ISO 13485:2016 - The Standards Navigator

ISO 13485 Clauses Explained: A Complete Clause-by-Clause Breakdown (2026)

ISO 13485:2016 has eight clauses, but only five carry auditable requirements. This ISO 13485 clauses explained guide breaks down Clauses 4 through 8 in practical terms, corrects the common DHF-to-Medical-Device-File mapping error, and explains how FDA’s Compliance Program 7382.850 — which replaced QSIT on February 2, 2026 — reorganizes inspections around six QMS Areas and four Other Applicable FDA Requirements.

What every section of ISO 13485:2016 actually requires — and where auditors dig deepest

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Standard Reads Like a Checklist. It Isn’t One.

ISO 13485:2016 has eight clauses. Five of them carry actual requirements. That structure looks simple on the page — and it’s exactly why so many quality teams underestimate how much interpretation each clause demands once an auditor starts asking “show me.” This ISO 13485 clauses explained guide breaks down what each section requires, where the requirements overlap, and what auditors and FDA investigators may look for.

The FDA’s Quality Management System Regulation (QMSR) took effect February 2, 2026, incorporating ISO 13485:2016 by reference into 21 CFR Part 820. That changes what this clause structure means in practice. FDA also replaced its inspection methodology the same day — the Quality System Inspection Technique (QSIT) is gone, replaced by Compliance Program 7382.850. Getting the clause boundaries right now has a direct line to how an FDA investigator scopes an inspection, not just how a certification body audits.

Regulatory affairs and quality professionals reading this already know ISO 13485 exists. What’s harder to find is a breakdown that goes past the clause titles and into what each section demands in practice — where the audit findings cluster, where risk management threads through clauses that don’t mention risk in their title, and where the standard’s lack of an Annex SL high-level structure changes how it should be read compared to ISO 9001.

My perspective on this comes from 25+ years in operations leadership, an ISO 9001 Internal Auditor certification, and a Six Sigma Green Belt — a lot of that time spent on both sides of the table, building QMS documentation and sitting in CAPA reviews when a gap in that documentation turned into a finding. The pattern holds across every regulated QMS I’ve worked with: teams don’t fail because they misread a clause. They fail because they treated clause boundaries as more rigid than the standard actually intends, and missed how much cross-referencing an auditor expects between clauses 4 through 8.

If you haven’t run a structured gap check against the current clause set, that’s the place to start — not a full documentation rewrite.

👉 Run the ISO 13485 Gap Assessment Checklist before you touch your quality manual — a free, structured way to see exactly which clauses your QMS already satisfies and which ones need real work before an auditor finds the gap for you.

In This Guide

How ISO 13485:2016 is structured, and why it doesn’t follow ISO’s Annex SL format
A clause-by-clause breakdown of Clauses 4 through 8
How FDA’s current inspection program, Compliance Program 7382.850, reorganizes inspections around six QMS Areas
The most common audit findings tied to specific sub-clauses
Where risk management actually appears throughout the standard
How ISO 13485 clause numbering compares to ISO 9001
FAQs on structure, exclusions, and transition timing

👉 Start Here (Top Resources)

Buying the standard: Get the official ISO 13485:2016 text through ANSI Webstore — the authorized source, with international-language editions available for teams managing multi-region QMS documentation.
Training: ISO 13485 training through BSI Group — useful if your internal auditors need clause-level training before your next surveillance cycle.
Related standard: ISO 14971:2019 (risk management) — clause 7.1 of ISO 13485 leans directly on this standard, so most teams end up buying both.

ISO 13485 Clauses Explained: How the Standard Is Structured

ISO 13485 clauses explained with an eight-clause map covering the standard’s foundational and QMS requirement clauses — ISO 13485 clauses explained through an eight-clause map showing the foundational clauses and the five clauses containing QMS requirements.

ISO 13485:2016 is built around eight clauses. The first three are introductory — they define scope, point to normative references, and set terminology. They carry no auditable requirements on their own, but skipping them is a mistake most teams make once and then correct the hard way.

Clauses 4 through 8 are where the requirements live. This is the part of the standard your certification body actually audits against, clause by clause, sub-clause by sub-clause.

Here’s something worth knowing before you go further: ISO 13485 does not follow the Annex SL high-level structure that ISO 9001:2015, ISO 14001, and ISO 45001 all share. Those three standards align clause-for-clause at the top level, which is why integrated management systems work so cleanly across them. ISO 13485 kept its own structure when it was revised in 2016, specifically so it could stay independent of ISO 9001 revision cycles — a deliberate choice by the technical committee to protect regulatory stability for device manufacturers. If you’re coming from an ISO 9001 background, this is the first adjustment to make: don’t assume clause 7 means the same thing in both standards. It doesn’t.

Clauses 1 Through 3: No Requirements, But Don’t Skip Them

Clause 1 (Scope) defines what the standard covers and, critically, how exclusion and non-application work. ISO 13485 doesn’t let an organization simply skip a requirement that seems inconvenient — where a clause is excluded or considered non-applicable (say, you don’t perform installation), the scope and justification have to be documented in the quality manual under Clause 4.2.2, and be prepared to defend that justification during an audit.

Clause 2 (Normative References) points to ISO 9000:2015 for terms and definitions. You don’t need to buy ISO 9000 to comply, but auditors do expect your team to be using its vocabulary consistently — “nonconformity,” “corrective action,” and “verification” all carry specific meanings your documentation should match.

Clause 3 (Terms and Definitions) establishes the vocabulary used throughout the standard, including specific definitions for concepts like medical device, complaint, risk, and post-market surveillance. Getting comfortable with this terminology matters more than it looks like it should — auditors expect your documentation to use these terms precisely, not colloquially.

📥 Before diving into clauses 4-8: if your QMS documentation predates 2020, run it against the current ISO 13485 Documentation Requirements breakdown first. Most gaps trace back to documentation structure, not missing procedures.

Clause 4: Quality Management System

Clause 4 sets the general requirements for the QMS itself — and it’s where most audit programs start, because everything downstream depends on it.

4.1 General Requirements requires you to identify your QMS processes, map their sequence and interaction, and — this is the part that trips up contract manufacturers — maintain control over any process you outsource. Most common finding: outsourced processes (contract sterilization, contract testing, third-party calibration) that exist operationally but were never formally brought into QMS scope. If a supplier touches your product or your data, your QMS has to account for it.

4.2 Documentation Requirements covers the quality manual, the Medical Device File (Clause 4.2.3), document control, and record control. This requirement is specific to this standard — it’s not something ISO 9001 asks for. It’s a defined set of documents and references demonstrating a device meets its requirements throughout its lifecycle, and auditors will ask to see it assembled, not scattered across a dozen disconnected folders.

If your documentation still uses FDA’s old terminology, this is worth getting precise about. As of February 2, 2026, the terms Device Master Record, Device History Record, and Design History File no longer appear in 21 CFR Part 820. Those legacy record concepts weren’t simply eliminated; their applicable requirements are now addressed through the QMSR framework and ISO 13485’s own structure. Most of what a Device Master Record covered lives in the Medical Device File at Clause 4.2.3, while the Design History File corresponds to the Design and Development File at Clause 7.3.10. These aren’t simple one-for-one renamings: the Medical Device File in particular is a broader requirement than the DMR it replaced, so a straight terminology swap in your documentation will likely leave gaps a crosswalk exercise would catch.

Sub-clause 4.2.4 (control of documentation) and 4.2.5 (control of records) get their own scrutiny. Auditors typically check three things here: are documents reviewed and approved before use, is there a mechanism to prevent use of outdated versions, and are records retained for a defined, justified period. If you’re preparing for your first audit under this clause → build your document control procedure before you build anything else. Everything else in the QMS references it.

Clause 5: Management Responsibility

Clause 5 puts specific, named accountability on top management — not “the quality department,” but leadership itself.

This clause requires a documented quality policy, measurable quality objectives, evidence of planning for QMS changes, and a sub-clause I’ve seen come up repeatedly in audit findings — management review. Clause 5.6.2 is unusually prescriptive for an ISO standard: it names twelve required inputs, and a compliant management review record has to address all of them or document why one doesn’t apply — feedback, complaint handling, reporting to regulatory authorities, audits, monitoring and measurement of processes, monitoring and measurement of product, corrective action, preventive action, follow-up actions from previous reviews, changes that could affect the QMS, recommendations for improvement, and applicable new or revised regulatory requirements. A management review that skips several of these, or that doesn’t produce documented outputs and action items, is a finding waiting to happen — and under the current FDA inspection framework, it’s no longer just a certification-audit concern (more on that below).

If you are already ISO 9001 certified, this clause will feel familiar structurally — but ISO 13485 expects a tighter link between management review and regulatory requirements specifically, not just general business objectives.

Clause 6: Resource Management

Clause 6 covers human resources, infrastructure, and work environment — including contamination-control requirements under 6.4.2 that go considerably further than ISO 9001’s general treatment of work environment.

6.2 Human Resources requires documented competence for anyone whose work affects product quality — not just “trained,” but competence tied to education, skills, and experience, with evidence. 6.3 Infrastructure requires maintenance records for equipment critical to product conformity. 6.4 Work Environment and Contamination Control is where device manufacturers doing anything sterile, implantable, or otherwise contamination-sensitive get the most detailed scrutiny — cleanroom classifications, gowning procedures, and environmental monitoring data all trace back here.

Clause 7: Product Realization

Clause 7 is the largest clause in the standard, and it’s where design controls, purchasing, production, and servicing all live.

