medical device compliance - The Standards Navigator

MDR vs. ISO 13485: What’s the Difference and Which One Do You Actually Need in 2026?

EU MDR and ISO 13485 solve different problems — one is law, the other is a certifiable QMS standard. This guide breaks down the core differences, current 2026–2027 MDR transition timelines, and a decision framework for regulatory affairs teams navigating both.

A regulatory affairs guide to two rules that get confused constantly — and cost time when they are

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Question That Stalls Every EU Market Entry Meeting

Somewhere in almost every medical device compliance kickoff, someone asks it: “We already have ISO 13485. Doesn’t that cover MDR?”

It doesn’t. And the gap between MDR vs ISO 13485 — a certified quality management system and an EU-compliant technical file — is where CE marking timelines quietly slip by six to twelve months.

MDR (Regulation (EU) 2017/745) and ISO 13485 aren’t competing standards. They aren’t interchangeable either. One is EU law. The other is a voluntary international standard that EU law happens to lean on heavily. Confusing the two doesn’t just cost time — it costs Notified Body findings, delayed submissions, and in some cases, a device that can’t legally reach the European market on schedule.

From the floor: I’ve sat in a management review where a director insisted the ISO 13485 certificate meant the technical documentation was “basically done” for an EU submission. It wasn’t. The certificate covered their quality system — design controls, CAPA, document control. It said nothing about the clinical evaluation report, MDR classification requirements, or the device-specific evidence required for conformity assessment. They spent the next quarter closing that gap instead of reviewing it calmly six months earlier. That’s the exact mistake this article exists to prevent.

👉 Before you assume your QMS certification covers your EU submission, run the gap check. Most regulatory affairs teams don’t fail because they misunderstand ISO 13485 — they fail because they assumed certification and market access were the same milestone. Get the ISO 13485 Gap Assessment Checklist and find out before a Notified Body does.

In This Guide

What EU MDR 2017/745 actually regulates
What ISO 13485 actually certifies
The core differences, side by side
Why “ISO 13485 certified” doesn’t mean “MDR compliant”
Where the two genuinely overlap — risk management, CAPA, design controls, and more
Current MDR transition timelines and 2026 developments
Which one you need — and when you need both
Common documentation mistakes that surface in Notified Body reviews
FAQ

👉 Start Here

ISO 13485:2016 — Purchase the Official Standard — the current edition, direct from ANSI Webstore, available in multiple languages for international regulatory teams.
ISO 13485 Training Courses — BSI Group — structured training for teams building out clause-by-clause understanding ahead of certification or an MDR technical file build.

What Is EU MDR 2017/745?

MDR is law, not a certifiable management system standard. Regulation (EU) 2017/745 governs what a manufacturer must prove — about a specific device — before that device can carry a CE mark and legally reach the EU market.

It covers device classification (Class I through III), clinical evaluation and clinical data requirements, technical documentation per Annexes II and III, post-market surveillance and post-market clinical follow-up (PMCF), Unique Device Identification (UDI) and EUDAMED registration, and — for higher-risk devices — Notified Body conformity assessment under Annex IX.

MDR replaced the older Medical Device Directive (MDD) and Active Implantable Medical Devices Directive (AIMDD), and it raised the bar substantially on clinical evidence and post-market obligations compared to both.

What Is ISO 13485?

ISO 13485 is a voluntary, internationally recognized quality management system standard for organizations involved in the design, production, or servicing of medical devices. It’s certifiable — a Notified Body or accredited certification body audits your QMS against the standard’s clauses and issues a certificate if you pass.

ISO 13485 uses maintaining effectiveness language throughout, not the continual improvement language found in ISO 9001. It’s structured around risk-based thinking applied specifically to design controls, document and record control, supplier controls, CAPA, and management review — the operational backbone a device manufacturer needs regardless of which market it sells into.

