ISO 13485:2016 Quality management

and corresponding general aspects for medical

devices.

Rengasri Ganesan
INTRODUCTION

This International Standard specifies requirements for a QMS that can be

used by an organization involved in the life-cycle of a medical device,
including

 Design and development,

 Production,
 Storage and distribution,
 Installation,
 Servicing,
 Final decommissioning and disposal of medical devices,
 Design and development, or provision of associated activities (e.g.
technical support).
TERMS OR PHRASES USED

“as appropriate”
 Product to meet requirements;
 Compliance with applicable regulatory requirements;
 The organization to carry out corrective action;
 The organization to manage risks.
“risk”
 Safety or performance requirements of the medical device
 Meeting applicable regulatory requirements.
“documented”
 established,
 implemented,
 maintained.
VERBAL FORMS USED

 “shall” requirement;

 “should” recommendation;

 “may” permission;

 “can” possibility or a capability.

 "NOTE” guidance or Clarification

PROCESS APPROACH

 The application of a system of processes within an organization,

 Identification and Interactions of these processes, and their management to produce

the desired outcome.

IMPORTANCE

 Understanding and meeting requirements;

 Considering processes in terms of added value;

 Obtaining results of process performance and effectiveness;

 Improving processes based on objective measurement.

LIST OF CLAUSES IN THE ISO 13485:2016

There are 8 different clauses present in the international standard.

 Scope

 Normative references

 Terms and definitions

 Quality management system

 Management responsibility

 Resource management

 Product realization

 Measurement, analysis and improvement

 CLAUSE 1 : SCOPE

 Requirements for a QMS where an organization needs to demonstrate its ability to provide
medical devices and related services that consistently meet customer and applicable
regulatory requirements.
 Organizations can be involved in one or more stages of the life-cycle.
 It can also be used by suppliers or external parties that provide product.
 It is applicable to organizations regardless of their size and regardless of their type
except where explicitly stated.
 It apply equally to associated services as supplied by the organization.
 Responsibility of the organization to ensure that claims of conformity and reflect any
exclusion of design and development controls.
 If any requirement is not applicable due to the activities undertaken and the organization
records the justification
CLAUSE 2 : NORMATIVE REFERENCES

Documents, in whole or in part, are normatively referenced.

[Link] references - only the edition cited applies.
II. Undated references - latest edition of the referenced document
applies.

CLAUSE 3 : TERMS AND DEFINITIONS

3.1 Advisory Notice

To provide supplementary information or to advise on action on the medical

device
Use,
Modification,
Return of the medical device to the organization that supplied it,
Destruction of a medical device.
3.2 Authorized representative

Legal person who has received a written mandate from the manufacturer to act
on his behalf for specified tasks.

3.3 Clinical Evaluation

 Assessment and analysis of clinical data pertaining to a medical
device.
 Verification of clinical safety and performance of the device when
used as intended by the manufacturer.

3.4 Complaint

 Written, electronic or oral communication that alleges deficiencies.

 Related to identity, quality, durability, reliability, usability, safety or
performance of a medical device
3.5 Distributor

 Legal person in the supply chain who, on his own behalf, furthers the availability
of a medical device to the end user.
 More than one distributor may be involved in the supply chain

3.6 Implantable medical device

 Medical devices only be removed by medical or surgical intervention.

 Totally or partially introduced into the human body.
 Replace an epithelial surface or the surface of the eye.
 Remain after the procedure for at least 30 days.
3.7 Importer
Legal person who is the first in a supply chain to make a medical device, manufactured
in another country or jurisdiction, available in the country or jurisdiction where it is
to be marketed.
3.8 Labelling
 Label,
 Instructions for use,
 Related to identification, technical description, intended purpose and proper use of
the medical device,
 Excluding shipping documents.
3.9 Life-cycle
All phases in the life of a medical device, from the initial conception to final
decommissioning and disposal