7.1 Planning of Product Realization is where ISO 13485 explicitly requires documented risk management processes within product realization, with records maintained throughout. The clause’s note points readers to ISO 14971 for further guidance on structuring that risk management activity — it’s a reference, not a formal incorporation, though in practice most organizations end up using ISO 14971’s framework to satisfy this requirement.

7.3 Design and Development is one of the sub-clauses most commonly identified as non-applicable by contract manufacturers who don’t design product — but where it applies, it can’t be excluded lightly, and the justification has to hold up to the same Clause 4.2.2 scrutiny as any other exclusion. If it applies to you, this is the densest technical section of the standard: design inputs, outputs, review, verification, validation, transfer, and change control, each with its own documented evidence trail. Most common finding: design changes made without running them back through the full verification/validation cycle, especially late in development when schedule pressure is highest.

7.4 Purchasing requires supplier evaluation criteria proportionate to risk, and re-evaluation triggers when supplier performance changes. 7.5 Production and Service Provision covers process validation for anything that can’t be fully verified by downstream inspection — sterilization is the textbook example, which is why it gets its own dedicated body of standards. 7.6 Control of Monitoring and Measuring Equipment ties directly into your calibration program.

If you are under customer or FDA pressure to show design control maturity quickly → prioritize closing out 7.3 documentation gaps before anything else in this clause. In my experience, it’s one of the first sections a regulatory reviewer or auditor asks to see in depth.

Clause 8: Measurement, Analysis and Improvement

Clause 8 is where the QMS proves it’s actually working — and where CAPA lives.

8.2 Monitoring and Measurement covers feedback, complaint handling, and internal audit. Complaint handling under this clause has to interface with FDA’s separate adverse-event reporting requirements — a complaint that may represent a reportable event under Medical Device Reporting (21 CFR Part 803) can’t remain solely an internal QMS record; it has to be evaluated independently against those reporting obligations.

8.3 Control of Nonconforming Product requires documented procedures for identifying, segregating, and dispositioning nonconforming product, including for product discovered nonconforming after delivery — which is where recall-adjacent procedures connect back into the standard.

8.5 Improvement is where corrective and preventive action requirements sit. CAPA under ISO 13485 requires root cause investigation, verification that the action taken was effective, and — a detail I’ve seen auditors check for specifically — evidence that you evaluated whether the same nonconformity could exist elsewhere in the organization before closing the CAPA. A CAPA record that fixes one instance without documenting that broader check is incomplete by this clause’s own standard, regardless of whether the immediate fix worked.

For a deeper breakdown of this clause specifically, see our full guide to CAPA requirements in ISO 13485.

Where ISO 13485 and FDA’s QMSR Overlap by Clause

FDA’s Quality Management System Regulation took effect February 2, 2026, incorporating ISO 13485:2016 by reference into 21 CFR Part 820. That’s the headline most coverage stopped at. What matters more for how you prepare is what happened on the inspection side the same day: FDA retired the Quality System Inspection Technique (QSIT), the inspection methodology it had used since 1999, and replaced it with a new compliance program manual — CP 7382.850, Inspection of Medical Device Manufacturers.

ISO 13485 clauses explained through the 2026 FDA QMSR inspection framework, including six QMS Areas and four OAFRs — ISO 13485 clauses explained in the context of the FDA QMSR and CP 7382.850 inspection framework effective February 2, 2026.

QSIT organized inspections around four subsystems. CP 7382.850 reorganizes them around six QMS Areas, each mapped to ISO 13485 clauses with FDA-specific requirements layered in:

Management Oversight — the QMS itself, management review, the medical device file, and product realization planning
Design and Development — design inputs, outputs, review, verification, validation, software validation, and transfer
Production and Service Provision — production planning, process validation, and servicing
Measurement, Analysis, and Improvement — complaint handling, feedback, internal audits, corrective and preventive action, and control of nonconforming product
Outsourcing and Purchasing — supplier evaluation and control
Change Control — how changes to product or process are managed and documented

Alongside the six QMS Areas, inspections also evaluate four Other Applicable FDA Requirements (OAFRs) that sit outside ISO 13485’s text entirely: Medical Device Reporting (21 CFR Part 803), Corrections and Removals reporting (21 CFR Part 806), Medical Device Tracking (21 CFR Part 821), and Unique Device Identification (21 CFR Part 830). This is where the clause structure above stops covering everything — these four areas are FDA-specific regulatory obligations, not ISO 13485 requirements. They’re evaluated during routine surveillance, compliance follow-up, and PMA postmarket inspections; a narrow exception can apply to certain PMA preapproval inspections when the manufacturer hasn’t yet introduced the device to the U.S. market.

The change that affects Clause 5 most directly: under the prior QSR, management review records were categorically exempt from FDA review under §820.180(c). Under CP 7382.850, that exemption is gone. Management review now sits squarely inside the Management Oversight QMS Area, and an investigator can ask to see it — which means the twelve required Clause 5.6.2 inputs covered above aren’t just a certification-audit concern anymore.

One caution worth stating plainly: ISO 13485 certification and FDA QMSR compliance are related but not identical. A QMS built cleanly against Clauses 4 through 8 covers the ISO 13485 core that QMSR incorporates, but it doesn’t automatically satisfy the four OAFRs — those require their own documented processes regardless of how strong your clause-by-clause QMS is.

If you’re not sure whether your current documentation satisfies both frameworks → our FDA QSR vs ISO 13485 comparison and MDSAP vs ISO 13485 breakdown both walk through this in more detail than fits here.

ISO 13485 vs ISO 9001: Same Numbers, Different Weight

Element	ISO 13485:2016	ISO 9001:2015
Structure	8 clauses, own structure (not Annex SL)	10 clauses, Annex SL high-level structure
Risk management	Documented risk management required in product realization (7.1); note references ISO 14971	Risk-based thinking, less prescriptive
Customer satisfaction monitoring	No direct ISO 9001-style requirement; feedback/complaints addressed via Clause 8.2	Explicit requirement (Clause 9.1.2)
Documentation	Medical device file required (Clause 4.2)	No equivalent requirement
Design controls	Detailed, mandatory unless justified exclusion	Less detailed by comparison
Regulatory link	Directly referenced in FDA QMSR (21 CFR 820)	Not tied to a specific regulation

The clause numbers look similar enough to cause real confusion — both standards use “Clause 7” for a large operational section, but the content underneath diverges substantially. If your organization holds both certifications, don’t assume a clause 7 audit finding under one standard tells you anything about your standing under the other. For the full comparison, see ISO 9001 vs ISO 13485.

The objection I hear most on this topic: “We’re already ISO 9001 certified — how much of this is actually new work?” Realistically, expect Clauses 5 and 6 to require the least rework, since management responsibility and resource management overlap heavily in intent. Clauses 4, 7, and 8 are where the medical device-specific requirements add real documentation and process work — the medical device file, design control rigor, and CAPA’s broader-impact evaluation aren’t things a general ISO 9001 QMS already has built in.

Most teams don’t fail an ISO 13485 audit because they misunderstood a clause. They fail because they assumed a documented procedure was enough without checking whether it actually produces the evidence an auditor will ask to see.

👉 Run a structured check before that assumption gets tested in front of an auditor → ISO 13485 Gap Assessment Checklist

Quick Clause Reference Checklist

A clause tells you what’s required. It doesn’t tell you what to hand an auditor when they ask for proof. Below is a quick translation — clause by clause, requirement to evidence.

ISO 13485 clauses explained through an audit evidence checklist showing objective evidence for Clauses 4, 5, 7, and 8 — ISO 13485 clauses explained through the objective evidence auditors may review for Clauses 4, 5, 7, and 8.

✅ Clause 4 — QMS scope defined, outsourced processes controlled, medical device file assembled
✅ Clause 5 — Quality policy documented, management review covering all required inputs
✅ Clause 6 — Competence records current, contamination controls documented where applicable
✅ Clause 7 — Risk management documented within product realization; ISO 14971 provides further guidance; design control records complete, supplier evaluation criteria defined
✅ Clause 8 — Complaint handling tied to regulatory reporting, CAPA records show broader-impact evaluation

⚠️ Clauses 1–3 — Exclusions and non-applicability justified in the quality manual, not just left blank

For implementation sequencing beyond the checklist above, our ISO 13485 Implementation Roadmap and ISO 13485 Gap Assessment: Step-by-Step Guide walk through the order to tackle these in.

FAQ

How many clauses does ISO 13485:2016 have?

Eight. Clauses 1 through 3 are introductory and carry no auditable requirements. Clauses 4 through 8 contain the substantive quality management system requirements that certification bodies audit against — and since February 2026, FDA investigators evaluate the same core requirements under Compliance Program 7382.850.

Does ISO 13485 follow the same structure as ISO 9001?

No. ISO 13485 does not use ISO’s Annex SL high-level structure, which ISO 9001, ISO 14001, and ISO 45001 all share. The technical committee kept ISO 13485 independent specifically to protect regulatory stability for device manufacturers, so clause numbers that look similar between the two standards often cover different scope.

Can I exclude clauses from ISO 13485?

Only with documented justification. Under Clause 4.2.2, the scope and justification for any exclusion or non-application have to be recorded in the quality manual, and you need to be prepared to defend that justification during an audit.

Which ISO 13485 clause covers risk management?

Clause 7.1 (Planning of Product Realization) is where documented risk management is explicitly required, and its note points to ISO 14971 for further guidance. But risk-related requirements aren’t confined to one clause — they surface throughout Clauses 4 through 8 rather than sitting in a single isolated section.

What’s the difference between ISO 13485 and the FDA’s QMSR?