Since FDA’s QMSR took effect February 2, 2026, 21 CFR Part 820 incorporates ISO 13485:2016 by reference — making it the enforceable quality management system standard for U.S. device manufacturers, not merely a reference point.

MDR vs. ISO 13485: Core Differences

Category	EU MDR 2017/745	ISO 13485
Nature	EU law — mandatory for CE marking	Voluntary international standard
Scope	Device-specific: classification, clinical evidence, technical file	Organization-wide: the QMS itself
Who assesses it	Notified Body (device-level conformity assessment)	Certification body (QMS audit)
Grants market access?	Yes — required for CE marking in the EU	No — supports it, doesn’t grant it
Geographic reach	EU/EEA market only	Recognized globally; now foundational to FDA QMSR
What it produces	Technical documentation, CER, PMS/PMCF plan, EUDAMED registration	A certificate covering your quality management system
Update cycle	Amended by EU legislative process (ongoing 2025–2027 reform)	Revised through ISO’s standard TC 210 process

Professional infographic comparing EU MDR 2017/745 and ISO 13485:2016, highlighting differences in regulatory requirements, quality management systems, CE marking, clinical evaluation, and technical documentation for medical device manufacturers. — This infographic compares EU MDR and ISO 13485, illustrating how one governs market access while the other establishes the quality management system that supports regulatory compliance.

Quick Answer:

Need CE marking? → MDR is required.
Need a compliant medical device QMS? → ISO 13485 is required.
Selling medical devices in the EU? → You almost certainly need both.

The stakes behind that table are real: the European Commission’s most recent Notified Bodies survey, published March 2026, showed roughly half of submitted MDR applications had reached certificate issuance — a gap driven largely by device misclassification, incomplete technical documentation, and thin clinical evidence, not by Notified Body capacity alone.

Why Manufacturers Conflate the Two

The most common objection I hear: “We’re ISO 13485 certified — why do we need a separate MDR effort?”

Here’s the resolution: ISO 13485 certification tells a Notified Body your quality system is sound. It says nothing about whether a specific device’s clinical evidence, risk classification, or technical file meets MDR’s requirements. A company can hold a spotless ISO 13485 certificate and still receive a Notified Body finding on a device submission because the clinical evaluation report was thin, the PMCF plan was missing, or the classification rule was misapplied under Annex VIII.

Think of it this way: ISO 13485 certifies the kitchen is clean and the process is controlled. MDR conformity assessment asks whether this specific dish meets the recipe, the nutrition label is accurate, and there’s a plan to keep checking it after it ships. You need both, but they answer different questions.

👉 If you are relying on your ISO 13485 certificate as your MDR readiness proof, that’s the gap to close first. Run the ISO 13485 Gap Assessment Checklist against your current technical files before your next Notified Body interaction.

Where MDR and ISO 13485 Overlap

Venn diagram infographic showing where EU MDR 2017/745 and ISO 13485:2016 overlap, highlighting shared quality management processes including risk management, design controls, CAPA, complaint handling, and supplier controls for medical device manufacturers. — This infographic illustrates the operational areas shared by EU MDR and ISO 13485 while distinguishing the unique regulatory and quality management requirements of each framework.

If they’re really two separate things, why does everyone talk about them in the same breath? Because the same five operational areas show up in both — just assessed from different angles.

Risk management — MDR requires risk management per Annex I general safety and performance requirements; ISO 13485 Clause 4.1.2 requires a risk-based approach throughout the QMS. Most manufacturers run one risk management process (typically ISO 14971-aligned) that satisfies both.
CAPA — ISO 13485 Clause 8.5 governs corrective and preventive action as a QMS requirement. MDR’s post-market surveillance and vigilance obligations feed directly into that same CAPA process when a field issue is identified.
Design controls — ISO 13485 Clause 7.3 sets design and development requirements; MDR’s technical documentation under Annex II leans on those same design records as evidence of a controlled development process.
Supplier controls — ISO 13485 Clause 7.4 requires supplier evaluation and monitoring; MDR expects that same supplier oversight to extend into the technical file wherever a supplier-controlled process affects device safety or performance.
Complaint handling — ISO 13485 Clause 8.2.2 sets complaint-handling requirements; MDR’s vigilance reporting obligations under Article 87 depend on that same complaint intake process to catch reportable events.

