026 the US FDA's Quality Management System Regulation (QMSR) incorporates it by reference.
This guide is for quality and regulatory managers at device manufacturers, contract manufacturers and their suppliers.
What is ISO 13485:2016 and is it still current?
ISO 13485:2016 is the third edition of the standard, published in March 2016 by ISO technical committee ISO/TC 210. The ISO 13485:2016 page on iso.org shows it at stage 90.93, confirmed, after its 2025 review. ISO reviews each standard every five years, and no newer edition is listed.
Its requirements sit in clauses 4 to 8. They cover the documented system and its records, management responsibility, resources, product realisation (including design and development in clause 7.3), and measurement, analysis and improvement (including complaint handling in clause 8.2.2).
The publication of ISO 9001:2026 does not change ISO 13485. It is a standalone standard, and ISO 13485:2016 remains the version that certification bodies, regulators and MDSAP auditors use.
Who has to implement an ISO 13485 QMS?
ISO describes the standard as intended for any organisation involved in the design, production, installation or servicing of medical devices and related services. It also applies to suppliers and external parties that provide product or QMS-related services to those organisations.
In practice that includes legal manufacturers, contract manufacturers, contract sterilisers, distributors and component suppliers. The standard itself is voluntary. What makes it necessary is the market. Regulators, notified bodies and large customers commonly ask for it as evidence of a controlled device business.
Component makers have a specific position in the United States. Part 820 says it does not apply to manufacturers of components or parts of finished devices, although FDA encourages them to consider it. Your device customers may still require an ISO 13485 certificate in the supply contract.
What changed when the FDA QMSR replaced the QSR on 2 February 2026?
FDA published the QMSR final rule on 2 February 2024 and it took effect on 2 February 2026. It replaced the Quality System Regulation that had applied since 1997, and FDA inspections moved from QSIT to compliance programme 7382.850. The details are on FDA's QMSR page.
21 CFR 820.10 now requires a documented QMS that complies with ISO 13485:2016, plus a short list of US additions. Those additions are where an ISO 13485 system written for Europe often falls short:
- Identification (clause 7.5.8) must follow the US unique device identification rules in Part 830, and the UDI must be recorded for each device or batch.
- Complaint records must capture set fields, including the device name, date received, UDI, complainant details, the corrective action and any reply.
- Servicing records must show the device, UDI, date, who serviced it, the work done and the test data.
- Reportable complaints follow Part 803, and advisory notices follow Part 806.
- Section 820.45 requires labelling and packaging to be inspected for accuracy before release, with the result recorded.
Two other changes matter on inspection day. FDA can now inspect management review, internal audit and supplier audit reports, which the old QSR exempted. FDA's QMSR FAQ also says it will not require or issue ISO 13485 certificates, and a certificate does not exempt a site from inspection.
The regulation also dropped the old QSR record names. Part 820 no longer refers to a design history file, device master record or device history record, and it points to the medical device file instead. If your procedures still use the old names, map each record to the ISO 13485 requirement it now evidences.
How do ISO 13485, the EU MDR and MDSAP fit together?
In the European Union, Article 10(9) of the Medical Devices Regulation (EU) 2017/745 requires every manufacturer of non-investigational devices to run a QMS proportionate to the risk class. The MDR has applied since 26 May 2021. EN ISO 13485:2016, with its 2018 corrigendum and its A11:2021 amendment, is listed as a harmonised standard under the MDR in Implementing Decision (EU) 2021/1182.
Article 10(9) lists thirteen aspects the QMS must address. Several go further than ISO 13485 alone: a strategy for regulatory compliance, identification of the general safety and performance requirements, clinical evaluation including post-market clinical follow-up, UDI verification, a post-market surveillance system and vigilance reporting.
The Medical Device Single Audit Program (MDSAP) lets one audit serve five regulators: Australia's TGA, Brazil's ANVISA, Health Canada, Japan's MHLW and PMDA, and the US FDA. FDA says it may accept MDSAP audit reports in place of routine inspections. Gulf regulators set their own registration rules, so confirm with each authority which certificates it accepts.