As of February 2, 2026, FDA’s QMSR incorporates ISO 13485:2016 by reference into 21 CFR Part 820, and FDA’s inspection methodology changed to match — Compliance Program 7382.850 replaced QSIT the same day. The two frameworks are far more tightly aligned than before, but they’re not identical: four Other Applicable FDA Requirements (Medical Device Reporting, Corrections and Removals, Medical Device Tracking, and UDI) sit outside ISO 13485’s text and are evaluated in applicable inspection types, with a limited exception for certain PMA preapproval inspections when the device has not yet been introduced to the U.S. market.

What is CP 7382.850?

CP 7382.850 (Inspection of Medical Device Manufacturers) is FDA’s current compliance program manual for device inspections, effective February 2, 2026 alongside the QMSR. It replaced the Quality System Inspection Technique (QSIT) and reorganizes inspections around six QMS Areas — Management Oversight, Design and Development, Production and Service Provision, Measurement/Analysis/Improvement, Outsourcing and Purchasing, and Change Control — plus four Other Applicable FDA Requirements evaluated in most inspection types.

Do I need to buy ISO 9001 to understand ISO 13485’s terminology?

You don’t need to purchase it, but ISO 13485 does reference ISO 9000:2015 for its terms and definitions, and auditors expect consistent use of that vocabulary in your documentation.

Which clauses deserve the closest audit preparation?

In practice, Clause 4.2 (documentation control), Clause 7.3 where applicable (design and development), and Clause 8.5 (CAPA effectiveness) tend to draw sustained attention, largely because each requires ongoing documented evidence rather than a one-time procedure. The exact focus varies by organization, device type, and regulatory scope — under the current FDA inspection framework, Management Oversight and Measurement, Analysis, and Improvement are evaluated on every inspection regardless of device type.

Is a documentation kit enough to get ISO 13485 clause requirements right?

A kit gives you a starting structure, but clause-by-clause compliance depends on evidence specific to your processes — training records, design and development records, CAPA effectiveness checks. Our ISO Documentation Kits for Manufacturers page breaks down what a kit does and doesn’t cover.

📥 Free Resources

ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification

Not Sure What to Do Next?

🔹 Still researching how the clauses fit together? Start with What Is ISO 13485? for the foundational overview before working through this clause breakdown a second time.

🔹 Ready to assess where your QMS actually stands? Run the ISO 13485 Gap Assessment Checklist against the clause list above — it’s built to map directly to Clauses 4 through 8.

🔹 Need the official standard text to cite exact clause language? Purchase ISO 13485:2016 through ANSI Webstore — use code CC2026 for 5% off through December 31, 2026. International-language editions are available for teams managing documentation across multiple regulatory regions.

🔹 Need your internal auditors trained on this clause structure before your next surveillance audit? ISO 13485 training through BSI Group covers the structure clause by clause with a certification body’s own instructors.

The Standards Navigator breaks down what these clauses actually demand — not just what they’re titled — so your team can walk into an audit knowing which sub-clause the finding will land on before it does.

Stay Ahead of Clause-Level Changes

Most QMS documentation doesn’t fail because a team ignored ISO 13485. It fails because someone mapped a procedure to the wrong clause once, early on, and every review since has confirmed the wrong thing.

Organizations that treat the clause structure above as a living reference — checked against actual audit findings, updated as FDA’s QMSR enforcement approach becomes clearer — walk into surveillance audits with far fewer surprises than organizations treating their quality manual as a document they wrote once and filed away.

The Standards Navigator tracks ISO 13485, QMSR, and the surrounding medical device standards landscape as they develop, not just at certification time.

👉 Get updates on ISO 13485 and medical device QMS requirements
👉 Be first to access new gap assessment tools and clause-mapping resources

Industrial Compliance. Clearly Explained.

ISO 13485 Gap Assessment: A Step-by-Step Guide for Medical Device Manufacturers (2026)

Learn how to run an ISO 13485 gap assessment step by step — from scoping and clause mapping to grading findings and building a remediation timeline before your certification audit.

How to run an ISO 13485 gap assessment before your certification body ever sees your QMS.

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Gap Assessment Is the Step Most Manufacturers Skip

Many manufacturers don’t discover their biggest ISO 13485 gaps until they systematically compare their QMS against the standard.

An ISO 13485 gap assessment gives you a structured way to find those gaps before your certification body does. It’s a clause-by-clause comparison of your current quality management system against what ISO 13485:2016 actually requires — and it’s one of the highest-leverage steps between “we think we’re ready” and “we’re ready for Stage 1.”

This guide walks through the gap assessment process step by step: how to scope it, how to run it, how to grade what you find, and how to turn the results into a remediation plan your team can actually execute before your audit window opens.

From the Floor: As a certified ISO 9001 Internal Auditor, the pattern I see most often in gap assessments — regardless of which standard is on the cover — is a QMS that has real documentation but no clause map. Procedures exist. Records exist. But nobody has walked the standard clause by clause and confirmed each requirement actually has evidence behind it. That’s exactly what a gap assessment is designed to expose, and finding it internally gives your team more control over the remediation timeline than discovering it during certification.

Before you build a remediation plan, you need to know where the gaps actually are. Run the free ISO 13485 Gap Assessment Checklist and get a clause-by-clause starting point for your own QMS.

In This Guide

What an ISO 13485 gap assessment actually is, and how it differs from an internal audit
The eight-step process, from scoping to remediation
How to grade findings so your team knows what to fix first
A readiness checklist for what “gap-assessed” should actually mean
Answers to the questions manufacturers ask most before their first assessment

👉 Start Here (Top Resources)

Own the standard you’re assessing against: ISO 13485:2016 — ANSI Webstore — you can’t run an accurate gap assessment without the current clause text in front of you. Use code CC2026 for 5% off through December 31, 2026.
Close the gaps once you find them: 9001Simplified — documentation kits built for manufacturers who need to build or rebuild QMS documentation without hiring a full-time consultant.
Get your team trained on the requirements before they run the assessment: ISO 13485 Training — BSI Group — a team that understands the clause structure finds gaps faster and more accurately than one working from intuition.

What an ISO 13485 Gap Assessment Actually Is

A gap assessment is not an audit. It’s not a certification activity, and no external party has to be involved. It’s an internal, structured comparison: for every requirement in ISO 13485:2016, does your QMS have documented evidence that requirement is met — and if not, how far off is it?

That distinction matters because it changes the tone of the exercise. An internal audit (covered in our guide on how to audit a medical device QMS) assumes a QMS is largely built and tests whether it’s being followed. A gap assessment assumes nothing — it’s asking “does this exist at all, and if it does, is it complete.”

Gap Assessment vs. Internal Audit

	Gap Assessment	Internal Audit
Primary question	Does the requirement and supporting evidence exist?	Is the QMS being followed and operating effectively?
Typical timing	Often performed during QMS development or transition	Performed as part of the established audit program
Main output	Gap list and remediation plan	Audit findings and corrective action
Evidence examined	Documents, records, and implementation evidence	Process implementation, records, and objective evidence
Purpose	Identify what needs to be built, changed, or strengthened	Evaluate conformity and implementation of the established QMS

Quick Answer

Question	Quick Answer
Is a gap assessment required for ISO 13485 certification?	No. It’s not a formal requirement of the standard, but it’s a practical risk-reduction step manufacturers can use to identify gaps before a certification audit.
How long does a gap assessment take?	As a planning estimate, a single-site manufacturer with an existing QMS might spread the assessment across roughly 2–4 weeks of part-time effort. Actual duration varies significantly with QMS maturity, scope, number of sites, product lines, and team availability.
Can I do a gap assessment myself, or do I need a consultant?	You can do it yourself with a structured checklist and a working knowledge of the standard. Consultants add value for complex or first-time QMS builds, but the assessment itself doesn’t require outside certification.
What’s the difference between a gap assessment and an internal audit?	A gap assessment checks whether documentation and evidence exist against each clause. An internal audit checks whether an existing, documented QMS is actually being followed in practice.

The Eight-Step Gap Assessment Process

Step 1: Define Scope and Assemble Your Team

Before you open the standard, decide what’s actually in scope. Which sites? Which product lines? Which regulatory markets — because that determines which country-specific requirements layer on top of the ISO 13485 baseline. If you’re weighing whether MDSAP applies to your assessment scope, our MDSAP vs ISO 13485 guide walks through that decision separately.

Assemble a small cross-functional team — quality, at minimum, plus whoever owns design, production, and supplier management. A gap assessment run entirely by one person in the quality department tends to miss operational gaps that only show up on the floor.

Step 2: Gather Current QMS Documentation

Pull everything: your quality manual, procedures, work instructions, forms, records, and any prior audit findings — internal or external. If your document control system is disorganized, this step alone often reveals your first gap. See our guide on ISO 13485 documentation requirements for what a complete document set should include.

Step 3: Build Your Clause Map

At a high level, ISO 13485:2016 organizes its requirements across five main clause groups: Quality Management System (Clause 4), Management Responsibility (Clause 5), Resource Management (Clause 6), Product Realization (Clause 7), and Measurement, Analysis and Improvement (Clause 8). Build a simple matrix — clause number down one side, your corresponding procedure or record down the other. Anywhere that cell is blank is your first visible gap, before you’ve even started evaluating quality.

ISO 13485 gap assessment clause map connecting requirements to procedures, records, and objective evidence — An ISO 13485 gap assessment clause map connects each requirement to the corresponding QMS procedure, work instruction, records, and objective evidence.

Step 4: Walk Each Clause Against the Evidence

This is the core of the assessment. For each clause, ask three questions: Does a documented procedure exist? Does it match what the standard actually requires — not just what sounds similar? And is there objective evidence (records, forms, logs) that the procedure is being followed, not just written?