This is the practical reason ISO 13485 certification and MDR technical documentation feel like the same conversation even though they’re legally distinct: a well-run QMS produces most of the raw material an MDR technical file needs. The gap is rarely in these five areas — it’s in whether that raw material gets assembled into a device-specific technical file the way MDR expects.

MDR Transition Timelines: Where Things Stand in 2026

The transition provisions have shifted more than once since MDR took effect in May 2021, and manufacturers still working under legacy MDD or AIMDD certificates need to track the current deadlines carefully:

Class III custom-made implantable devices: compliance required by May 26, 2026
Class III and certain implantable Class IIb devices: transition extends to December 31, 2027
Most other Class IIb, IIa, and Class I devices: transition extends to December 31, 2028

Legacy device status under these extended timelines requires a valid MDD/AIMDD certificate, no significant design or intended-use change, continued compliance with the original directive, and a signed agreement with an MDR-designated Notified Body.

Separately, the European Commission published a proposal on December 16, 2025 to simplify and reduce administrative burden under both MDR and its IVDR counterpart — including changes to PRRC availability requirements and certificate validity limits. That proposal is still moving through the EU’s ordinary legislative process, and current projections put final adoption no earlier than the second quarter of 2027. Nothing in that proposal changes your obligations today. Manufacturers should keep building technical documentation to the current MDR text rather than waiting on a reform that hasn’t been adopted.

Timeline infographic showing the EU MDR transition deadlines for legacy medical devices in 2026, 2027, and 2028, along with ongoing requirements for technical documentation, clinical evaluation, post-market surveillance, and Notified Body agreements. — This timeline summarizes the current EU MDR transition deadlines for legacy medical devices while highlighting the ongoing compliance activities manufacturers must maintain throughout the transition period.

Do You Need Both? A Decision Framework

If you are selling into the EU market → MDR compliance is mandatory, full stop. ISO 13485 certification is not legally required by MDR text, but in practice Notified Bodies expect it as evidence your QMS can sustain the technical file over time.
If you are U.S.-only and not yet EU-bound → FDA’s QMSR incorporates ISO 13485:2016 by reference into 21 CFR Part 820, making alignment with ISO 13485 the foundation of U.S. medical device QMS compliance as of February 2, 2026. Third-party certification isn’t mandated by FDA, but the standard’s substance now is.
If you are already ISO 13485 certified and expanding into the EU → treat MDR as a device-level project layered on top of your existing QMS, not a QMS rebuild. The gap is almost always in clinical evidence and technical documentation, not in your quality processes.
If you are under customer or investor pressure to move fast → get the ISO 13485 gap assessment done first. It surfaces documentation gaps in days instead of finding them mid-audit.

Common Mistakes That Surface in Notified Body Review

Most common finding: Clinical evaluation reports that summarize literature but never tie evidence back to the specific device’s risk profile under Annex I general safety and performance requirements.

Other recurring gaps: PMCF plans that exist as a template but were never executed against real post-market data; UDI and EUDAMED registration treated as an afterthought instead of a parallel workstream; and design change records that don’t clearly show which MDR classification rule applied after a design modification.

⚠️ A Notified Body finding on any of these doesn’t necessarily mean your ISO 13485 QMS has failed — it usually means the QMS and the MDR technical file were built as two separate projects instead of one connected effort.

Quick Reference Checklist

✅ ISO 13485 certificate current and audit-ready
✅ Technical documentation mapped to current MDR Annex II/III requirements ✅ Clinical evaluation report tied to device-specific risk profile
✅ PMCF plan active and generating real post-market data
✅ UDI assigned and EUDAMED registration current
✅ Notified Body agreement in place if relying on legacy transition timelines
✅ Design change records show which classification rule applies post-modification

FAQ

Does ISO 13485 certification satisfy MDR requirements?

