ISO 13485 Certification: Requirements, Process, and Checklist

TL;DR

• ISO 13485:2016 defines quality management system (QMS) requirements for organizations involved in medical devices and related services.
• Certification preparation involves defining scope, implementing documented controls, managing risk, training staff, and completing internal audits and management review.
• An independent certification body assesses the QMS; certification is not the same as FDA clearance or authorization to market a medical device.
• Digital systems can help organize quality records, traceability, and audit evidence, but software alone does not establish conformity or guarantee certification.

ISO 13485 certification demonstrates that an organization's quality management system has been assessed against the applicable requirements of ISO 13485. The standard is designed for the medical-device industry and organizations involved in activities such as design, production, storage, distribution, installation, servicing, and related support.

Certification can be relevant to manufacturers, suppliers, contract manufacturers, and other organizations in the medical-device supply chain. Whether certification is required depends on applicable regulations, customer contracts, market expectations, and the organization's role.

The practical challenge is not simply documenting procedures. Teams need to show that approved processes are followed, records are reliable, risks are assessed, changes are controlled, and issues lead to appropriate corrective action.

What Is ISO 13485 Certification?

ISO 13485:2016 is an international standard for quality management systems in the medical-device sector. It establishes requirements intended to help organizations consistently meet customer and applicable regulatory requirements.

Certification is an independent third-party assessment of an organization's QMS within a defined scope. The certificate does not automatically establish that every device is approved for sale in every market.

Who may need ISO 13485 certification?

It may be relevant to organizations involved in:

• Medical-device design and development
• Manufacturing, assembly, and production
• Contract manufacturing and outsourced production
• Storage, distribution, installation, and servicing
• Components, materials, and services supplied to medical-device organizations

The exact scope depends on the organization's activities, locations, products, and applicable requirements.

Is ISO 13485 certification mandatory?

The standard itself does not make third-party certification universally mandatory. However, certification may be expected or required by customers, contracts, procurement requirements, or specific regulatory and market-access arrangements.

Organizations should confirm the requirements applicable to their products and target markets rather than assuming that certification alone satisfies every regulatory obligation.

ISO 13485 Certification Requirements

Preparing for certification means translating the standard's applicable requirements into working processes, assigned responsibilities, and objective evidence. The precise requirements depend on the organization's scope and activities.

1. Quality management system and documentation

Organizations need a defined QMS with appropriate policies, procedures, responsibilities, and records. Documentation should reflect how work is actually performed - not just describe an intended process.

A practical review should check whether procedures are approved, current versions are available to the people who need them, changes are controlled, and completed records can be retrieved when required.

2. Risk management and product realization

Risk management should be integrated into relevant product and process activities. Depending on the organization's role, this may include design and development controls, production planning, supplier controls, verification or validation activities, and monitoring throughout the product lifecycle.

Teams should be able to connect identified risks with the decisions, controls, and records used to address them. The level of evidence needed depends on the process and applicable requirements.

3. Supplier controls, traceability, and records

Organizations need controls appropriate to externally provided products and services. Where applicable, records should support traceability between materials, components, production activities, inspection results, nonconformities, and relevant product or batch identifiers.

For laboratory and testing workflows, the same operational principle applies: teams should be able to understand where data came from, what changed, which procedure or instrument was involved, and which records support the reported result.

4. Competence, internal audits, and corrective action

Personnel performing work that affects quality need appropriate competence, and organizations should maintain relevant training and competence records.

Internal audits help determine whether the QMS conforms to planned arrangements and applicable requirements. When problems are identified, the organization should document the issue, investigate its cause as appropriate, implement corrective action, and assess whether that action was effective.

Management review provides a structured way to evaluate QMS performance and determine whether further action or resources are needed.

How to Get ISO 13485 Certification: Step by Step

The timeline depends on the organization's size, operational complexity, existing QMS maturity, scope, and the availability of audit resources. These steps provide a practical starting point.

Step 1: Define the certification scope

Identify the products, activities, processes, and locations the QMS will cover. Confirm which requirements apply to the organization's role and document the rationale for any exclusions where permitted.

A clearly defined scope helps the organization plan implementation and helps the certification body understand what needs to be assessed.

Step 2: Conduct a gap assessment

Compare existing processes and records with the applicable requirements. Record each gap, its operational impact, the action needed, the owner, and the target date.

Prioritize gaps that affect product quality, risk controls, traceability, required records, and the ability to demonstrate that processes are implemented and maintained.

Step 3: Implement and document the QMS

Develop or update procedures, responsibilities, training, risk-management activities, supplier controls, records, and corrective-action processes as appropriate to the organization.

The aim is to embed the QMS in everyday operations. A document is not sufficient evidence by itself if the process it describes is not being followed.

Step 4: Complete internal audits and management review

Run internal audits against the defined audit programme, record findings, and follow up on required actions. Conduct management review and document the inputs, decisions, and follow-up actions.

These activities help the organization assess readiness before the external certification audit.

Step 5: Select a suitable certification body

Choose a certification body with appropriate accreditation and competence for the scope being assessed. Confirm its scope, audit approach, expected evidence, fees, and scheduling before proceeding.

ISO does not issue ISO 13485 certificates. Certification is carried out by third-party certification bodies.

Step 6: Complete the certification audits and address findings

The initial assessment commonly involves two stages: a readiness and documentation review, followed by an evaluation of the QMS's implementation and effectiveness. The certification body reports findings and determines what needs to be addressed before a certification decision can be made.

Follow the certification body's process for responding to nonconformities and providing evidence of correction and corrective action. Certification is granted only after the applicable requirements for the decision have been met.

Step 7: Maintain the system after certification

Certification is not a one-time documentation exercise. Organizations need to maintain their QMS, monitor performance, address changes, and complete surveillance and recertification activities according to the certification arrangement.

As processes, products, suppliers, or sites change, review whether the QMS and certification scope remain appropriate.

How Digital Systems Can Support ISO 13485 Readiness

Digital tools can help teams manage the information used to demonstrate that processes are controlled. Their suitability depends on the system's actual functionality, configuration, validation needs, and the organization's procedures.

Keep records connected to the work

Where relevant, teams can benefit from linking experimental or testing data with samples, instruments, procedures, results, and supporting documentation. This can make it easier to retrieve records and understand the context behind a result.

Improve document and change visibility

Document-management workflows can help teams identify approved versions, maintain revision history, and make controlled information available to the appropriate users. Organizations still need defined approval responsibilities and processes for managing changes.

Make audit evidence easier to retrieve

Structured records and traceable workflows can reduce the effort involved in assembling evidence for internal reviews and external audits. Teams should confirm that the selected system's access controls, audit trails, retention capabilities, and other relevant functions meet their intended use and applicable requirements.

Scispot's LIMS platform can be evaluated for laboratory data and workflow needs, including how records from relevant lab activities may be organized. Assess any software against your specific QMS requirements; no software platform independently grants ISO 13485 certification.