ISO 13485:2016 – Medical Devices Quality Management

Overview

ISO 13485:2016 specifies requirements for a Quality Management System specifically designed for organisations involved in the design, development, production, installation, and servicing of medical devices and related services. It differs from ISO 9001 in that it emphasises regulatory compliance requirements, risk management (ISO 14971), design controls, sterile product requirements, and post-market surveillance — all critical in the life-safety-sensitive medical device industry.

Key differences from ISO 9001: Regulatory Requirements (explicitly integrates CDSCO, FDA 21 CFR Part 820, EU MDR 2017/745 requirements), Risk Management (integration with ISO 14971 throughout design and production), Validation Requirements (extensive validation of manufacturing processes, sterilisation, software, and computer systems), Documentation (Device History File, Design History File, Device Master Record — stringent retention requirements), and Post-Market Surveillance (active monitoring of device performance data).

Key benefits: Mandatory for medical device export to EU (EU MDR), Australia (TGA), Canada (Health Canada); CDSCO approval pathway for Class B, C, and D medical devices; FDA 510(k) compatibility; CE Marking prerequisite; and risk management integration.

MFiling implementation support: from Rs.44,999 (exclusive of certification body fees).

Key Benefits

Mandatory for EU, Australia, Canada Medical Device Export

EU MDR, TGA (Australia), and Health Canada (Canada) all require ISO 13485 for medical device market access.

CDSCO Class B/C/D Device Approval Pathway

CDSCO requires ISO 13485 certification for approval of Class B, C, and D medical devices in the Indian market.

CE Marking Prerequisite

EU Notified Bodies require ISO 13485 as a prerequisite for CE technical documentation review and CE Marking approval.

Risk Management per ISO 14971 Integrated

ISO 14971 Risk Management File developed alongside the QMS — covers design, production, and post-market risk throughout device lifecycle.

Design Controls and DHF/DMR Documentation

Complete Design History File and Device Master Record documentation developed — essential for regulatory submissions globally.

Post-Market Surveillance System Established

Systematic post-market surveillance process for collecting and acting on market feedback — required by EU MDR and CDSCO.

Documents Required

Company Profile and Organisational Chart with Job Roles and Reporting Lines

List of All Business Processes and Process Flowcharts (existing or to be developed)

List of Products and Services Offered with Key Customer and Supplier Information

Management Commitment Letter from Top Management (CEO/MD) Supporting Certification

Existing Quality/Management Procedures and Work Instructions (if any)

Previous Audit Reports or Non-Conformance Records (if any)

List of All Medical Devices Manufactured with Intended Use, Classification (Class A/B/C/D), and Regulatory Status

Existing Design and Development Records (DHF, DMR, Risk Files) — if available

CDSCO Manufacturing Licence (Form MD-5) and Device Registration Status

Sterilisation Process Validation Records (for sterile devices)

How it Works

Gap Analysis (2–4 weeks)

MFiling auditor assesses current processes against the standard requirements — identifies gaps, non-conformities, and implementation priorities.

Documentation Development (4–8 weeks)

Prepare the Quality/Management Manual, process procedures, work instructions, forms, and records as required by the standard.

Employee Training and Awareness (2–4 weeks)

Train all relevant staff on the new management system — roles, responsibilities, procedures, and objectives.

Implementation and Operational Control (4–8 weeks)

Deploy the documented processes across all departments — monitor compliance and address practical implementation issues.

Internal Audit (2–3 weeks)

MFiling conducts a full internal audit against the standard requirements — identifies non-conformities before certification body audit.

Management Review (1 week)

Top management reviews audit results, performance data, objectives, and approves the management system for Stage 1 audit.

Stage 1 Audit (Certification Body) (1–2 days)

Accredited certification body reviews documentation and assesses readiness for Stage 2 audit — any major gaps addressed.

Stage 2 Audit and Certificate Issuance (2–5 days audit + 2–4 weeks processing)

Certification body conducts on-site audit of actual implementation — Certificate issued within 2–4 weeks if no major non-conformities.

Frequently Asked Questions

Is ISO 13485 required to sell medical devices in India?

For selling medical devices in India, the primary requirement is CDSCO compliance under the Medical Devices Rules, 2017 — a manufacturing licence (Form MD-5) and product registration/import licence. ISO 13485 is not explicitly mandated for all Class A devices, but CDSCO requires ISO 13485 certification for Class B, C, and D device manufacturers for their own manufacturing licence. Additionally, any medical device company seeking to export to the EU, Australia, or Canada needs ISO 13485. For domestic sales of higher-class devices and for export market access, ISO 13485 is effectively mandatory.

What is the Device History Record (DHR) and Device Master Record (DMR) under ISO 13485?

The Device Master Record (DMR) is the set of documents that defines a medical device — specifications, manufacturing procedures, quality standards, labelling, and packaging requirements. Think of it as the "recipe" for the device. The Device History Record (DHR) is the record of activities and results that demonstrate each individual device was manufactured per the DMR — production records, test results, inspection records, sterilisation records, and labelling records for each production batch. Both are mandatory under ISO 13485 and are the primary documents reviewed during FDA inspections and notified body audits. MFiling develops both the DMR and DHR system as core deliverables of the implementation engagement.

Service Price

₹44,999

Starting price · GST extra

Call Expert WhatsApp Us

Mandatory for EU, Australia, Canada Medical Device Export

EU MDR, TGA (Australia), and Health Canada (Canada) all require ISO 13485 for medical device market access.

CDSCO Class B/C/D Device Approval Pathway

CDSCO requires ISO 13485 certification for approval of Class B, C, and D medical devices in the Indian market.

CE Marking Prerequisite

EU Notified Bodies require ISO 13485 as a prerequisite for CE technical documentation review and CE Marking approval.

Risk Management per ISO 14971 Integrated

ISO 14971 Risk Management File developed alongside the QMS — covers design, production, and post-market risk throughout device lifecycle.

Design Controls and DHF/DMR Documentation

Complete Design History File and Device Master Record documentation developed — essential for regulatory submissions globally.

Post-Market Surveillance System Established

Systematic post-market surveillance process for collecting and acting on market feedback — required by EU MDR and CDSCO.

ISO 13485:2016 – Medical Devices Quality Management

Overview

Key Benefits

Documents Required

How it Works

Frequently Asked Questions

Related Services

Related Articles

Ready to Start or Grow Your Business?

ISO 13485:2016 – Medical Devices Quality Management

Overview

Key Benefits

Documents Required

How it Works

Frequently Asked Questions

Related Services

ISO 9001:2015 – Quality Management System

ISO 14001:2015 – Environmental Management System

ISO 45001:2018 – Occupational Health & Safety

ISO 22000:2018 – Food Safety Management System

Related Articles

Annual Compliance Checklist for Private Limited Companies in 2025

GST Registration: Who Needs It and How to Apply?

How to Register a Private Limited Company in India (2025 Guide)

Ready to Start or Grow Your Business?