No. ISO 13485 certifies your quality management system. MDR requires separate, device-specific technical documentation, clinical evidence, and — for most devices — Notified Body conformity assessment. Certification supports MDR compliance; it doesn’t substitute for it.

Is ISO 13485 mandatory for the EU market?

MDR text doesn’t explicitly mandate ISO 13485 certification, but in practice, Notified Bodies expect a certified QMS as part of demonstrating your ability to sustain compliance. Most manufacturers pursuing MDR conformity hold ISO 13485 certification for this reason.

Do U.S.-only manufacturers need to worry about MDR?

Not directly, unless you plan to sell into the EU. However, FDA’s QMSR — effective February 2, 2026 — makes ISO 13485:2016 the operative U.S. regulation, so ISO 13485 alignment now matters regardless of whether MDR applies to you.

What’s the current MDR transition deadline for legacy devices?

It depends on device classification: Class III custom-made implantables faced a May 26, 2026 deadline, Class III and certain implantable Class IIb devices extend to December 31, 2027, and most other devices extend to December 31, 2028 — provided legacy status conditions are met.

Is the EU actually changing MDR requirements soon?

The European Commission proposed simplification changes on December 16, 2025, but the proposal is still in the EU legislative process, with final adoption not expected before the second quarter of 2027. Current MDR requirements remain fully in effect in the meantime.

What’s the biggest documentation gap Notified Bodies flag?

Clinical evaluation reports that summarize literature broadly without tying the evidence directly to the specific device’s risk profile under the general safety and performance requirements.

Can one gap assessment cover both ISO 13485 certification readiness and MDR technical file readiness?

A well-structured gap assessment should flag both, but they’re different reviews at their core — one audits your QMS against ISO 13485 clauses, the other audits your technical documentation against MDR annexes. Treat them as connected but distinct workstreams.

Where should a manufacturer start if pursuing both?

Start with the QMS. A certified, functioning ISO 13485 system gives you the document control, CAPA, and design control infrastructure that MDR technical documentation depends on. Building MDR documentation on top of a shaky QMS just relocates the problem.

📥 Free Resources

ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements before certification or a Notified Body review.
ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system from the ground up.
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements across production environments.

Not Sure What to Do Next?

🔹 Still researching the difference between MDR and ISO 13485? Start with What Is ISO 13485? and FDA QSR vs. ISO 13485 to ground the fundamentals before your next planning meeting.

🔹 Ready to close the documentation gap? Review ISO 13485 Documentation Requirements and Validation & Verification Requirements against your current technical files.

🔹 Need to purchase the standard itself? Get ISO 13485:2016 directly from ANSI Webstore — available internationally, with multi-language editions for global regulatory teams. Use code CC2026 for 5% off through December 31, 2026.

MDR and ISO 13485 solve different problems, and treating them as one project is how audit-ready timelines slip by a quarter or more. The Standards Navigator will keep tracking both as EU reform proposals and FDA QMSR guidance continue to evolve through 2026 and 2027.

Stop Guessing Where Your MDR Gap Actually Is

Regulatory teams that treat MDR and ISO 13485 as one combined project usually discover the gap during a Notified Body review — the worst possible time to find it. Teams that separate the two, and check each on its own terms, walk into that review with documentation that already matches what’s being asked.

The Standards Navigator tracks EU MDR developments, FDA QMSR alignment, and ISO 13485 implementation detail so medical device teams aren’t relying on outdated guidance six months into a submission.

👉 Get updates on MDR, ISO 13485, and medical device regulatory changes as they happen
👉 Be first to access new gap assessment tools and documentation resources for regulatory affairs teams

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

Validation & Verification Requirements: What ISO 13485 and the New FDA QMSR Actually Demand (2026 Guide)

ISO 13485 Clause 7.3 requires distinct verification and validation evidence — and the FDA’s new QMSR, effective February 2, 2026, makes the distinction matter more than ever. This guide breaks down design verification, design validation, process validation, and software validation requirements, and shows manufacturers how to build a traceability matrix that survives an audit or inspection.

