ISO 13485 Medical devices — Quality management systems — Requirements for regulatory purposes is an International Organization for Standardization (ISO) standard published for the first time in 1996; it represents the requirements for a comprehensive quality management system for the design and manufacture of medical devices.

Reason for use

While it remains a stand-alone document, ISO 13485 is generally harmonized with ISO 9001. A principal difference, however, is that ISO 9001 requires the organization to demonstrate continual improvement, whereas ISO 13485 requires only that the certified organization demonstrate the quality system is effectively implemented and maintained. Additionally, the ISO 9001 requirements regarding customer satisfaction are absent from the medical device standard.

Other specific differences include:

• The promotion and awareness of regulatory requirements as a management responsibility. Examples of market-specific regulatory requirements include 21 CFR 820, the Quality System Regulation for medical devices sold in the United States, enforced by the U.S. Food and Drug Administration (FDA), or the Medical Devices Directive 93/42/EEC, required for doing business in the European Union
• Controls in the work environment to ensure product safety
• Focus on risk management activities and design control activities during product development
• Specific requirements for inspection and traceability for implantable devices
• Specific requirements for documentation and validation of processes for sterile medical devices
• Specific requirements for verification of the effectiveness of corrective and preventive actions

Compliance with ISO 13485 is often seen as the first step in achieving compliance with European regulatory requirements. The conformity of Medical Devices and In-vitro Diagnostic Medical Device according to European Union Directives 93/42/EEC, 90/385/EEC and 98/79/EEC must be assessed before sale is permitted. One of the major requirements to prove conformity is the implementation of the Quality Management System according ISO 9001 and/or ISO 13485 and ISO 14971. Although the European Union Directives do not mandate certification to ISO 9001 and/or ISO 13485 the preferred method to prove compliance to such standards is to seek its official certification which is issued by certifying organizations known as “Registrars”. Several registrars also act as Notified Body. For those medical devices requiring the pre-market involvement of a Notified Body, the result of a positive assessment from the Notified Body is the certificate of conformity allowing the CE mark and the permission to sell the medical device in the European Union. A very careful assessment of the company Quality Management System by the Notified Body, together with the review of the required Technical Documentation, is a major element which the Notified Body takes into account to issue the certificate of conformity to the company product(s).

This standard adopted by CEN as EN ISO 13485:2003/AC:2007 is harmonized with respect to the European medical device directives 93/42/EEC, 90/385/EEC and 98/79/EC.

 

ISO 13485 is now considered to be inline standard and requirement for medical devices even with “Global Harmonization Task Force Guidelines” (GHTF). The GHTF guidelines are slowly becoming universal standards for design, manufacture, export and sales of various medical devices. The GHTF has been replaced in the last few years by the International Medical Device Regulatory Forum (IMDRF) and is structured differently from the GHTF as only the regulators, that are primary members of the group, get to make many of the decisions. The IMDRF main membership (the regulators) do want to have non-regulators involved without voting rights and in this way they are hoping to get the process and documents completed quicker than under the GHTF system (regulators & non-regulators were equal in voting rights) that worked reasonably well, but somewhat slow.

This standard adopted by CEN as EN ISO 13485:2012 is harmonized with respect to the European Medical Devices Directive 93/42/EEC.

General Requirements

• Adhere to the standard.
• Document what needs to be documented.
• Maintain what is required.
• Have written procedures in place and ensure the effectiveness of the system implemented.
• Consider the risk factors in all activities.
• Introduce steps to minimize the risks identified and aim to not cause catastrophic events.
• Identify how things should be done to generate the medical device and stick to those processes.
• Determine ways to track the activities, correct any process failures or oversights, and generate records to show all the activities are being done.
• Determine the requirements that are legally bound to, and follow them.
• Even when outsourcing work, ensure to maintain responsibility for that work.
• Any systems used in the manufacturing processes should be confirmed to ensure they work as intended and don’t negatively affect the processes.

Document Requirements

• Quality Manual with Scope of the QMS
• Required Procedures
• Required Forms & Records
• Control of Documents
• Control of Forms

Fig. 1 ISO 13485 Certificate