3.10 Manufacturer
 Legal person with responsibility for design and/or manufacture of a
medical device.
 Medical device available for use, under his name.
 Manufactured by that person himself or on his behalf by another person.
3.11 Medical device
 Instrument, apparatus, implement, machine, appliance, implant, reagent for in
vitro use, software, material or other similar or related article, intended by the
manufacturer to be used, alone or in combination, for human beings.
 It does not achieve its primary intended action by pharmacological,
immunological or metabolic means, in or on the human body.
3.12 Medical device family
 Group of medical devices manufactured by or for the same organization.
 Same basic design and performance characteristics and intended use and
function.
3.13 Performance evaluation
 Assessment and analysis of data to establish or verify the ability of an in
vitro diagnostic medical device.
 To achieve its intended use.
3.14 Post-market surveillance
Process to collect and analyse experience gained from medical devices that have been
placed on the market

3.15 Product

Four generic product categories,

Services (Transport);
Software (Computer program, dictionary);
Hardware (Engine mechanical part);
Processed materials (Lubricant).
3.16 Purchased product
Product provided by a party outside the organization’s QMS

3.17 Risk
combination of the probability of occurrence of harm and the severity of that
harm
3.18 Risk management

Tasks of
 Analysing,
 Evaluating,
 Controlling and
 Monitoring risk.
3.19 Sterile barrier system
 Prevents ingress of microorganisms.
 Allows aseptic presentation of the product at the point of use.

3.20 Sterile medical device

Medical device intended to meet the requirements for sterility.
CLAUSE 4 : Quality Management System

4.1 General requirements

4.1.1
 The organization shall document a QMS and maintain its effectiveness.
 Establish, implement and maintain any requirement, procedure, activity or
arrangement required to be documented.
 The organization shall document the role(s) undertaken by the organization
4.1.2
 Determine the processes needed for QMS.
 Application of these processes throughout the organization.
 Apply a risk-based approach to the control of the appropriate processes.
 Determine the sequence and interaction of these processes
4.1.3

 Determine criteria and methods needed to ensure that both the operation and
control.
 Ensure the availability of resources and information necessary.
 Implement actions necessary to achieve planned results.
 Monitor, measure as appropriate, and analyse.
 Establish and maintain records.

4.1.4

Changes to be made to these processes in QMS shall be:

Evaluated for their impact on QMS.
Evaluated for their impact on the medical devices produced.
Controlled in accordance with the requirements
4.1.5
When the organization chooses to outsource any process that affects product conformity,
It shall monitor and ensure control over such processes.
It shall retain responsibility of conformity.
The controls shall be proportionate to the risk involved and ability of the external
party to meet the requirements.
It shall include written quality agreements.

4.1.6
 It shall document procedures for the validation of the application of computer
Software.
 It shall be validated prior to initial use and, as appropriate, after changes to such
software or its application.
 Validation and revalidation shall be proportionate to the risk.
4.2 Documentation Requirements

4.2.1 General
 Documented statements of a quality policy and quality objectives.
 Quality manual.
 Documented procedures and records.
 Documents to be necessary to ensure the effective planning, operation, and
control of its processes.
 Documentation specified by applicable regulatory requirements.
4.2.2 Quality manual

 Scope of the quality management system that includes details of and justification for
any exclusion or non-application
Procedures for the QMS , or reference to them.
Description of the interaction between the processes.
4.2.3 Medical device file

 General description of the medical device, intended use/purpose, and labelling,

including any instructions for use.
 Specifications for product;
 Specifications or procedures for manufacturing, packaging, storage, handling and
distribution.
 Procedures for measuring and monitoring.
 Requirements for installation.
 Procedures for servicing.

4.2.4 Control of documents

 Review and approve documents for adequacy prior to issue.
 Update as necessary and re-approve documents.
 Ensure that the current revision status of and changes to documents are identified and
relevant versions of applicable documents are available at points of use.
 Documents remain legible and readily identifiable.
4.2.4 Control of documents(Continuation)

 Ensure that documents of external origin, determined by the organization to be

necessary for the planning and operation of the QMS, are identified and their
distribution controlled.
 Prevent deterioration or loss of documents;
 Prevent the unintended use of obsolete documents and apply suitable
identification to them.
4.2.5 Control of Records

 It shall be maintained to provide evidence of conformity.