Which records prove each requirement?
An auditor tests the system by asking for records, not by reading the manual. The table lists the records most often requested. The record column is AGS's practical interpretation, not wording from the standard or the regulation.
| Requirement | Reference | Records that show it works |
|---|---|---|
| Control of records | ISO 13485 clause 4.2.5 | Master list of records, retention periods, approved record templates |
| Design and development | Clause 7.3 (US: class II, III and some class I devices, 820.10(c)) | Design plan, design review minutes, verification and validation reports, design transfer and change records |
| Production and process validation | Clause 7.5, including its process validation subclauses | Batch records, IQ, OQ and PQ protocols, sterilisation validation, environmental monitoring |
| Identification and traceability | Clauses 7.5.8 and 7.5.9 (US: Part 830, 820.35(c)) | UDI assignment, traceability records, implant traceability where it applies |
| Servicing | Clause 7.5.4 (US: 820.35(b)) | Service reports with device, UDI, date, technician, work done and test data |
| Complaints and reporting | Clauses 8.2.2 and 8.2.3 (US: 820.35(a), Part 803) | Complaint file, investigation or justification for none, regulatory reports |
| Labelling and packaging | Clause 7.5.1 (US: 820.45) | Label inspection and release records, line clearance checks |
Risk management runs through all of these. The device-specific standard is ISO 14971:2019, which ISO also confirmed in 2025. In practice, keep a risk management file for each device that links its hazards to design outputs and production controls.
Do you also need ISO 9001, ISO 31000 or ISO/IEC 17020?
Not for ISO 13485 certification. Some manufacturers run an integrated system because a customer asks for ISO 9001 as well. If you do, plan for ISO 9001:2026, which replaced the 2015 edition in September 2026. Our ISO 9001:2026 transition guide covers the dates.
ISO 31000:2018 gives general guidance on organisational risk, such as supply, financial or business continuity risk. It is not certifiable and it does not replace ISO 14971 for product risk. Our guide to ISO 31000 and IEC 31010 explains how the general framework works.
ISO/IEC 17020 is different again. It sets requirements for inspection bodies, and the current edition, ISO/IEC 17020:2026, was published in March 2026. A manufacturer needs it only if part of the organisation runs an inspection service whose impartiality must be shown, for example inspecting devices for others. Our ISO/IEC 17020 guide covers that case.
How AGS can help
AGS has two kits for device quality systems, both in editable Microsoft Word:
- ISO 13485-2016-Medical QMS: 102 documents, including a quality manual, procedures, design, risk and sterilisation validation forms, and a clause-wise audit questionnaire.
- IMS Medical Device Manufacturing (ISO 13485, ISO 9001, ISO/IEC 17020, ISO 31000): 64 documents, including UDI, vigilance and recall procedures and audit checklists for each standard.
Frequently asked questions
Is ISO 13485 mandatory?
The standard is voluntary, but regulators build on it. The US QMSR incorporates it by reference, and EN ISO 13485 is listed as a harmonised standard under the EU MDR.
Does FDA accept an ISO 13485 certificate instead of an inspection?
No. FDA says a certificate does not exempt a manufacturer from inspection. It may accept MDSAP audit reports in place of routine inspections.
Is there a newer edition than ISO 13485:2016?
No. ISO confirmed the 2016 edition in 2025, so it remains current.
Can a document kit make a company certified?
No. Only a certification body can certify the organisation, after auditing a system that is implemented and producing records.
AGS provides independent documentation toolkits. This guide and the referenced kits are prepared to support ISO 13485, FDA QMSR and EU MDR requirements. They are not affiliated with, endorsed by or approved by ISO, the US FDA, the European Commission, any MDSAP regulator or any certification body, and they do not guarantee any audit, inspection or certification outcome.
Reviewed October 2026. Facts checked against the sources current at publication.
