The guidance document for ISO 13485 has changed — here’s what medical device quality professionals need to know today
Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.
The Standard That Guided ISO 13485 Compliance Is Gone — Here’s What That Means
If you searched for ISO/TR 14969, you already ran into a dead end. The document is no longer current. It was officially withdrawn.
That matters more than it sounds. Quality professionals in the medical device space still reference ISO/TR 14969 in internal procedures, training materials, and supplier documentation. Some consultants still cite it. If you are building or auditing a QMS right now, you need to know what replaced it — and whether your documentation is anchored to an obsolete source.
ISO/TR 14969:2004 was withdrawn by ISO when ISO 13485 was revised to its 2016 edition. The technical report was tied to ISO 13485:2003. When the 2016 version introduced risk-based process controls, expanded post-market surveillance requirements, and global regulatory alignment language, the 2004 guidance became misaligned — and in some clauses, actively misleading. In its place, ISO published a new handbook: ISO 13485:2016 — Medical Devices — A Practical Guide.
Now, in 2026, the stakes are higher. The FDA’s Quality Management System Regulation (QMSR) took effect February 2, 2026, formally replacing 21 CFR Part 820 with ISO 13485:2016 as the baseline for U.S. device compliance. Organizations that built their QMS on ISO 13485:2003 interpretations — or whose procedures still reference ISO/TR 14969 — face a two-layer exposure: outdated guidance and regulatory non-alignment.
I’ve seen this pattern play out in quality systems that looked solid on paper. During a QMS documentation review I supported at a contract manufacturer with FDA-regulated device components, the team found five procedures that traced their CAPA language back to 14969 interpretation. The procedures hadn’t been reviewed since 2019. They weren’t wrong, exactly — but they were missing the risk-proportionate framing the 2016 standard requires. No findings yet. That changes when the next surveillance audit runs QMSR expectations against legacy documentation.
Before you go further — if your team is preparing for ISO 13485 certification or a surveillance audit, run a gap check first:
👉 Download the ISO 13485 Gap Assessment Checklist — Free checklist for medical device manufacturers assessing their QMS against ISO 13485:2016 requirements.
In This Guide
- What ISO/TR 14969 was and what it covered
- Why it was withdrawn
- What replaced it — the ISO 13485:2016 Practical Guide, including its structure and chapter mapping
- Why 2026 is the year this gap becomes a compliance liability (FDA QMSR)
- How to update your QMS documentation to reflect current guidance
- Where to purchase the current standard and guidance documents
- FAQ
Table of Contents
👉 Start Here — Top Resources
- ISO 13485:2016 — ANSI Webstore — Purchase the current edition of the standard. Use code CC2026 for 5% off at checkout.
- ISO 13485 Training — BSI Group — Implementation, internal auditor, and lead auditor courses aligned to ISO 13485:2016.
- ISO 13485 Gap Assessment Checklist — Free download. Identify where your current QMS falls short before your next audit.
What Was ISO/TR 14969?
ISO/TR 14969:2004 was a Technical Report published by ISO’s Technical Committee 210 (ISO/TC 210), the group responsible for quality management and general aspects for medical devices.
TR stands for Technical Report. Unlike a full ISO standard, a Technical Report carries no requirements. It cannot be used as the basis for certification or regulatory inspection. Its purpose was interpretive: help organizations understand what ISO 13485 required and how to meet those requirements in practice.
ISO/TR 14969 provided clause-by-clause guidance on ISO 13485:2003. It explained intent, offered implementation examples, and clarified language that auditors and manufacturers found ambiguous. The document mirrored the clause structure of ISO 13485:2003 and covered:
- Scope and application — how requirements applied across different organization types (manufacturers, service providers, distributors)
- Quality management system (Clause 4) — documentation requirements, records, and what was required vs. recommended
- Management responsibility (Clause 5) — how top management commitment was assessed and evidenced
- Resource management (Clause 6) — personnel competency requirements, infrastructure, and work environment controls
- Product realization (Clause 7) — planning, design controls, purchasing, production, and process validation
- Measurement, analysis, and improvement (Clause 8) — feedback, internal audits, nonconformance control, CAPA, and data analysis
Most common finding: Organizations that built their QMS procedures using ISO/TR 14969 as a reference may have clause citations, interpretive notes, or CAPA language that is now misaligned with ISO 13485:2016. Those gaps become findings during document reviews and surveillance audits.
Why Was ISO/TR 14969 Withdrawn?