 It shall document procedures to define the controls needed for the identification, storage,
security and integrity, retrieval, retention time and disposition of records.
 It shall define and implement methods for protecting confidential health information.
 It shall remain legible, readily identifiable and retrievable.
 It shall retain the records for at least the lifetime of the medical device , but not less than
two years from the medical device release by the organization.
CLAUSE 5 : Management Responsibility

5.1 Management commitment

It shall provide evidence of its commitment to the development and implementation of QMS.
communicating to the organization.
Establishing the quality policy.
Ensuring that quality objectives.
Conducting management reviews.
Ensuring the availability of resources.
5.2 Customer focus
It shall ensure that customer requirements and applicable regulatory requirements are
determined and met.
5.3 Quality policy
Management shall ensure that the quality policy,
 Applicable to the purpose of the organization.
 Commitment to comply with requirements and to maintain the effectiveness of the
QMS.
 Framework for establishing and reviewing quality objectives.
 Communicated and understood within the organization.
 Reviewed for continuing suitability.
5.4 Planning
5.4.1 Quality objectives

Management shall ensure that quality objectives,

 To meet applicable regulatory requirements and requirements for product.
 It shall be measurable and consistent with the quality policy.
5.4.2 Quality management system
planning
It shall ensure that:
 The planning of the QMS is carried out in order to meet the requirements,
as well as the quality objectives.
 The integrity of the QMS is maintained when changes to it are planned and
implemented.
5.5 Responsibility, authority and
communication
5.5.1 Responsibility and authority

 Responsibilities and authorities are defined, documented and communicated within

the organization.
 The interrelation of all personnel who manage, perform and verify work
affecting quality.
 Ensure the independence and authority necessary to perform these tasks.
5.5.2 Management representative

It shall appoint a member of management who, irrespective of other responsibilities, has

responsibility and authority that includes:
 Ensuring that processes needed for the QMS are documented.
 Reporting to top management on the effectiveness.
 Promotion of awareness of applicable regulatory requirements

5.5.3 Internal communication

Management shall ensure that appropriate communication processes are established
within the organization
5.6 Management review
Management shall review the organization’s QMS at documented planned intervals to
ensure :
Continuing suitability,
Adequacy ,
Effectiveness.
5.6.2 Review Input

It shall include:
Feedback;
Complaint handling;
Reporting to regulatory authorities;
Audits;
Monitoring and measurement of processes and product;
Corrective action and preventive action(CAPA).
Follow-up actions from previous management reviews;
Changes that could affect the quality management system;
Recommendations for improvement;
Applicable new or revised regulatory requirements.
5.6.3 Review output

 Improvement needed to maintain the suitability, adequacy, and effectiveness of the

QMS and its processes;
 Improvement of product related to customer requirements;
 Changes needed to respond to applicable new or revised regulatory requirements;
 Resource needs.
CLAUSE 6 : Resource Management

6.1 Provision of resources

The organization shall determine and provide the resources needed to:
Implement the QMS and to maintain its effectiveness.
Meet applicable regulatory and customer requirements

6.2 Human resources

The organization shall:

 Determine the necessary competence for personnel performing work.
 Provide training or take other actions.
 Evaluate the effectiveness of the actions taken.
 Ensure that its personnel are aware of the relevance and importance.
6.3 Infrastructure

Infrastructure includes, as appropriate:

 Buildings, workspace and associated utilities;
 Process equipment (both hardware and software);
 Supporting services (such as transport, communication, or information
systems).
The organization shall document requirements for the maintenance activities,
including the interval of performing the maintenance activities.
6.4 Work environment and contamination
control
6.4.1 Work environment

If the conditions for the work environment can have an adverse effect on product quality,
The organization shall:
 Document requirements for health, cleanliness and clothing of personnel.
 Ensure that all personnel who are required to work temporarily under special
environmental conditions
6.4.2 Contamination control

