ISO 13485

ISO 13485 Medical devices -- Quality management systems -- Requirements for regulatory purposes is a voluntary standard, published by International Organization for Standardization (ISO) for the first time in 1996, and contains a comprehensive quality management system for the design and manufacture of medical devices. The latest version of this standard supersedes earlier documents such as EN 46001 (1993 and 1996) and EN 46002 (1996), the previously published ISO 13485 (1996 and 2003), and ISO 13488 (also 1996).

The current ISO 13485 edition was published on 1 March 2016.

Background

Though it is tailored to the industry's quality system expectations and regulatory requirements, an organization does not need to be actively manufacturing medical devices or their components to seek certification to this standard, in contrast to the automotive sector's ISO/TS 16949, where only firms with an active request for quotation, or on the bid list, of an International Automotive Task Force supply chain manufacturer can seek registration.

Reason for use

While it remains a stand-alone document, ISO 13485 is generally harmonized with ISO 9001. A principal difference, however, is that ISO 9001 requires the organization to demonstrate continual improvement, whereas ISO 13485 requires only that the certified organization demonstrate the quality system is effectively implemented and maintained. Additionally, the ISO 9001 requirements regarding customer satisfaction are absent from the medical device standard.

ISO 13485 places specific emphasis on resource and environment management, tailored to the medical device and software sectors. For example, the standard requires organizations to ensure that their personnel are not only qualified but also adequately trained to understand and implement regulatory requirements. Moreover, the infrastructure and work environment must support compliance and safety. In software engineering for medical devices, this extends to maintaining cybersecurity measures and ensuring a development environment free from potential risks to data integrity or software reliability.

Other specific differences include:

• the promotion and awareness of regulatory requirements as a management responsibility. Examples of market-specific regulatory requirements include 21 CFR 820, the Quality System Regulation for medical devices sold in the United States, enforced by the U.S. Food and Drug Administration (FDA), or the Medical Devices Directive 93/42/EEC, required for doing business in the European Union
• controls in the work environment to ensure product safety
• focus on risk management activities and design control activities during product development
• specific requirements for inspection and traceability for implantable devices
• specific requirements for documentation and validation of processes for sterile medical devices
• specific requirements for verification of the effectiveness of corrective and preventive actions
• specific requirements for cleanliness of products

Compliance with ISO 13485 is often viewed as the initial step in ensuring adherence to European regulatory requirements. This is particularly significant when it comes to assessing the conformity of Medical Devices and In-vitro Diagnostic Medical Devices in accordance with European Union Directives 93/42/EEC, 90/385/EEC, and 98/79/EEC before allowing their sale. A fundamental aspect of proving conformity lies in the establishment and implementation of a Quality Management System compliant with ISO 9001, ISO 13485, and ISO 14971. While it's important to note that the European Union Directives don't explicitly mandate certification to ISO 9001 and/or ISO 13485, it is the preferred approach for demonstrating compliance to these standards, and this certification is issued by specialized organizations referred to as "Registrars."

Furthermore, some of these registrars also serve as Notified Bodies, which play a pivotal role in the pre-market assessment of certain medical devices. When a Notified Body conducts a thorough evaluation and issues a positive assessment, it results in the coveted certificate of conformity, granting the CE mark and the authorization to market the medical device within the European Union. It's important to underline that the Notified Body's assessment scrutinizes the company's Quality Management System in great detail, along with a meticulous review of the requisite Technical Documentation. This comprehensive evaluation is a crucial element that the Notified Body takes into account when granting the certificate of conformity for the company's product or products.

In summary, the journey to compliance with European regulatory requirements for medical devices entails a multi-faceted approach, with ISO 13485 serving as a cornerstone and the involvement of Notified Bodies as a key step to gain the necessary certifications and permissions for market access in the European Union.

This standard adopted by CEN as EN ISO 13485:2003/AC:2007 is harmonized with respect to the European medical device directives 93/42/EEC, 90/385/EEC and 98/79/EC.

ISO 13485 is now considered to be inline standard and requirement for medical devices even with "Global Harmonization Task Force Guidelines" (GHTF). The GHTF guidelines are slowly becoming universal standards for design, manufacture, export and sales of various medical devices. The GHTF has been replaced in the last few years by the International Medical Device Regulators Forum (IMDRF) and is structured differently from the GHTF as only the regulators, that are primary members of the group, get to make many of the decisions. The IMDRF main membership (the regulators) do want to have non-regulators involved without voting rights and in this way they are hoping to get the process and documents completed quicker than under the GHTF system (regulators & non-regulators were equal in voting rights) that worked reasonably well, but somewhat slow.

This standard adopted by CEN as EN ISO 13485:2012 is harmonized with respect to the European Medical Devices Directive 93/42/EEC.

Mexico published on October 11, 2012, a national standard as a Norma Oficial Mexicana (NOM) to control manufacture of medical devices inside the country. NOM-241-SSA1-2012, Buenas Practicas de Fabricación para Establecimientos dedicados a la Fabricación de Dispositivos Médicos. The scope of application is mandatory in the national territory, for all establishments dedicated to the process of medical devices marketed in the country. The Cofepris is the body assigned to its control, verification and to grant the records of compliance to the companies that implement this Standard of Good Manufacturing Practices. This standard is partially in line with ISO 13485: 2003 and ISO 9001: 2008.

In 2017, The Farmacopea de los Estados Unidos Mexicanos (United Mexican States Pharmacopoeia), medical industrial sectors and Cofepris are working together for updating NOM-241 Standard, putting special attention on managing risks during manufacture and regulating by manufacturing lines some of the most important medical devices manufacturing processes. This standard will be published in August 2018, and 180 days after publication it will become mandatory for the industry.

In Spain, medical devices are named in ISO-13485 as "Sanitary Products" as Castellano-language translation of ISO-13485, but in Mexico they are known as "Medical Devices" and correspond to those used in medical practice and that meet the definition established by NOM-241 as: Medical device, to the substance, mixture of substances, material, apparatus or instrument (including the computer program necessary for its proper use or application), used alone or in combination in the diagnosis, monitoring or prevention of human or auxiliary diseases in the treatment of the same and of the disability, as well as the employees in the replacement, correction, restoration or modification of the anatomy or human physiological processes. Medical devices include products of the following categories: medical equipment, prostheses, orthotics, functional aids, diagnostic agents, supplies for dental use, surgical, healing and hygiene products. ISO 13485:2016 Certificates meets the requirement of IEC 60601-2-25 : 1993 + A1: 1999 safety of Electrocardiograms.

Chronology

Year	Description
1993	EN 46001 Quality systems – Medical devices – Particular requirements for the application of EN ISO 9001 is published by the European Committee for Standardization (CEN), forming the basis for developing ISO 13485.
1996	ISO 13485 (1st Edition).
2000	EN ISO 13485 is published by CEN, creating a European Norm version of the international standard, and the previous European standard (EN 46001) is withdrawn.
2003	ISO 13485 (2nd Edition).
2012	EN ISO 13485 is revised so that it harmonizes with the three European directives associated with the medical sector: 93/42/EEC (medical devices), 98/79/EC (in vitro diagnostic medical devices), and 90/385/EEC (active implantable medical devices).
2016	ISO 13485 (3rd Edition).

See also

• ISO 14971
• Good manufacturing practice
• List of International Organization for Standardization standards

External links

• Guide to ISO 13485
• ISO 13485 Standard: Medical devices — Quality management systems: ISO Website
• Overview, guidance and regulatory compliance for EU medical device manufacturers
• CFR - Code of Federal Regulations Title 21, Part 821, Food and Drug Administration's Quality System Regulation