ISO 13485 verification and validation requirements explained for medical device manufacturers navigating the QMSR transition

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Documentation Gap That Fails Design History Files

A design verification report that confirms the device meets its own specifications is not the same thing as a validation report that confirms the device meets the user’s actual needs. Auditors know the difference. Regulatory affairs teams sometimes don’t find out until an FDA inspector or notified body assessor pulls the Design History File and asks for both — and only one exists.

That gap has gotten more consequential, not less. The FDA’s Quality Management System Regulation took effect February 2, 2026, formally incorporating ISO 13485:2016 into 21 CFR Part 820 by reference. Verification and validation records that used to satisfy QSR expectations are now being evaluated against ISO 13485 Clause 7.3 directly — and the two frameworks don’t document V&V identically.

From the Floor: As a certified ISO 9001 Internal Auditor, I’ve sat across the table from teams who could produce a stack of test reports but couldn’t answer a simple question: which of these prove the design meets the specification, and which prove it meets the user’s need? Verification and validation get treated as interchangeable paperwork until an auditor separates them — and by then it’s a finding, not a conversation. The QMS documentation discipline that catches this before an audit is the same discipline that catches it before a submission.

If your last internal audit didn’t clearly separate verification evidence from validation evidence, that’s the gap worth closing first.

Run a clause-by-clause gap check before your next surveillance audit or FDA inspection — the ISO 13485 Gap Assessment Checklist below is built for exactly this kind of documentation review. Most teams miss the verification/validation split until it’s flagged.

👉 ISO 13485 Gap Assessment Checklist

In This Guide

What verification and validation mean under ISO 13485 Clause 7.3, and why they are not interchangeable
How process validation (Clause 7.5.6) differs from design validation
Software validation requirements for devices and manufacturing/QMS software
What changed under the FDA QMSR effective February 2, 2026
The most common V&V documentation failures found in audits and inspections
How to structure a verification and validation plan that survives scrutiny

👉 Start Here (Top Resources)

If you’re building or auditing a verification and validation process, these are the two resources worth starting with:

Get ISO 13485 training from BSI Group — BSI’s ISO 13485 training programs walk quality and regulatory teams through Clause 7.3 requirements in detail, including how design controls map to verification and validation evidence.
Purchase the official ISO 13485:2016 standard from ANSI Webstore — the authoritative source for Clause 7.3 language. ANSI Webstore serves international buyers and offers the standard in multiple formats. Use code CC2026 for 5% off.

Verification vs. Validation: The Core Distinction

Comparison infographic explaining the differences between ISO 13485 verification and validation requirements under ISO 13485:2016, including design inputs, intended use, testing methods, timing, applicable clauses, and common audit findings. — This comparison illustrates how verification and validation serve different purposes under ISO 13485 and why both are required for compliant medical device design controls.

Verification confirms that design outputs meet design inputs. Validation confirms that the finished device meets user needs and intended use. That one-sentence distinction is where most documentation failures start, because the two activities can look procedurally similar — testing, measuring, comparing results against criteria — while answering completely different questions.

Element	Design Verification	Design Validation
Question answered	Did we build the design correctly?	Did we build the correct design?
Compared against	Design inputs / specifications	User needs / intended use
Typical methods	Bench testing, inspection, analysis, comparison to similar designs	Clinical evaluation, simulated use testing, human factors studies
Timing	Throughout design and development	Under defined operating conditions, on initial production units or equivalent
ISO 13485 clause	7.3.6	7.3.7
Common failure	Testing against internal spec only, no traceability to input	Validating on prototypes instead of production-equivalent units

Most common finding: auditors and FDA investigators repeatedly cite validation performed on non-representative units — bench prototypes, early builds, or units built on equipment that doesn’t match production. ISO 13485 Clause 7.3.7 specifically requires validation on production or production-equivalent units, under defined operating conditions.