 As appropriate, the organization shall plan and document arrangements for the control of
contaminated or potentially contaminated product.
 For sterile medical devices, the organization shall document requirements for control of
contamination with microorganisms or particulate matter during assembly or packaging
processes.
CLAUSE 7: Product Realization
7.1 Planning of product realization

The organization shall determine:

 Quality objectives and requirements for the product.
 Establish processes and documents to provide resources specific to the product
 Infrastructure and work environment;
 Required verification, validation, monitoring, measurement, inspection and test,
handling, storage,
 Distribution and traceability activities
 Records needed to provide evidence that the realization processes and resulting
product meet requirements
7.2 Customer-related processes
7.2.1 Determination of requirements related
to product
 Requirements specified by the customer, including the requirements for delivery and
post-delivery activities;
 Requirements not stated by the customer but necessary.
 Applicable regulatory requirements.
 User training
7.2.2 Review of requirements related to
product
 Product requirements are defined and documented.
 Requirements differing from those previously expressed
are resolved
 Applicable regulatory requirements are met.
 User training identified
7.2.3 Communication
Communicating with customers in relation to:
 Product information
 Enquiries, contracts or order handling, including amendments.
 Customer feedback, including complaints.
 Advisory notices.
7.3 Design and development
7.3.1 General
Document procedures for design and development.
7.3.2 Design and development planning

 Design and development stages.

 Review.
 Verification, validation, and design transfer.
 Responsibilities and authorities for design and development.
 traceability of design and development outputs to design and development inputs
7.3.3 Design and development inputs

 Functional, performance, usability and safety requirements, according to the

intended use;
 Applicable regulatory requirements and standards;
 Applicable output(s) of risk management;
 As appropriate, information derived from previous similar designs.

7.3.4 Design and development outputs

 Meet the input requirements for design and development;

 Provide appropriate information for purchasing, production and service
provision;
 Contain or reference product acceptance criteria;
 Specify the characteristics of the product that are essential for its safe and proper
use.
7.3.5 Design and development review

 Evaluate the ability of the results of design and development to meet requirements;
 Identify and propose necessary actions

7.3.6 Design and development verification

Verification shall be performed to ensure that :

 Design and development outputs have met the design and development input
requirements.
 Verification plans that include methods, acceptance criteria and, as appropriate,
statistical techniques with rationale for sample size.
 If the intended use requires that the medical device be connected to, or have
an interface with, other medical device(s), shall include confirmation that
the design outputs meet design inputs when so connected or interfaced.
7.3.7 Design and development validation

 It shall be performed in accordance with planned and documented arrangements

to ensure that the resulting product is capable of meeting the requirements for the
specified application or intended use.
 The organization shall document validation plans that include methods,
acceptance criteria and, as appropriate, statistical techniques with rationale for
sample size.
 Design validation shall be conducted on representative product.
 The organization shall perform clinical evaluations or performance
evaluations of the medical device.
 A medical device used for clinical evaluation or performance evaluation is
not considered to be released for use to the customer.
7.3.8 Design and development transfer

 It shall document procedures for transfer of design and development outputs to

manufacturing.
 Ensure that design and development outputs are verified as suitable for
manufacturing before becoming final production specifications.
 It shall ensure production capability can meet product requirements.

7.3.9 Control of design and development

changes
Design and development changes shall be identified. Before implementation, the changes
shall be:
a) reviewed;
b) verified;
c) validated, as appropriate;
d) approved.
7.3.10 Design and development files

 The organization shall maintain a design and development file for each medical device
type or medical device family.
 It shall include or reference records generated to demonstrate conformity.