CAPA is worth flagging specifically here because it requires the team to connect nonconformance, root cause, corrective action, and effectiveness verification across the QMS. Our breakdown of CAPA requirements under ISO 13485 covers what auditors expect to see connected — traceable within the QMS rather than reconciled manually across separate systems.

This is often where gap assessments slow down because the work is tedious, not because it’s conceptually difficult. If your team needs a structured starting point instead of building the clause matrix from scratch → Run the free ISO 13485 Gap Assessment Checklist.

ISO 13485 gap assessment showing how procedures, records, and objective evidence demonstrate QMS conformity — An ISO 13485 gap assessment should verify not only that procedures exist, but that records provide objective evidence the QMS is being followed.

Step 5: Grade Each Finding

Not every gap carries the same weight. A missing signature on a training record is not the same category of problem as a design control process that doesn’t exist. Grade findings on a simple scale:

Critical — the requirement is effectively absent. No procedure, no evidence, no compensating control.
Major — a procedure exists but has a significant gap against the clause requirement, or evidence of following it is inconsistent.
Minor — the procedure and evidence both exist, but execution has small, correctable inconsistencies.

Grading matters because it drives sequencing. These labels are an internal prioritization framework, not ISO 13485-defined finding classifications — the exact grading terminology and criteria used by a certification body or regulatory program can vary. For an internal assessment, the important thing is to apply your criteria consistently so the team knows which gaps require immediate attention.

Step 6: Prioritize Remediation

Start with the gaps that present the greatest risk to QMS conformity or product and regulatory compliance. In most cases, that means addressing foundational gaps such as a missing design-control process or nonexistent CAPA system before working through lower-risk administrative issues. Major findings come next, typically grouped by clause area so one person or team can work through related gaps together rather than jumping between unrelated processes.

If you are rebuilding documentation from a critical or major finding → start with the clause itself, not a generic template. A procedure written to satisfy a checklist item without matching your actual process creates a new gap the moment an auditor asks a follow-up question.

If you are working through a backlog of minor findings → batch them by owner and set a single close-out date rather than tracking dozens of individual deadlines. Minor findings left open individually tend to get lost; batched with a deadline, they get closed.

Step 7: Build a Remediation Timeline

Attach real dates to every finding, not target quarters. Critical findings should have the shortest timeline your team can realistically execute — these are the gaps most likely to create significant problems during a certification assessment if they remain unresolved. Build in a buffer before your target certification audit date; remediation almost always takes longer than the first estimate, especially where a new procedure requires training staff to actually follow it.

Step 8: Re-Assess Before You Schedule Your Audit

A gap assessment isn’t a one-time snapshot. Once remediation work closes out your critical and major findings, re-walk those specific clauses to confirm the fix actually holds — not just that a document was updated, but that the evidence trail behind it exists. This is also the point where many manufacturers benefit from a full internal audit as a final check before scheduling Stage 1.

Common Mistakes That Undermine a Gap Assessment

Treating the assessment as a documentation review only. Confirming a procedure exists isn’t the same as confirming it’s followed. A gap assessment that never looks at records — training logs, CAPA files, supplier evaluations — will miss exactly the kind of gap an auditor finds first, because auditors ask for objective evidence, not just the procedure. Our guide on common mistakes in ISO 13485 QMS implementation covers this pattern in more depth.

Assessing against an old edition of the standard. ISO 13485:2016 is the current edition, but manufacturers working from a QMS built years ago sometimes have procedures written against superseded clause numbering. Confirm you’re assessing against the current published text before you start building your clause matrix.

Skipping the connection to FDA’s QMSR. If you sell into the United States, consider whether your gap assessment also needs to address FDA’s QMSR requirements and inspection expectations — FDA’s QMSR, effective February 2, 2026 and incorporating ISO 13485:2016 by reference, expanded what FDA can review during an inspection. Records that were previously exempt from routine inspection under the legacy QSR — management review, internal quality audit, and supplier audit records — are not exempt under QMSR. That’s worth building into your assessment scope rather than assuming an ISO 13485-only assessment automatically covers it.

Gap Assessment Readiness Checklist

✅ Scope defined — sites, product lines, and regulatory markets confirmed
✅ Cross-functional team assembled, not just quality department staff
✅ Full current QMS documentation set gathered and organized
✅ Clause matrix built against ISO 13485:2016, Clauses 4 through 8
✅ Each clause walked against both procedure and objective evidence, not procedure alone
✅ Findings graded — critical, major, minor — using consistent criteria
✅ Remediation timeline built with real dates, prioritized by severity
✅ Critical and major findings re-assessed after remediation, before scheduling your audit

ISO 13485 gap assessment process showing how manufacturers find, prioritize, remediate, and re-assess QMS gaps before certification — An ISO 13485 gap assessment turns identified QMS gaps into a prioritized remediation plan, followed by verification and re-assessment before the certification audit.

Frequently Asked Questions

Is a gap assessment required before ISO 13485 certification?

No. It’s not a formal requirement in the standard itself. It’s a risk-reduction step manufacturers use to avoid discovering major or critical nonconformities for the first time during an actual certification audit, where findings can delay certification.

How is a gap assessment different from an internal audit?

A gap assessment asks whether documentation and evidence exist at all against each clause — it’s typically run once, early, often before a QMS is fully built out. An internal audit assumes a documented QMS exists and tests whether it’s actually being followed in day-to-day operation. A common approach is to run the gap assessment first, then use internal audits on a recurring schedule once the QMS is established.

Who should be involved in a gap assessment?

At minimum, someone from quality who knows the standard well enough to interpret clause intent, plus representation from any function the clauses touch directly — design, production, supplier management. A single-person assessment tends to miss operational gaps that only surface when someone from outside quality reviews the finding.

How long does a gap assessment typically take?

As a planning estimate, a manufacturer with an existing QMS and a single site in scope might spread the assessment across roughly 2–4 weeks of part-time effort. Actual duration varies significantly with QMS maturity, scope, number of sites, product lines, and team availability — manufacturers building a QMS from scratch, or with multiple sites in scope, should expect it to take longer.

Can I use the same gap assessment for MDSAP readiness?

Largely, yes — MDSAP audits use ISO 13485:2016 requirements alongside applicable regulatory requirements from participating authorities, so a thorough ISO 13485 gap assessment covers most of the same ground. MDSAP layers those country-specific regulatory requirements on top of the ISO 13485 baseline, so if MDSAP is in scope, your assessment should also map those additional requirements. See our MDSAP vs ISO 13485 guide for how the two relate.

What happens if I find a critical gap close to my planned audit date?

Push the audit date. Scheduling a certification audit around a known critical gap doesn’t make the gap disappear — it moves the risk of discovering that gap into the certification audit, where the certification body will determine whether the issue constitutes a nonconformity and how it should be classified, instead of remaining an internal finding you controlled the timeline on.

Do I need a consultant to run a gap assessment?

Not necessarily. A structured checklist and a working knowledge of the standard’s clause structure is enough for most single-site manufacturers with an existing QMS. Consultants add the most value for first-time QMS builds, multi-site assessments, or situations where the internal team lacks bandwidth to run the assessment alongside daily operations.

📥 Free Resources

ISO 13485 Gap Assessment Checklist — free clause-by-clause checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements.
ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system.
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments.
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts.
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification.

Not Sure What to Do Next?

🔹 Still figuring out where your QMS stands? Start with the ISO 13485 Gap Assessment Checklist — it’s the fastest way to see your clause-by-clause starting point before you build a full remediation plan.

🔹 Ready to close documentation gaps you’ve already identified? 9001Simplified’s documentation kits are built for manufacturers assembling or rebuilding QMS documentation without a full-time consultant.

🔹 Need to confirm your clause matrix against the current standard? Get ISO 13485:2016 from ANSI Webstore — code CC2026 takes 5% off through December 31, 2026.

🔹 Want your team trained before they run the assessment? BSI Group’s ISO 13485 training builds the clause knowledge that makes a gap assessment faster and more accurate.

Treating a gap assessment as a formality can leave significant gaps undiscovered until the certification audit. A properly executed assessment gives your team an opportunity to find those gaps internally, assign ownership, and control the remediation timeline before the certification audit begins. The Standards Navigator will keep this guide current as ISO 13485 and its related regulatory frameworks continue to evolve.

Stay Ahead of Your Next Audit Cycle

Skipping the gap assessment step doesn’t remove the risk of undiscovered gaps — it increases the chance that a gap will first be identified during the certification process, in front of an auditor, where the certification body determines whether it constitutes a nonconformity. Running it properly moves that discovery earlier, onto your own timeline, with your team in control of the fix.

The Standards Navigator tracks how ISO 13485, MDSAP, and FDA’s QMSR continue to shift so your QMS doesn’t fall behind a requirement you didn’t know had changed.

👉 Get updates on ISO 13485 requirements and medical device compliance as they happen
👉 Be first to access new gap assessment tools and documentation resources as we build them

Industrial Compliance. Clearly Explained.

MDSAP vs ISO 13485: What’s the Difference and Do You Need Both in 2026?

MDSAP and ISO 13485 are often confused, but they answer different questions. This guide breaks down how the MDSAP audit program relates to the ISO 13485:2016 standard, what changed with FDA’s 2026 QMSR, and which manufacturers actually need MDSAP registration.

Whether the MDSAP consolidated audit program adds real value to your QMS — or scope you don’t need yet.

