TL;DR
- An ISO 13485 quality management system (QMS) is the documented set of processes a medical device or IVD organization uses to consistently meet customer and regulatory requirements across the device lifecycle.
- The standard asks for a risk-based process approach, controlled documents and records, design and purchasing controls, internal audits, and corrective action.
- In the US, the FDA's Quality Management System Regulation (QMSR) has incorporated ISO 13485:2016 by reference since February 2, 2026.
- Software used in your QMS must be validated for its intended use (Clause 4.1.6). Buying a tool does not make you conformant.
Most ISO 13485 audit findings don't come from a missing procedure. They come from a procedure that says one thing while the lab does another, with the evidence scattered across shared drives and inboxes. This guide explains how an ISO 13485 quality management system is structured, how to build one that holds up in audits, and what to look for in QMS software.
What Is an ISO 13485 Quality Management System?
ISO 13485:2016, Medical devices — Quality management systems — Requirements for regulatory purposes, is the international standard for medical device quality management systems. ISO last reviewed and confirmed the 2016 edition in 2025, so it remains the current version.
Who needs an ISO 13485 QMS?
It applies to organizations involved in the design, production, installation, or servicing of medical devices and related services. That includes device and IVD manufacturers, contract manufacturers, component suppliers, and service providers.
How does ISO 13485 differ from ISO 9001?
ISO 9001 applies to any industry. According to ISO, ISO 13485 puts more weight on regulatory requirements, risk management, and process validation. It also adds device-specific controls, such as a medical device file.
How does ISO 13485 relate to FDA QMSR and EU MDR?
The FDA's Quality Management System Regulation took effect on February 2, 2026. It amends 21 CFR Part 820 to incorporate ISO 13485:2016 by reference for finished device manufacturers. Where ISO 13485 conflicts with the FD&C Act or its regulations, the FDA requirements control.
In the EU, EN ISO 13485:2016 (with A11:2021) is a harmonised standard under the Medical Device Regulation (Commission Implementing Decision (EU) 2021/1182). In both markets, certification and regulatory compliance are assessed separately.
Core Components of an ISO 13485 QMS
The main and important auditable requirements sit in Clauses 4–8. Here's how they fit together as one system. For a clause-by-clause breakdown, read our guide to ISO 13485 requirements.
Documentation and control (Clause 4)
Your QMS documentation should include a quality policy and objectives, a quality manual, the required procedures and records, and a medical device file for each device type or family. Clause 4.2.4 covers document control: approval, review, revisions, and preventing the use of obsolete documents. Clause 4.2.5 covers record control: records must stay legible, identifiable, and retrievable. Our ISO 13485 document control guide covers both in detail.
Management responsibility and resources (Clauses 5–6)
Top management sets the quality policy and objectives, assigns responsibilities, and runs management reviews at planned intervals. Clause 6 covers competence, training, infrastructure, and the work environment.
Product realization (Clause 7)
The operational core: risk management, design and development controls (7.3), purchasing and supplier controls (7.4), production and service provision, including process validation and traceability (7.5), and control of monitoring and measuring equipment (7.6).
Measurement, analysis, and improvement (Clause 8)
Clause 8 covers feedback and complaint handling, reporting to regulatory authorities, internal audits (8.2.4), control of nonconforming product, data analysis, and corrective and preventive action (8.5.2 and 8.5.3).
How to Build an ISO 13485 Quality Management System
A QMS that holds up in audits mirrors how work actually happens.
1. Define your scope and regulatory role
Document your regulatory role (manufacturer, distributor, importer, or authorized representative) and the products, sites, and activities in scope. Justify any excluded or non-applied clause where the standard permits it.
2. Map processes and apply a risk-based approach
Identify the processes your QMS needs, how they interact, and who owns each. Clause 4.1.2 asks for a risk-based approach, so processes that affect device safety need tighter controls.
3. Write procedures that match the work
Draft SOPs and work instructions with the people who run the process. Link each procedure to the records it produces, such as test results, training sign-offs, and supplier evaluations. This is where traceability is built or broken.
4. Audit, review, and improve
Run internal audits at planned intervals with an ISO 13485 internal audit checklist. Feed the findings into CAPA and check that corrective actions worked. Then bring the trends to management review.
Choosing and Validating ISO 13485 QMS Software
Paper and shared-drive systems can meet ISO 13485, but they get harder to keep consistent as products, sites, and suppliers grow.
Capabilities to evaluate
- Controlled documents with approval workflows, version history, and training acknowledgment
- Change control with impact assessment
- Audit trails and electronic signatures, including 21 CFR Part 11 controls if you sell in the US
- Links between quality records and operational data, such as samples, lots, instruments, and results
- Fast evidence retrieval for audits
If you're deciding where quality records should live, our LIMS vs QMS guide explains how the two systems divide the work.
Clause 4.1.6: validate the software you use
ISO 13485 requires documented procedures for validating software used in the QMS, before first use and, as appropriate, after changes. Effort should be proportionate to risk, and records must be kept. The responsibility stays with your organization. Vendor documentation can speed up the work but doesn't replace your own intended-use assessment.
How Scispot supports an ISO 13485 QMS
Scispot is an AI-native laboratory platform with expert delivery. It connects quality processes to the lab work they govern. Scispot QMS ++ covers document control, training management, configurable change control, audit trails, and electronic signatures. For diagnostics and IVD teams, Scispot can link design inputs, assay versions, kit and reagent lots, samples, instrument runs, results, and approvals in one traceable record.
You don't have to replace your existing eQMS. Scispot can work alongside your current QMS, ELN, LIMS, and document systems. It keeps evidence in Trust Vault, so audit-ready lab operations become part of daily work instead of a scramble before the audit. Scispot Validation Care provides IQ/OQ/PQ protocols and evidence for your Scispot system to support your own validation. Your team still owns intended use, procedures, training, and regulated sign-off. No software guarantees ISO 13485 certification.