7.4 Purchasing
7.4.1 Purchasing process
The organization shall establish criteria for the evaluation and selection of suppliers. The
criteria shall be:
 Based on the supplier’s ability to provide product that meets the organization’s
requirements;
 Based on the performance of the supplier;
 Based on the effect of the purchased product on the quality of the medical device;
 Proportionate to the risk associated with the medical device.
7.4.2 Purchasing information

Purchasing information shall describe or reference the product to be purchased,

including as appropriate:
 Product specifications;
 Requirements for product acceptance, procedures, processes and equipment;
 Requirements for qualification of supplier personnel;
 Quality management system requirements.
7.4.3 Verification of purchased product

When the organization or its customer intends to perform verification at the supplier’s
premises, the organization shall state the intended verification activities and method of
product release in the purchasing information.
7.5 Production and service provision
7.5.1 Control of production and service
provision
 Documentation of procedures and methods for the control of production ;
 Qualification of infrastructure;
 Implementation of monitoring and measurement of process parameters and product
characteristics;
 Availability and use of monitoring and measuring equipment;
 Implementation of defined operations for labelling and packaging;
 Implementation of product release, delivery and post-delivery activities.
7.5.2 Cleanliness of product
 Product is cleaned by the organization prior to sterilization or its use;
 Product is supplied non-sterile and is to be subjected to a cleaning process
prior to sterilization or its use;
 Product cannot be cleaned prior to sterilization or its use, and its cleanliness is
of significance in use;
 Product is supplied to be used non-sterile, and its cleanliness is of significance
in use;
 Process agents are to be removed from product during manufacture.
7.5.3 Installation activities

 The organization shall document requirements for medical device installation

and acceptance criteria for verification of installation, as appropriate.
 External party other than the organization or its supplier, the
organization shall provide documented requirements for medical device
installation and verification of installation.
7.5.4 Servicing activities
The organization shall analyse records of servicing activities carried out by the
organization or its supplier:
 To determine if the information is to be handled as a complaint;
 As appropriate, for input to the improvement process.
7.5.5 Particular requirements for sterile
medical devices
The organization shall maintain records of the sterilization process parameters
used for each sterilization batch.
7.5.6 Validation of processes for production
and service provision

The organization shall document procedures for validation of processes, including:

 Defined criteria for review and approval of the processes;
 Equipment qualification and qualification of personnel;
 Use of specific methods, procedures and acceptance criteria;
 As appropriate, statistical techniques with rationale for sample sizes;
 Requirements for records;
 Revalidation, including criteria for revalidation;
 Approval of changes to the processes.
7.5.7 Particular requirements for validation of processes for
sterilization and sterile
barrier systems
The organization shall document procedures for the validation of processes for
sterilization and sterile barrier systems.

7.5.8 Identification

 The organization shall document procedures for product identification and identify
product by suitable means throughout product realization.
 Identify product status with respect to monitoring and measurement
 Requirements throughout product realization.
 Identification of product status shall be maintained throughout production, storage,
installation and servicing of product.
 If required by applicable regulatory requirements, the organization shall document a
system to assign unique device identification to the medical device.
7.5.9 Traceability

[Link] General
The organization shall document procedures for traceability.

[Link] Particular requirements for

implantable medical devices

 Records of components, materials, and conditions for the work environment used, if
these could cause the medical device not to satisfy its specified safety and
performance requirements.
 Suppliers of distribution services or distributors maintain records of the distribution
of medical devices to allow traceability and that these records are available for
inspection.
7.5.10 Customer property

 The organization shall identify, verify, protect, and safeguard customer property
provided for use or incorporation into the product while it is under the
organization’s control or being used by the organization
 If any customer property is lost, damaged or otherwise found to be unsuitable for
use, the organization shall report this to the customer and maintain records
7.5.11 Preservation of product

 Designing and constructing suitable packaging and shipping containers;

 Documenting requirements for special conditions needed if packaging alone
cannot provide preservation.
7.6 Control of monitoring and measuring
equipment
 Be calibrated or verified, or both, at specified intervals, or prior to use, against
measurement standards traceable to international or national measurement standards:
when no such standards exist, the basis used for calibration or verification shall be
recorded.
 Be adjusted or re-adjusted as necessary: such adjustments or re-adjustments shall be
recorded.
 Have identification in order to determine its calibration status;
 Be safeguarded from adjustments that would invalidate the measurement result;
 Be protected from damage and deterioration during handling, maintenance and
storage.
 The organization shall perform calibration or verification in accordance with
documented procedures.
Clause 8 Measurement, analysis and
improvement
8.1 General
The organization shall:
 Demonstrate conformity of product;
 Ensure conformity of the quality management system;
 Maintain the effectiveness of the quality management system.
8.2 Monitoring and measurement
The organization shall document procedures for the feedback process. This feedback
process shall include provisions to gather data from production as well as post-production
activities.
8.2.2 Complaint handling
 Receiving and recording information;
 Evaluating information to determine if the feedback constitutes a complaint;
 Investigating complaints;
 Determining the need to report the information to the appropriate regulatory
authorities;
 Handling of complaint-related product;
 Determining the need to initiate corrections or corrective actions.
8.2.3 Reporting to regulatory authorities

