ISO 13485 FAQ

ISO 13485 is an internationally recognised standard that outlines the requirements for a quality management system specifically for organisations involved in the design, development, manufacture, distribution and servicing of medical devices. It covers requirements related to both organisational systems, such as document control and training, and to product lifecycle, including design reviews and product change management. When fully implemented, ISO 13485 ensures that an organisation runs effectively by prioritising processes that promote product safety and efficacy.

ISO 13485 is important for product safety as it helps define processes which are considered best practices for ensuring that medical device products are designed, reviewed and produced in a way which is controlled by people with appropriate competence and with sufficient rigour to reduce the risk of product-related hazards. As an organisation, ISO 13485 compliance demonstrates that product quality is important and provides assurance to customers or partners that operations are being carried out in a controlled and systematic way. This not only helps improve reputation, but also makes compliance with regulatory requirements more streamlined.

To achieve ISO 13485 certification, an organisation must first review and implement the requirements of the standard. This involves creating or aligning internal processes to those specified by the standard, including internally reviewing data through internal auditing and management review, before seeking an external auditing body to provide certification. External audits for certification happen in two stages, the first to assess readiness and the second to fully ensure that your organisation meets the requirements of the standard, only then can the system be awarded certification, which lasts three years before it must be fully audited again

In order to sell Class I medical devices into the UK and the EU, you are not required to have an external body audit and certify your ISO 13485 QMS, though compliance to the standard will be helpful in meeting the regulatory requirements required to self-certify your product. For higher risk classification devices (Class IIa, Class IIb or Class III), the easiest and most streamlined way to gain device certification (such as UKCA or CE Mark) is through external certification of a Quality Management System against the requirements of ISO 13485.

Key benefits of ISO 13485 certification include reduced barriers to compliance with applicable regulatory requirements for putting a device on the market, particularly in the UK and EU. Certification also helps provide customers and partners with assurance that your organisation is working effectively and creating safe products, which may strengthen commercial relationships. Internally, adopting clear and defined processes can also improve general business operations and reduce waste of time and resources.

Organisations that design, manufacture, distribute, or service medical devices can benefit from ISO 13485, including suppliers and subcontractors in the supply chain. Any organisation that is involved with the supply of medical devices should align itself with the processes within the standard, either for the purposes of certification or to improve cohesion with other organisations that have done the same.

ISO 13485 is specifically focused on the medical device sector and includes additional requirements related to regulatory compliance. ISO 13485 focuses on medical device efficacy and safety, and creating procedures which support that goal. ISO 9001, however, is a more general management system standard which is focused on customer experience and satisfaction. These things may overlap in many ways, but ISO 9001 places focus on customers, whereas ISO 13485 is implemented to support safe products first.

Risk management is a critical component of ISO 13485, requiring organisations to identify, assess, and mitigate risks throughout the product lifecycle to ensure safety and effectiveness. Risks should be identified from a range of sources, such as clinical safety, usability and labelling and misuse, and reviewed by relevant stakeholders with appropriate expertise from both a clinical and technical perspective.

An ISO 13485 should be reviewed in a planned and risk-based manner. Mostly, reviews will be in the form of a schedule of internal audits, where compliance with procedure and effectiveness of procedures should be checked. Management reviews should also take place, usually at least annually, where KPIs and data related to the performance of the management system are discussed with senior management to determine if the system is meeting requirements.

The most common challenge when implementing ISO 13485 is organisational buy-in and compliance. Implementation of new procedures and changes to existing processes requires training and maintenance in addition to normal organisational functions. Ensuring training and competence, along with carefully maintaining and controlling documentation and records, are typical hurdles that organisations face.

Yes, ISO 13485 certification can enhance an organisation's reputation by demonstrating a commitment to quality and regulatory compliance, fostering trust among customers and stakeholders. ISO 13485 certification signals to external parties that an organisation is operating with well-defined processes, performed by competent individuals, which is a strong marker that the organisation will perform reliably and effectively.