ISO/TR 14969:2004 was withdrawn because ISO 13485 itself was substantially revised in 2016. When the 2016 edition introduced new and modified requirements, the 2004 guidance document became misaligned — and in some areas, a liability.
| Change Area | ISO 13485:2003 / TR 14969 | ISO 13485:2016 |
|---|---|---|
| Risk-based process control | Limited risk language | Risk-based approach embedded throughout QMS structure |
| Regulatory requirements | Aligned primarily to EU directives | Expanded global alignment (FDA, TGA, Health Canada, EU MDR) |
| Post-market surveillance | General requirements | Explicit feedback loop and monitoring requirements |
| Software validation | Basic guidance | Expanded requirements for QMS software validation |
| Outsourced processes | Covered in Clause 4.1 | Risk-proportionate controls based on risk and external party capability |
| Supplier controls | Standard purchasing controls | Risk-proportionate controls with clearer documentation requirements |
A technical report tied to the 2003 standard could not guide organizations through requirements that didn’t exist until 2016. ISO withdrew the document and directed users to the replacement handbook.
What Replaced ISO/TR 14969? Structure and Clause Mapping
The current guidance document is the ISO 13485:2016 — Medical Devices — A Practical Guide, published by ISO in 2017 and authored by technical experts from ISO/TC 210. In the United States it was adopted by AAMI as AAMI/ISO 13485:2016 — A Practical Guide, available through the ANSI Webstore. AAMI explicitly identifies it as the replacement for ISO/TR 14969.
The handbook runs approximately 214 pages and is organized to mirror the clause structure of ISO 13485:2016, making it a direct lookup reference when you’re working through specific requirements. Here’s how it maps:
| Handbook Section | ISO 13485:2016 Clause | Key Guidance Provided |
|---|---|---|
| Introduction & Scope | Clause 1 | Applicability across organization types; what “regulatory purposes” means in practice |
| Quality Management System | Clause 4 | Risk-based QMS design; documentation hierarchy; outsourced process controls |
| Management Responsibility | Clause 5 | Top management commitment evidence; quality planning; management review inputs/outputs |
| Resource Management | Clause 6 | Competency records; infrastructure qualification; work environment controls |
| Product Realization | Clause 7 | Design controls; purchasing controls; production process validation; sterilization; servicing |
| Measurement, Analysis & Improvement | Clause 8 | Feedback systems; complaint handling; internal audit; CAPA; statistical methods |
Beyond clause-level guidance, the Practical Guide also includes:
- Regulatory notes specific to different markets — particularly useful for EU MDR and FDA QMSR alignment
- Worked examples of how to apply risk-based thinking to QMS process selection and documentation intensity
- Transition guidance for organizations moving from ISO 13485:2003-based systems to the 2016 edition
One practical limitation worth knowing: the Practical Guide is a 214-page document that, despite its name, is not always light reading. Industry reviewers have noted that some sections contain circular references and that the guidance on risk-based approach — one of the biggest paradigm shifts in the 2016 standard — spans only a few pages for a topic that has generated ongoing debate between manufacturers and notified bodies. Having the Practical Guide alongside a current training course is more effective than relying on the handbook alone.
👉 If you’re preparing for Stage 1 audit and haven’t run a full clause-by-clause gap check, do that before you open the Practical Guide. Download the ISO 13485 Gap Assessment Checklist to identify gaps first — then use the handbook to close them.
Why This Matters More in 2026: FDA QMSR and Dual Compliance
This isn’t just a document housekeeping issue. In 2026, it’s a compliance liability with a hard regulatory edge.
The FDA QMSR took effect February 2, 2026. It formally replaced 21 CFR Part 820 — the U.S. Quality System Regulation that governed device manufacturing for nearly 30 years — with ISO 13485:2016 as the legal baseline for U.S. medical device quality systems. Manufacturers who previously maintained a 21 CFR Part 820-based QMS now need to be running against ISO 13485:2016 requirements, including the interpretive framework the 2016 standard uses.
That has a direct impact on ISO/TR 14969 references. Here’s why:
ISO/TR 14969 pre-dates both ISO 13485:2016 and FDA QMSR. Any QMS procedure, work instruction, or training record that traces its authority back to 14969 guidance — rather than the 2016 standard and current Practical Guide — is not aligned to the regulatory expectations your FDA inspector will be applying.
Specific areas where this creates dual exposure:
- CAPA requirements — 14969 guidance on CAPA pre-dates the 2016 standard’s risk-proportionate framing. FDA inspectors applying QMSR expectations will scrutinize whether your CAPA process scales corrective action depth to risk level. Procedures built on 14969 interpretation often don’t.
- Post-market surveillance — The 2016 standard significantly strengthened feedback loop requirements. 14969 guidance reflects the lighter 2003 language. Under QMSR, FDA expects active post-market data feeding back into the QMS — not just complaint logs.