If applicable regulatory requirements require notification of complaints that meet

specified reporting criteria of adverse events or issuance of advisory notices.
8.2.4 Internal audit

 Conforms to planned and documented arrangements, requirements of this

international standard, quality management system requirements established by the
organization, and applicable regulatory requirements;
 It is effectively implemented and maintained.

8.2.5 Monitoring and measurement of

processes
The organization shall apply suitable methods for monitoring and, as appropriate,
measurement of the quality management system processes. These methods shall
demonstrate the ability of the processes to achieve planned results.
8.2.6 Monitoring and measurement of
product
 The organization shall monitor and measure the characteristics of the product to
verify that product requirements have been met.
 Evidence of conformity to the acceptance criteria shall be maintained.
 Product release and service delivery shall not proceed until the planned and
documented arrangements have been satisfactorily completed.
 For implantable medical devices, the organization shall record the identity of
personnel performing any inspection or testing.
8.3 Control of nonconforming product
8.3.1 General

 It shall ensure that product which does not conform to product requirements is identified
and controlled to prevent its unintended use or delivery.
 The evaluation of nonconformity shall include a determination of the need for an
investigation and notification of any external party responsible for the nonconformity.
8.3.2 Actions in response to nonconforming
product detected before delivery
The organization shall:
 Taking action to eliminate the detected nonconformity;
 Taking action to preclude its original intended use or application;
 Authorizing its use, release or acceptance under concession.
8.3.3 Actions in response to nonconforming
product detected after delivery

 When nonconforming product is detected after delivery or use has started, the
organization shall take action appropriate to the effects, or potential effects, of the
nonconformity. Records of actions taken shall be maintained.
 The organization shall document procedures for issuing advisory notices in
accordance with applicable regulatory requirements.
8.3.4 Rework

 The organization shall perform rework in accordance with documented procedures

that takes into account the potential adverse effect of the rework on the product.
 After the completion of rework, product shall be verified to ensure that it meets
applicable acceptance criteria and regulatory requirements.
8.4 Analysis of data

The analysis of data shall include:

feedback;
 Conformity to product requirements;
 Characteristics and trends of processes and product, including opportunities
for improvement;
 Suppliers;
 Audits;
 Service reports, as appropriate.
8.5 Improvement

8.5.1 General

The organization shall identify and implement any changes necessary to ensure and
maintain the continued suitability, adequacy

8.5.2 Corrective action

The organization shall take action to eliminate the cause of nonconformities in order to
prevent recurrence.
 Reviewing nonconformities (including complaints);
 Determining the causes of nonconformities;
 Evaluating the need for action to ensure that nonconformities do not recur;
 Planning and documenting action needed and implementing such action,
including, as appropriate, updating documentation;
8.5.2 Corrective action(continuation)……

 Verifying that the corrective action does not adversely affect the ability to meet
applicable
 Regulatory requirements or the safety and performance of the medical device;
 Reviewing the effectiveness of corrective action taken.

8.5.3 Preventive action

The organization shall determine action to eliminate the causes of potential
nonconformities in order to prevent their occurrence.

 Determining potential nonconformities and their causes;

 Evaluating the need for action to prevent occurrence of nonconformities;
 Planning and documenting action needed and implementing such action,
including, as appropriate,updating documentation;
8.5.3 Preventive action (continuation)….

 Verifying that the action does not adversely affect the ability to meet
applicable regulatory requirements or the safety and performance of the
medical device;
 Reviewing the effectiveness of the preventive action taken, as appropriate.