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

Two Audits, One QMS Standard — and a Decision Most Manufacturers Get Wrong

MDSAP vs ISO 13485 is a distinction worth getting right before you scope an audit program: these are not competing options, and they are not two paths to the same certificate. Treating them as interchangeable is exactly how manufacturers end up either over-auditing themselves or discovering — mid-application — that a market they assumed was covered isn’t.

If you sell into more than one of the five MDSAP countries, this decision affects your audit calendar, your registrar spend, and your regulatory submission timeline for years. If you sell only into the EU or UK, most of what follows doesn’t apply to you at all — and that’s worth knowing before you spend a quarter evaluating a program you don’t need.

This guide breaks down exactly what MDSAP is, how it relates to ISO 13485:2016, and — now that the FDA’s Quality Management System Regulation has replaced the legacy 21 CFR Part 820 — what changed for US-market manufacturers in 2026.

From the Floor: With 25+ years in heavy industrial manufacturing and a certified ISO 9001 Internal Auditor credential, I’ve seen the same regulated-QMS failure pattern show up regardless of which standard is on the cover — 9001 or 13485. It’s not missing documentation. It’s documentation that exists but doesn’t connect: a CAPA log that references a nonconformance report that was never actually closed out in the corrective action file. Stack five regulatory authorities’ expectations on top of each other instead of one, and that gap can become a nonconformity that appears in the MDSAP audit record used by the participating Regulatory Authorities.

Before you evaluate MDSAP, confirm your QMS actually conforms to ISO 13485:2016 first — MDSAP audits against it, it doesn’t substitute for it. Run the free ISO 13485 Gap Assessment Checklist and see exactly where your documentation stands before you add audit scope on top of it.

In This Guide

What MDSAP actually is, and how it relates to ISO 13485:2016
A side-by-side comparison of both frameworks
What changed in 2026 with the FDA’s QMSR and the revised MDSAP Audit Approach
Decision-stage signals for whether MDSAP applies to your business
What MDSAP costs — and what it saves — compared to separate country audits
Documentation issues that can create problems in MDSAP-scope audits
A readiness checklist and answers to the questions manufacturers ask most

👉 Start Here (Top Resources)

Own the standard MDSAP is built on: ISO 13485:2016 — ANSI Webstore — the foundation document every MDSAP audit is measured against. Use code CC2026 for 5% off through December 31, 2026.
Close documentation gaps before you’re audited on them: 9001Simplified — documentation kits built for manufacturers assembling or tightening a QMS without hiring a full-time consultant.
Get your team trained on the underlying requirements: ISO 13485 Training — BSI Group — BSI is one of the Auditing Organizations recognized under MDSAP, and their training builds the ISO 13485 foundation your audit is scored against.

What Is ISO 13485, and What Is MDSAP Built on Top Of It?

ISO 13485:2016 is the quality management system standard for medical device manufacturers. It’s a standalone document you can certify to on its own — covered in detail in our What Is ISO 13485 guide.

MDSAP (Medical Device Single Audit Program) is not a standard. It’s a regulatory audit program. Five participating Regulatory Authorities — Australia’s TGA, Brazil’s ANVISA, Health Canada, Japan’s MHLW/PMDA, and the U.S. FDA — use a single consolidated audit, conducted by an MDSAP-recognized Auditing Organization, to assess the applicable QMS and regulatory requirements across participating markets, rather than requiring separate audits from each regulator. That audit is scored against ISO 13485:2016 as the baseline, with country-specific regulatory requirements layered on top for each market a manufacturer participates in.

Standalone ISO 13485 certification, by contrast, is issued by certification bodies accredited through national accreditation bodies — in the US, that’s typically ANAB. MDSAP Auditing Organizations go through a separate recognition process run directly by the participating Regulatory Authorities, not through the standard accreditation pathway.

In plain terms: ISO 13485 is what you’re audited against. MDSAP is who accepts that audit, and how many regulators it satisfies at once.

Quick Answer

Question	Quick Answer
Is MDSAP the same as ISO 13485?	No. MDSAP is a multi-country regulatory audit program built on top of ISO 13485:2016 — it doesn’t replace the standard, it audits against it plus country-specific requirements.
Do I need ISO 13485 certification before MDSAP?	No. Your QMS must conform to ISO 13485:2016, but you don’t necessarily need a separate ISO 13485 certificate before undergoing an MDSAP audit — the MDSAP audit itself assesses that conformance.
Is MDSAP required?	Only for Class II–IV Canadian market access. In the other participating MDSAP markets, participation is generally voluntary, although it can consolidate applicable regulatory assessments across multiple markets.
Does MDSAP replace FDA inspections entirely?	No. MDSAP audit results can be used by FDA within its regulatory program, but FDA retains its authority to conduct inspections, including for-cause inspections.

MDSAP vs ISO 13485: Side-by-Side

Category	ISO 13485:2016	MDSAP
What it is	A quality management system standard	A multi-jurisdiction regulatory audit program
Basis	Standalone document	Built on ISO 13485:2016 plus country-specific regulatory requirements
Who administers it	Certification bodies accredited by ANAB or an equivalent accreditation body	Auditing Organizations recognized by the five participating Regulatory Authorities
Countries covered	Global — recognized wherever ISO 13485 certification is accepted	Australia, Brazil, Canada, Japan, United States
Can you buy it?	Yes — it’s a purchasable standard document	No — it’s an audit program, not a document
Mandatory?	Often required by customers, notified bodies, or regulators (EU MDR, for example)	Mandatory only for Class II–IV Canadian market access; voluntary elsewhere
Audit frequency	Per your certification body’s surveillance schedule — typically annual	Initial audit followed by annual surveillance audits within the certification cycle
What you get	An ISO 13485 certificate	An MDSAP certification document and audit report each participating Regulatory Authority can use within its own regulatory program

For the broader question of how ISO 13485 stacks up against the standard most manufacturers compare it to first, see ISO 9001 vs ISO 13485.

The 2026 Regulatory Shift: QMSR and the Revised MDSAP Audit Approach

MDSAP vs ISO 13485 infographic showing the 2026 FDA QMSR transition and changes to medical device quality records — MDSAP vs ISO 13485: The 2026 FDA QMSR aligns U.S. medical device quality requirements with ISO 13485:2016 and changes FDA access to management review, internal audit, and supplier audit records.

Two changes landed in 2026 that directly affect this comparison.

On February 2, 2026, the FDA’s Quality Management System Regulation (QMSR) officially took effect, replacing the legacy 21 CFR Part 820 Quality System Regulation and incorporating ISO 13485:2016 by reference. That doesn’t make US manufacturers MDSAP-compliant automatically — it means the US regulatory baseline now speaks the same structural language as ISO 13485, closing a gap that used to require manufacturers to maintain two separate documentation logics. We cover the mechanics of that shift in FDA QSR vs ISO 13485.

The QMSR also removed a long-standing FDA inspection exemption. Under the prior QSR, §820.180(c) shielded management review records, internal quality audit reports, and supplier audit reports from routine FDA inspection. The QMSR eliminates that exemption entirely — FDA’s own QMSR FAQ confirms investigators now have authority to review management review, quality audit, and supplier audit records as part of a standard inspection. For manufacturers who treated those records as internal-only, that’s a meaningful shift in what “audit-ready” documentation needs to look like.

Around the same window, the MDSAP Regulatory Authority Council released a revised Audit Approach document (MDSAP AU P0002.010), updating the audit sequence and process guidance auditors use during MDSAP assessments. If your last MDSAP audit was conducted under the prior version, don’t assume your documentation package is still current against the revised approach — verify against the current edition before your next audit window.

It can be tempting to assume that QMSR compliance automatically covers MDSAP scope. It doesn’t — QMSR alignment closes the gap between the US baseline and ISO 13485, but MDSAP still layers the applicable regulatory requirements of each participating jurisdiction on top of that baseline. Check where your QMS actually stands before you assume you’re covered → Run the ISO 13485 Gap Assessment Checklist.

Do You Need MDSAP? Decision-Stage Signals

If you are selling only into the EU or UK → you still need to meet the applicable medical-device QMS and conformity-assessment requirements for those markets, but MDSAP is not generally required there.
If you are selling into Canada at Class II, III, or IV → MDSAP is mandatory. Health Canada requires an MDSAP certificate, issued by a recognized MDSAP Auditing Organization, as part of the device license application.
If you sell into several of the five MDSAP countries → compare the cost and disruption of MDSAP against the separate regulatory assessments that would otherwise apply. Three or more can be a useful practical threshold for comparison, but the right number depends on your specific audit costs, inspection history, device scope, and market plans.
If you are already ISO 13485 certified and sell only into the US → weigh MDSAP against your actual FDA inspection frequency and any near-term expansion plans before adding audit scope you may not need yet.

MDSAP decision flowchart showing when medical device manufacturers need MDSAP for Canada and when it is generally voluntary in other markets — A practical MDSAP decision guide showing when certification is required for Canadian Class II–IV devices and when manufacturers should evaluate MDSAP based on market scope, audit costs, and regulatory strategy.

What MDSAP Actually Costs You — And What It Saves

The most common objection we hear is straightforward: MDSAP audits cost more than a standard ISO 13485 surveillance audit, so why add the expense?

That’s true in isolation — an MDSAP audit typically runs longer and costs more per audit day than a single-standard ISO 13485 surveillance visit, because the auditor is assessing conformance to multiple regulatory frameworks in one visit. But the comparison that matters isn’t MDSAP audit cost versus ISO 13485 audit cost. It’s MDSAP audit cost versus the combined cost of separate inspections from Health Canada, ANVISA, TGA, and PMDA, run independently, on different schedules, each requiring separate audit prep. For manufacturers selling across several MDSAP markets, the consolidation can make the overall audit program less costly and less disruptive than managing multiple separate regulatory assessments — but the business case depends on device classification, facility count, audit scope, your Auditing Organization, and your existing inspection cadence, so get a scoped quote rather than budgeting off a generic number.