- Software validation for QMS applications — If your document control system, CAPA software, or ERP was validated against 14969 guidance language, that validation basis needs review under the 2016 standard’s expanded software validation requirements.
I worked with a team at a supplier to a large device OEM during QMSR transition prep. Their internal audit procedure had been solid for years — well-written, consistently followed. When we mapped it against QMSR expectations, the issue wasn’t procedure quality. It was that the criteria used to determine audit frequency and depth hadn’t been updated since the 2003-era documentation. Risk-based audit scheduling — required under the 2016 standard — wasn’t in the procedure. The OEM’s supplier quality team flagged it in a pre-audit review before the FDA did. That’s the window you want to catch this in.
For a detailed breakdown of the QMSR transition and what changes for manufacturers, see FDA QSR vs ISO 13485.
How to Update Your QMS for Current Guidance
If your QMS procedures, work instructions, or training materials reference ISO/TR 14969, here’s how to address it systematically.
Step 1 — Document search Run a controlled search of your document management system for “ISO/TR 14969,” “TR 14969,” and “14969:2004.” Flag every document where the reference appears. Include training materials and supplier quality agreements.
Step 2 — Classify each reference Not every reference creates a compliance gap. Categorize:
✅ Citation-only reference — the procedure logic is sound; only the document reference needs updating
⚠️ Interpretive reference — procedure was built around 14969 guidance that may not align with current Practical Guide interpretation (CAPA framing, risk-based audit criteria, outsourced process controls)
⚠️ Training material reference — auditors check training records; outdated citations get flagged
Step 3 — Batch the citation updates For straightforward citation updates, consolidate them into a single planned revision cycle. Update the reference from “ISO/TR 14969” to “ISO 13485:2016” or the Practical Guide as appropriate. Document the rationale in your change control record.
Step 4 — Cross-reference interpretive references against the Practical Guide For procedures built on 14969 interpretation, map them against the equivalent clause in the ISO 13485:2016 Practical Guide. Pay specific attention to: CAPA (Clause 8.5), outsourced process controls (Clause 4.1), internal audit (Clause 8.2), and post-market surveillance feedback (Clause 8.2.1). These are the areas where the 2016 guidance diverges most from 2003-era interpretation.
Step 5 — Update internal auditor training records If your ISO 13485 internal auditor training references 14969, update the training materials and re-document competency verification. This is consistently one of the overlooked items in QMS transitions — and it surfaces in audits.
Do the gap assessment before you start revising. Chasing individual references without knowing your overall QMS posture is working in the wrong order. The ISO 13485 Gap Assessment Checklist gives you the full picture first.
✅ Quick Checklist: ISO/TR 14969 Reference Review
- [ ] Searched QMS document system for all 14969 references
- [ ] Searched training materials and supplier quality agreements
- [ ] Classified references as citation-only or interpretive
- [ ] Verified CAPA procedure aligns with 2016 risk-proportionate framing — not 14969
- [ ] Verified internal audit frequency and depth criteria include risk-based logic
- [ ] Verified post-market surveillance feedback procedure reflects 2016 requirements
- [ ] Updated training materials to remove obsolete guidance document references
- [ ] Confirmed training records reflect ISO 13485:2016 Practical Guide as current source
- [ ] Completed a full ISO 13485:2016 gap assessment against all 8 clauses
Where to Buy ISO 13485 and the Current Guidance Handbook
| Document | Description | Source |
|---|---|---|
| ISO 13485:2016 | The current active standard — required for certification | ANSI Webstore |
| ISO 13485:2016 Practical Guide | 214-page official guidance handbook replacing ISO/TR 14969 | ANSI Webstore — available individually or in bundles |
| ISO 13485 / ISO 14971 Bundle | Standard + risk management standard package | ANSI Webstore bundle |
| ISO/TR 14969:2004 | Withdrawn — historical reference only | Available as historical document only |
Use coupon code CC2026 for 5% off at the ANSI Webstore — valid through December 31, 2026. ANSI serves international buyers and offers standards in multiple languages where available.
For more on building your ISO 13485 QMS documentation, see ISO 13485 Documentation Requirements and the ISO 13485 Implementation Roadmap.
FAQ
Is ISO/TR 14969 still valid?
No. ISO/TR 14969:2004 was officially withdrawn by ISO when ISO 13485 was revised to its 2016 edition. It is no longer current and should not be used as implementation guidance for an ISO 13485:2016-aligned QMS. It remains available as a historical document only. The replacement is the ISO 13485:2016 — Medical Devices — A Practical Guide.
What replaced ISO/TR 14969?
ISO/TR 14969 was replaced by the ISO 13485:2016 — Medical Devices — A Practical Guide, a 214-page companion handbook published by ISO in 2017 and authored by ISO/TC 210 technical experts. In the United States, it was adopted by AAMI as AAMI/ISO 13485:2016 and is available through the ANSI Webstore. AAMI explicitly identifies it as the replacement for ISO/TR 14969.
Can I still reference ISO/TR 14969 in my QMS procedures?
It is not prohibited, but it creates audit risk — especially now that FDA QMSR is in effect. A reference to a withdrawn guidance document signals that your documentation system may not be current. Best practice is to replace ISO/TR 14969 citations with ISO 13485:2016 clause references or the Practical Guide, and to verify that any procedure logic built on 14969 interpretation still holds against the 2016 standard.
Does ISO/TR 14969 apply to FDA QMSR compliance?
No. ISO/TR 14969 was guidance for ISO 13485:2003. The FDA QMSR — effective February 2, 2026 — harmonizes U.S. requirements with ISO 13485:2016. QMSR compliance requires alignment with the 2016 standard and its current guidance documents. Organizations still referencing 14969 in CAPA, audit, or post-market surveillance procedures should treat QMSR implementation as the trigger to complete that cleanup.
What is the difference between a Technical Report and an ISO standard?
An ISO Technical Report carries no requirements and cannot serve as the basis for certification or regulatory inspection. ISO/TR 14969 was a TR — it existed to help organizations interpret and implement ISO 13485, not to define binding requirements. The ISO 13485:2016 Practical Guide serves the same interpretive purpose.
How is ISO/TR 14969 different from ISO 13485?
ISO 13485 is the requirements standard — it defines what a QMS must do to be certifiable. ISO/TR 14969 was guidance only — it explained how to interpret and meet those requirements. The standard is mandatory for certification; the guidance document was optional but widely used. ISO 13485:2016 is the current active standard.
Do I need to buy the ISO 13485:2016 Practical Guide separately from the standard?
Yes. The standard and the Practical Guide are separate publications. The standard defines the requirements; the Practical Guide explains clause intent and provides implementation examples. Bundle packages combining ISO 13485:2016, the Practical Guide, and ISO 14971 are available at the ANSI Webstore at savings compared to individual purchases. For manufacturers building or overhauling a QMS, having both is strongly recommended.
Where can I get ISO 13485 training that covers the current guidance?
BSI Group offers ISO 13485 training at awareness, requirements, implementation, internal auditor, and lead auditor levels — all aligned to the 2016 edition. BSI is both an accredited training provider and a recognized certification body. Pairing their implementation or internal auditor course with the Practical Guide gives you a working command of the 2016 requirements, not just familiarity with the document.
📥 Free Resources
- ISO 13485 Gap Assessment Checklist — Free checklist for medical device manufacturers assessing their QMS against ISO 13485:2016 requirements before certification or a surveillance audit
- ISO 9001 Roadmap — Step-by-step implementation guide for manufacturers building or improving a quality management system
- Manufacturing Compliance Checklist — Practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
- Supplier Quality Checklist — Evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
- AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification
Not Sure What to Do Next?
🔹 Still researching ISO 13485 requirements? Start with What Is ISO 13485? for a full breakdown of the standard’s scope, structure, and who needs it.
🔹 Building or upgrading your ISO 13485 QMS? The ISO 13485 Implementation Roadmap walks you through the sequence from gap assessment to certification-ready documentation. For training on the 2016 requirements, BSI Group’s ISO 13485 courses include implementation-level coverage that goes well beyond the handbook itself.
🔹 Ready to purchase the standard? Get ISO 13485:2016 at the ANSI Webstore in digital or print. Use code CC2026 for 5% off through December 31, 2026.
The Standards Navigator covers the full medical device compliance standards landscape — from ISO 13485 implementation to FDA QMSR alignment. If your QMS has to hold up against both ISO certification and FDA inspection, the guidance document you’re working from matters as much as the standard itself.
Stay Current on ISO 13485 and Medical Device Compliance
QMS procedures built on outdated guidance don’t fail audits immediately. They fail them on the third surveillance cycle, when nobody remembers where the language came from. The FDA QMSR has made that timeline shorter.
The Standards Navigator covers ISO 13485 implementation, QMSR transition, risk management requirements, and the documentation controls that keep QMS systems audit-ready across both regulatory frameworks.
👉 Get updates on the medical device compliance standards cluster 👉 Be first to access new ISO 13485 implementation resources and checklists
Subscribe below to stay ahead.
The Standards Navigator — Industrial Compliance. Clearly Explained.