Manufacturers building out documentation to support a broader audit scope shouldn’t be doing it from scratch. If your QMS documentation isn’t structured to hold up under multiple regulatory frameworks at once, that’s the gap to close first → 9001Simplified’s documentation kits are built for exactly this kind of consolidation work.

Documentation Issues That Can Create Problems in MDSAP Readiness

One area worth checking closely is CAPA traceability. CAPA records should connect clearly to the underlying nonconformance, investigation, corrective action, and effectiveness evidence, rather than leaving the auditor to reconcile separate systems manually — see our breakdown of common mistakes in ISO 13485 QMS implementation and the full CAPA requirements under ISO 13485 for what auditors expect to see connected.

Another area to review is how regulatory requirements are mapped into the QMS. MDSAP audits ISO 13485 alongside applicable jurisdiction-specific requirements, so documentation that only reflects one regulator’s language may need additional mapping before an MDSAP audit. Our guide on ISO 13485 documentation requirements covers how to structure it correctly the first time.

MDSAP vs ISO 13485 readiness infographic showing CAPA traceability, document control, regulatory mapping, internal audits, and audit evidence — MDSAP vs ISO 13485: MDSAP readiness depends on connected evidence across CAPA, document control, regulatory mapping, internal audits, and market scope.

MDSAP Readiness Checklist

✅ QMS is currently certified — or verified compliant — to ISO 13485:2016
✅ CAPA records cross-reference nonconformance reports within the QMS itself, not a separate tracking tool
✅ Document control system is organized by ISO 13485 clause structure, not by individual regulator language
✅ You’ve confirmed which of the five MDSAP countries you actually sell into or plan to
✅ You’ve reviewed your documentation against the revised MDSAP Audit Approach (AU P0002.010)
✅ You’ve scoped audit cost and timeline with an MDSAP-recognized Auditing Organization
✅ Internal audit process already traces process interactions, not just individual clause compliance — see how to audit a medical device QMS

Frequently Asked Questions

Is MDSAP the same thing as ISO 13485?

No. ISO 13485:2016 is the quality management system standard. MDSAP is a regulatory audit program that assesses conformance to that standard, plus country-specific requirements from five participating Regulatory Authorities, in a single consolidated audit.

Do I need to be ISO 13485 certified before I can apply for MDSAP?

Your QMS needs to conform to ISO 13485:2016 — MDSAP auditors assess that conformance directly as part of the MDSAP audit itself. In practice, most manufacturers already hold or are pursuing ISO 13485 certification before entering the MDSAP process.

Which countries does MDSAP cover?

Five participating Regulatory Authorities: Australia (TGA), Brazil (ANVISA), Canada (Health Canada), Japan (MHLW/PMDA), and the United States (FDA). A number of other regulators participate as observers or affiliate members without full recognition of MDSAP audit results.

Is MDSAP required to sell medical devices in the United States?

No. The FDA accepts MDSAP audit results as part of its compliance program, and the 2026 QMSR incorporates ISO 13485:2016 by reference, but MDSAP participation itself remains voluntary for US-only manufacturers.

How did the FDA’s 2026 QMSR change affect MDSAP?

The QMSR, effective February 2, 2026, replaced 21 CFR Part 820 and incorporated ISO 13485:2016 by reference — narrowing the gap between US regulatory expectations and the ISO 13485 baseline that MDSAP already audits against. It doesn’t grant automatic MDSAP compliance; it changes what the US regulatory floor requires your documentation to look like.

How much does an MDSAP audit cost compared to a standard ISO 13485 audit?

MDSAP audits generally run longer and cost more per audit than a single-standard ISO 13485 surveillance audit, since the scope covers multiple regulatory frameworks in one visit. Pricing varies significantly by Auditing Organization, facility count, and audit scope — get a quote scoped to your specific situation rather than relying on a general figure.

Can a small manufacturer participate in MDSAP?

Yes. Any manufacturer with a product that falls under the scope of at least one participating Regulatory Authority may apply. It tends to make the most financial sense for manufacturers selling into several of the five MDSAP countries, where consolidating audits can produce clearer savings — though the exact threshold depends on your specific cost structure.

Does an MDSAP certificate replace my ISO 13485 certificate?

Not automatically, and it depends on the market. In Canada, the MDSAP certificate has replaced the standalone ISO 13485 certificate in the device license application process for Class II–IV devices. In most other participating markets, manufacturers typically maintain both, since ISO 13485 certification is often required independently by customers or notified bodies.

📥 Free Resources

ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements before pursuing MDSAP or standalone certification.
ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system.
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments.
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts.
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification.

Not Sure What to Do Next?

🔹 Still researching whether MDSAP applies to you? Start with the ISO 13485 Gap Assessment Checklist — confirm your QMS conforms to ISO 13485:2016 before you evaluate adding MDSAP scope on top of it.

🔹 Ready to close documentation gaps before your next audit? 9001Simplified’s documentation kits are built for manufacturers structuring a QMS to hold up under more than one regulatory framework at once.

🔹 Need to buy the ISO 13485:2016 standard itself? Get it directly from ANSI Webstore — code CC2026 takes 5% off through December 31, 2026.

🔹 Want your team trained on the requirements before your MDSAP audit? BSI Group’s ISO 13485 training builds the foundation MDSAP auditors score against.

MDSAP isn’t a bigger version of ISO 13485 certification — it’s a different question entirely: not “is your QMS compliant,” but “how many regulators can rely on the same answer.” Get that distinction right before you scope an audit program you may not need, or miss one you do. The Standards Navigator will keep tracking how MDSAP and the 2026 QMSR shift continue to interact as more guidance comes out.

Stay Ahead of the Next Regulatory Shift

Manufacturers who treat MDSAP as “extra paperwork” usually find out the hard way — mid-application, with a Canadian import deadline already on the calendar. Manufacturers who map their audit scope to their actual markets first spend less on audits and never scramble for a certificate they didn’t know they’d need.

The Standards Navigator tracks how ISO 13485, MDSAP, and FDA’s QMSR continue to shift against each other so you don’t have to monitor five regulators’ guidance pages yourself.

👉 Get updates on medical device compliance and regulatory changes as they happen
👉 Be first to access new gap assessment tools and documentation resources as we build them

Industrial Compliance. Clearly Explained.

ISO/TR 14969 Explained: What It Was, Why It Was Withdrawn, and What Replaces It in 2026

ISO/TR 14969:2004 — the companion guidance document for ISO 13485:2003 — was officially withdrawn when ISO 13485 was revised to its 2016 edition. Quality professionals still referencing it in QMS procedures are citing an obsolete document. This article explains what ISO/TR 14969 covered, why it was withdrawn, and what replaces it: the ISO 13485:2016 Practical Guide.

The guidance document for ISO 13485 has changed — here’s what medical device quality professionals need to know today

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Standard That Guided ISO 13485 Compliance Is Gone — Here’s What That Means

If you searched for ISO/TR 14969, you already ran into a dead end. The document is no longer current. It was officially withdrawn.

That matters more than it sounds. Quality professionals in the medical device space still reference ISO/TR 14969 in internal procedures, training materials, and supplier documentation. Some consultants still cite it. If you are building or auditing a QMS right now, you need to know what replaced it — and whether your documentation is anchored to an obsolete source.

ISO/TR 14969:2004 was withdrawn by ISO when ISO 13485 was revised to its 2016 edition. The technical report was tied to ISO 13485:2003. When the 2016 version introduced risk-based process controls, expanded post-market surveillance requirements, and global regulatory alignment language, the 2004 guidance became misaligned — and in some clauses, actively misleading. In its place, ISO published a new handbook: ISO 13485:2016 — Medical Devices — A Practical Guide.

Now, in 2026, the stakes are higher. The FDA’s Quality Management System Regulation (QMSR) took effect February 2, 2026, formally replacing 21 CFR Part 820 with ISO 13485:2016 as the baseline for U.S. device compliance. Organizations that built their QMS on ISO 13485:2003 interpretations — or whose procedures still reference ISO/TR 14969 — face a two-layer exposure: outdated guidance and regulatory non-alignment.

I’ve seen this pattern play out in quality systems that looked solid on paper. During a QMS documentation review I supported at a contract manufacturer with FDA-regulated device components, the team found five procedures that traced their CAPA language back to 14969 interpretation. The procedures hadn’t been reviewed since 2019. They weren’t wrong, exactly — but they were missing the risk-proportionate framing the 2016 standard requires. No findings yet. That changes when the next surveillance audit runs QMSR expectations against legacy documentation.

Before you go further — if your team is preparing for ISO 13485 certification or a surveillance audit, run a gap check first:

👉 Download the ISO 13485 Gap Assessment Checklist — Free checklist for medical device manufacturers assessing their QMS against ISO 13485:2016 requirements.

In This Guide

What ISO/TR 14969 was and what it covered
Why it was withdrawn
What replaced it — the ISO 13485:2016 Practical Guide, including its structure and chapter mapping
Why 2026 is the year this gap becomes a compliance liability (FDA QMSR)
How to update your QMS documentation to reflect current guidance
Where to purchase the current standard and guidance documents
FAQ

👉 Start Here — Top Resources

ISO 13485:2016 — ANSI Webstore — Purchase the current edition of the standard. Use code CC2026 for 5% off at checkout.
ISO 13485 Training — BSI Group — Implementation, internal auditor, and lead auditor courses aligned to ISO 13485:2016.
ISO 13485 Gap Assessment Checklist — Free download. Identify where your current QMS falls short before your next audit.

What Was ISO/TR 14969?

ISO/TR 14969:2004 was a Technical Report published by ISO’s Technical Committee 210 (ISO/TC 210), the group responsible for quality management and general aspects for medical devices.

TR stands for Technical Report. Unlike a full ISO standard, a Technical Report carries no requirements. It cannot be used as the basis for certification or regulatory inspection. Its purpose was interpretive: help organizations understand what ISO 13485 required and how to meet those requirements in practice.

ISO/TR 14969 provided clause-by-clause guidance on ISO 13485:2003. It explained intent, offered implementation examples, and clarified language that auditors and manufacturers found ambiguous. The document mirrored the clause structure of ISO 13485:2003 and covered:

Scope and application — how requirements applied across different organization types (manufacturers, service providers, distributors)
Quality management system (Clause 4) — documentation requirements, records, and what was required vs. recommended
Management responsibility (Clause 5) — how top management commitment was assessed and evidenced
Resource management (Clause 6) — personnel competency requirements, infrastructure, and work environment controls
Product realization (Clause 7) — planning, design controls, purchasing, production, and process validation
Measurement, analysis, and improvement (Clause 8) — feedback, internal audits, nonconformance control, CAPA, and data analysis

Most common finding: Organizations that built their QMS procedures using ISO/TR 14969 as a reference may have clause citations, interpretive notes, or CAPA language that is now misaligned with ISO 13485:2016. Those gaps become findings during document reviews and surveillance audits.

Why Was ISO/TR 14969 Withdrawn?

Comparison chart showing differences between withdrawn ISO/TR 14969 guidance and ISO 13485:2016 Practical Guide. — Compare legacy ISO/TR 14969 guidance with the current ISO 13485 implementation approach.

ISO/TR 14969:2004 was withdrawn because ISO 13485 itself was substantially revised in 2016. When the 2016 edition introduced new and modified requirements, the 2004 guidance document became misaligned — and in some areas, a liability.

Change Area	ISO 13485:2003 / TR 14969	ISO 13485:2016
Risk-based process control	Limited risk language	Risk-based approach embedded throughout QMS structure
Regulatory requirements	Aligned primarily to EU directives	Expanded global alignment (FDA, TGA, Health Canada, EU MDR)
Post-market surveillance	General requirements	Explicit feedback loop and monitoring requirements
Software validation	Basic guidance	Expanded requirements for QMS software validation
Outsourced processes	Covered in Clause 4.1	Risk-proportionate controls based on risk and external party capability
Supplier controls	Standard purchasing controls	Risk-proportionate controls with clearer documentation requirements

A technical report tied to the 2003 standard could not guide organizations through requirements that didn’t exist until 2016. ISO withdrew the document and directed users to the replacement handbook.

What Replaced ISO/TR 14969? Structure and Clause Mapping

Timeline showing ISO/TR 14969 withdrawal and transition to ISO 13485:2016 Practical Guide and FDA QMSR requirements. — See how ISO/TR 14969 evolved into today’s ISO 13485 guidance framework.

The current guidance document is the ISO 13485:2016 — Medical Devices — A Practical Guide, published by ISO in 2017 and authored by technical experts from ISO/TC 210. In the United States it was adopted by AAMI as AAMI/ISO 13485:2016 — A Practical Guide, available through the ANSI Webstore. AAMI explicitly identifies it as the replacement for ISO/TR 14969.

The handbook runs approximately 214 pages and is organized to mirror the clause structure of ISO 13485:2016, making it a direct lookup reference when you’re working through specific requirements. Here’s how it maps:

Handbook Section	ISO 13485:2016 Clause	Key Guidance Provided
Introduction & Scope	Clause 1	Applicability across organization types; what “regulatory purposes” means in practice
Quality Management System	Clause 4	Risk-based QMS design; documentation hierarchy; outsourced process controls
Management Responsibility	Clause 5	Top management commitment evidence; quality planning; management review inputs/outputs
Resource Management	Clause 6	Competency records; infrastructure qualification; work environment controls
Product Realization	Clause 7	Design controls; purchasing controls; production process validation; sterilization; servicing
Measurement, Analysis & Improvement	Clause 8	Feedback systems; complaint handling; internal audit; CAPA; statistical methods

Beyond clause-level guidance, the Practical Guide also includes:

Regulatory notes specific to different markets — particularly useful for EU MDR and FDA QMSR alignment
Worked examples of how to apply risk-based thinking to QMS process selection and documentation intensity
Transition guidance for organizations moving from ISO 13485:2003-based systems to the 2016 edition

One practical limitation worth knowing: the Practical Guide is a 214-page document that, despite its name, is not always light reading. Industry reviewers have noted that some sections contain circular references and that the guidance on risk-based approach — one of the biggest paradigm shifts in the 2016 standard — spans only a few pages for a topic that has generated ongoing debate between manufacturers and notified bodies. Having the Practical Guide alongside a current training course is more effective than relying on the handbook alone.

👉 If you’re preparing for Stage 1 audit and haven’t run a full clause-by-clause gap check, do that before you open the Practical Guide. Download the ISO 13485 Gap Assessment Checklist to identify gaps first — then use the handbook to close them.

Why This Matters More in 2026: FDA QMSR and Dual Compliance

This isn’t just a document housekeeping issue. In 2026, it’s a compliance liability with a hard regulatory edge.

The FDA QMSR took effect February 2, 2026. It formally replaced 21 CFR Part 820 — the U.S. Quality System Regulation that governed device manufacturing for nearly 30 years — with ISO 13485:2016 as the legal baseline for U.S. medical device quality systems. Manufacturers who previously maintained a 21 CFR Part 820-based QMS now need to be running against ISO 13485:2016 requirements, including the interpretive framework the 2016 standard uses.

That has a direct impact on ISO/TR 14969 references. Here’s why:

ISO/TR 14969 pre-dates both ISO 13485:2016 and FDA QMSR. Any QMS procedure, work instruction, or training record that traces its authority back to 14969 guidance — rather than the 2016 standard and current Practical Guide — is not aligned to the regulatory expectations your FDA inspector will be applying.

Specific areas where this creates dual exposure:

CAPA requirements — 14969 guidance on CAPA pre-dates the 2016 standard’s risk-proportionate framing. FDA inspectors applying QMSR expectations will scrutinize whether your CAPA process scales corrective action depth to risk level. Procedures built on 14969 interpretation often don’t.
Post-market surveillance — The 2016 standard significantly strengthened feedback loop requirements. 14969 guidance reflects the lighter 2003 language. Under QMSR, FDA expects active post-market data feeding back into the QMS — not just complaint logs.
Software validation for QMS applications — If your document control system, CAPA software, or ERP was validated against 14969 guidance language, that validation basis needs review under the 2016 standard’s expanded software validation requirements.

I worked with a team at a supplier to a large device OEM during QMSR transition prep. Their internal audit procedure had been solid for years — well-written, consistently followed. When we mapped it against QMSR expectations, the issue wasn’t procedure quality. It was that the criteria used to determine audit frequency and depth hadn’t been updated since the 2003-era documentation. Risk-based audit scheduling — required under the 2016 standard — wasn’t in the procedure. The OEM’s supplier quality team flagged it in a pre-audit review before the FDA did. That’s the window you want to catch this in.

For a detailed breakdown of the QMSR transition and what changes for manufacturers, see FDA QSR vs ISO 13485.

How to Update Your QMS for Current Guidance

Five-step workflow for updating QMS documentation from ISO/TR 14969 to ISO 13485:2016 guidance. — Use this workflow to systematically remove obsolete guidance from your QMS.

If your QMS procedures, work instructions, or training materials reference ISO/TR 14969, here’s how to address it systematically.

Step 1 — Document search Run a controlled search of your document management system for “ISO/TR 14969,” “TR 14969,” and “14969:2004.” Flag every document where the reference appears. Include training materials and supplier quality agreements.

Step 2 — Classify each reference Not every reference creates a compliance gap. Categorize:

✅ Citation-only reference — the procedure logic is sound; only the document reference needs updating
⚠️ Interpretive reference — procedure was built around 14969 guidance that may not align with current Practical Guide interpretation (CAPA framing, risk-based audit criteria, outsourced process controls)
⚠️ Training material reference — auditors check training records; outdated citations get flagged

Step 3 — Batch the citation updates For straightforward citation updates, consolidate them into a single planned revision cycle. Update the reference from “ISO/TR 14969” to “ISO 13485:2016” or the Practical Guide as appropriate. Document the rationale in your change control record.

Step 4 — Cross-reference interpretive references against the Practical Guide For procedures built on 14969 interpretation, map them against the equivalent clause in the ISO 13485:2016 Practical Guide. Pay specific attention to: CAPA (Clause 8.5), outsourced process controls (Clause 4.1), internal audit (Clause 8.2), and post-market surveillance feedback (Clause 8.2.1). These are the areas where the 2016 guidance diverges most from 2003-era interpretation.

Step 5 — Update internal auditor training records If your ISO 13485 internal auditor training references 14969, update the training materials and re-document competency verification. This is consistently one of the overlooked items in QMS transitions — and it surfaces in audits.

Do the gap assessment before you start revising. Chasing individual references without knowing your overall QMS posture is working in the wrong order. The ISO 13485 Gap Assessment Checklist gives you the full picture first.

✅ Quick Checklist: ISO/TR 14969 Reference Review

[ ] Searched QMS document system for all 14969 references
[ ] Searched training materials and supplier quality agreements
[ ] Classified references as citation-only or interpretive
[ ] Verified CAPA procedure aligns with 2016 risk-proportionate framing — not 14969
[ ] Verified internal audit frequency and depth criteria include risk-based logic
[ ] Verified post-market surveillance feedback procedure reflects 2016 requirements
[ ] Updated training materials to remove obsolete guidance document references
[ ] Confirmed training records reflect ISO 13485:2016 Practical Guide as current source
[ ] Completed a full ISO 13485:2016 gap assessment against all 8 clauses

Where to Buy ISO 13485 and the Current Guidance Handbook

Document	Description	Source
ISO 13485:2016	The current active standard — required for certification	ANSI Webstore
ISO 13485:2016 Practical Guide	214-page official guidance handbook replacing ISO/TR 14969	ANSI Webstore — available individually or in bundles
ISO 13485 / ISO 14971 Bundle	Standard + risk management standard package	ANSI Webstore bundle
ISO/TR 14969:2004	Withdrawn — historical reference only	Available as historical document only

Use coupon code CC2026 for 5% off at the ANSI Webstore — valid through December 31, 2026. ANSI serves international buyers and offers standards in multiple languages where available.

For more on building your ISO 13485 QMS documentation, see ISO 13485 Documentation Requirements and the ISO 13485 Implementation Roadmap.

FAQ

Is ISO/TR 14969 still valid?

No. ISO/TR 14969:2004 was officially withdrawn by ISO when ISO 13485 was revised to its 2016 edition. It is no longer current and should not be used as implementation guidance for an ISO 13485:2016-aligned QMS. It remains available as a historical document only. The replacement is the ISO 13485:2016 — Medical Devices — A Practical Guide.

What replaced ISO/TR 14969?

ISO/TR 14969 was replaced by the ISO 13485:2016 — Medical Devices — A Practical Guide, a 214-page companion handbook published by ISO in 2017 and authored by ISO/TC 210 technical experts. In the United States, it was adopted by AAMI as AAMI/ISO 13485:2016 and is available through the ANSI Webstore. AAMI explicitly identifies it as the replacement for ISO/TR 14969.

Can I still reference ISO/TR 14969 in my QMS procedures?

It is not prohibited, but it creates audit risk — especially now that FDA QMSR is in effect. A reference to a withdrawn guidance document signals that your documentation system may not be current. Best practice is to replace ISO/TR 14969 citations with ISO 13485:2016 clause references or the Practical Guide, and to verify that any procedure logic built on 14969 interpretation still holds against the 2016 standard.

Does ISO/TR 14969 apply to FDA QMSR compliance?

No. ISO/TR 14969 was guidance for ISO 13485:2003. The FDA QMSR — effective February 2, 2026 — harmonizes U.S. requirements with ISO 13485:2016. QMSR compliance requires alignment with the 2016 standard and its current guidance documents. Organizations still referencing 14969 in CAPA, audit, or post-market surveillance procedures should treat QMSR implementation as the trigger to complete that cleanup.

What is the difference between a Technical Report and an ISO standard?

An ISO Technical Report carries no requirements and cannot serve as the basis for certification or regulatory inspection. ISO/TR 14969 was a TR — it existed to help organizations interpret and implement ISO 13485, not to define binding requirements. The ISO 13485:2016 Practical Guide serves the same interpretive purpose.

How is ISO/TR 14969 different from ISO 13485?

ISO 13485 is the requirements standard — it defines what a QMS must do to be certifiable. ISO/TR 14969 was guidance only — it explained how to interpret and meet those requirements. The standard is mandatory for certification; the guidance document was optional but widely used. ISO 13485:2016 is the current active standard.

Do I need to buy the ISO 13485:2016 Practical Guide separately from the standard?

Yes. The standard and the Practical Guide are separate publications. The standard defines the requirements; the Practical Guide explains clause intent and provides implementation examples. Bundle packages combining ISO 13485:2016, the Practical Guide, and ISO 14971 are available at the ANSI Webstore at savings compared to individual purchases. For manufacturers building or overhauling a QMS, having both is strongly recommended.

Where can I get ISO 13485 training that covers the current guidance?

BSI Group offers ISO 13485 training at awareness, requirements, implementation, internal auditor, and lead auditor levels — all aligned to the 2016 edition. BSI is both an accredited training provider and a recognized certification body. Pairing their implementation or internal auditor course with the Practical Guide gives you a working command of the 2016 requirements, not just familiarity with the document.

📥 Free Resources

ISO 13485 Gap Assessment Checklist — Free checklist for medical device manufacturers assessing their QMS against ISO 13485:2016 requirements before certification or a surveillance audit
ISO 9001 Roadmap — Step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — Practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — Evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification

Not Sure What to Do Next?

🔹 Still researching ISO 13485 requirements? Start with What Is ISO 13485? for a full breakdown of the standard’s scope, structure, and who needs it.

🔹 Building or upgrading your ISO 13485 QMS? The ISO 13485 Implementation Roadmap walks you through the sequence from gap assessment to certification-ready documentation. For training on the 2016 requirements, BSI Group’s ISO 13485 courses include implementation-level coverage that goes well beyond the handbook itself.

🔹 Ready to purchase the standard? Get ISO 13485:2016 at the ANSI Webstore in digital or print. Use code CC2026 for 5% off through December 31, 2026.

The Standards Navigator covers the full medical device compliance standards landscape — from ISO 13485 implementation to FDA QMSR alignment. If your QMS has to hold up against both ISO certification and FDA inspection, the guidance document you’re working from matters as much as the standard itself.

Stay Current on ISO 13485 and Medical Device Compliance

QMS procedures built on outdated guidance don’t fail audits immediately. They fail them on the third surveillance cycle, when nobody remembers where the language came from. The FDA QMSR has made that timeline shorter.

The Standards Navigator covers ISO 13485 implementation, QMSR transition, risk management requirements, and the documentation controls that keep QMS systems audit-ready across both regulatory frameworks.

👉 Get updates on the medical device compliance standards cluster 👉 Be first to access new ISO 13485 implementation resources and checklists

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

The Standard Reads Like a Checklist. It Isn’t One.

In This Guide

Table of Contents

👉 Start Here (Top Resources)

ISO 13485 Clauses Explained: How the Standard Is Structured

Clauses 1 Through 3: No Requirements, But Don’t Skip Them

Clause 4: Quality Management System

Clause 5: Management Responsibility

Clause 6: Resource Management

Clause 7: Product Realization

Clause 8: Measurement, Analysis and Improvement

Where ISO 13485 and FDA’s QMSR Overlap by Clause

ISO 13485 vs ISO 9001: Same Numbers, Different Weight

Quick Clause Reference Checklist

FAQ

How many clauses does ISO 13485:2016 have?

Does ISO 13485 follow the same structure as ISO 9001?

Can I exclude clauses from ISO 13485?

Which ISO 13485 clause covers risk management?

What’s the difference between ISO 13485 and the FDA’s QMSR?

What is CP 7382.850?

Do I need to buy ISO 9001 to understand ISO 13485’s terminology?

Which clauses deserve the closest audit preparation?

Is a documentation kit enough to get ISO 13485 clause requirements right?

📥 Free Resources

Not Sure What to Do Next?

Stay Ahead of Clause-Level Changes

Subscribe

The Gap Assessment Is the Step Most Manufacturers Skip

In This Guide

Table of Contents

👉 Start Here (Top Resources)

What an ISO 13485 Gap Assessment Actually Is

Gap Assessment vs. Internal Audit

Quick Answer

The Eight-Step Gap Assessment Process

Step 1: Define Scope and Assemble Your Team

Step 2: Gather Current QMS Documentation

Step 3: Build Your Clause Map

Step 4: Walk Each Clause Against the Evidence

Step 5: Grade Each Finding

Step 6: Prioritize Remediation

Step 7: Build a Remediation Timeline

Step 8: Re-Assess Before You Schedule Your Audit

Common Mistakes That Undermine a Gap Assessment

Gap Assessment Readiness Checklist

Frequently Asked Questions

Is a gap assessment required before ISO 13485 certification?

How is a gap assessment different from an internal audit?

Who should be involved in a gap assessment?

How long does a gap assessment typically take?

Can I use the same gap assessment for MDSAP readiness?

What happens if I find a critical gap close to my planned audit date?

Do I need a consultant to run a gap assessment?

📥 Free Resources

Not Sure What to Do Next?

Stay Ahead of Your Next Audit Cycle

Subscribe

Two Audits, One QMS Standard — and a Decision Most Manufacturers Get Wrong

In This Guide

Table of Contents

👉 Start Here (Top Resources)

What Is ISO 13485, and What Is MDSAP Built on Top Of It?

Quick Answer

MDSAP vs ISO 13485: Side-by-Side

The 2026 Regulatory Shift: QMSR and the Revised MDSAP Audit Approach

Do You Need MDSAP? Decision-Stage Signals

What MDSAP Actually Costs You — And What It Saves

Documentation Issues That Can Create Problems in MDSAP Readiness

MDSAP Readiness Checklist

Frequently Asked Questions

Is MDSAP the same thing as ISO 13485?

Do I need to be ISO 13485 certified before I can apply for MDSAP?

Which countries does MDSAP cover?

Is MDSAP required to sell medical devices in the United States?

How did the FDA’s 2026 QMSR change affect MDSAP?

How much does an MDSAP audit cost compared to a standard ISO 13485 audit?

Can a small manufacturer participate in MDSAP?

Does an MDSAP certificate replace my ISO 13485 certificate?

📥 Free Resources