Verification and Validation in Practice: An Infusion Pump Example

Take a manufacturer developing an infusion pump. Design verification confirms the device meets its own engineering specifications:

✅ Flow rate accuracy within the specified tolerance
✅ Battery life meets the stated runtime under load
✅ Alarm volume meets the decibel specification

Design validation confirms something different — that the device works safely in the hands of the people who will actually use it:

✅ Nurses can operate the pump correctly and safely during simulated or actual clinical use
✅ The alarm is audible and distinguishable in a realistic hospital environment, not a quiet test lab
✅ Labeling and instructions for use are understood by the intended users without additional training

A pump can pass every verification test and still fail validation — accurate flow rate and long battery life mean nothing if a nurse under time pressure misreads the alarm or misinterprets the instructions. That’s the gap Clause 7.3.7 is built to catch, and it’s why validation has to happen on production-equivalent units under conditions that resemble actual use.

Design Verification Requirements

Clause 7.3.6 requires that design verification confirms outputs meet input requirements, with results and conclusions recorded, including the methods, dates, and individuals performing the verification. In practice, that means every design input needs a traceable verification activity — not a general statement that “the device was tested.”

If you are building a Design History File from scratch → start with a traceability matrix that maps every design input to its verification method and result before writing a single test protocol. Retrofitting traceability after testing is where most rework happens.

If you are already ISO 9001 certified and adding ISO 13485 → your existing design control process likely covers verification structurally, but it almost certainly lacks the input-to-output traceability rigor ISO 13485 auditors expect. That’s the gap to close first, not the documentation format.

👉 Before You Build Another Test Protocol

Most verification failures aren’t testing failures — they’re traceability failures. Run your design inputs against your current verification records now and find the gaps before an assessor does. →

Design Validation Requirements

Design validation under Clause 7.3.7 must be performed on production or production-equivalent units, under defined operating conditions, and must include risk analysis where applicable — which is where ISO 14971 risk management intersects directly with design controls. Validation isn’t complete until it addresses actual clinical or user-environment conditions, not lab conditions that approximate them.

Objection: “Our device is low-risk — do we really need formal simulated-use validation?” Even Class I and low-risk Class II devices need validation evidence proportional to risk, and “proportional” still means documented, traceable, and tied to intended use. A shorter validation plan is defensible. No validation plan is not.

Clinical evaluation, when required, and human factors/usability testing both fall under validation, not verification — a distinction that matters for regulatory submissions referencing FDA guidance on human factors engineering.

Process Validation Under Clause 7.5.6

Infographic explaining the three phases of process validation under ISO 13485, including Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ), with key activities, outputs, and compliance requirements. — This infographic explains the roles of IQ, OQ, and PQ in process validation, helping manufacturers understand how each qualification stage supports ISO 13485 and FDA QMSR compliance.

Separate from design validation, ISO 13485 Clause 7.5.6 requires validation of processes where the resulting output cannot be verified by subsequent monitoring or measurement — sterilization, certain sealing and bonding processes, injection molding parameters, and software used in production are the classic examples.

Process validation requires:

✅ Defined criteria for review and approval of the process
✅ Approval of equipment and qualification of personnel
✅ Use of specific methods, procedures, and acceptance criteria
✅ Requirements for records (Clause 4.2.5)
✅ Revalidation criteria, including criteria for triggering revalidation

Most auditors and FDA investigators expect this evidence structured around three stages: Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ).

Installation Qualification (IQ) confirms that equipment and supporting systems are installed correctly, according to the manufacturer’s specifications and the site’s own installation requirements — including verified utilities, calibration status, and documentation of the as-installed configuration, not just a checklist that the equipment arrived and was plugged in.

Operational Qualification (OQ) confirms that the equipment operates as intended across its full specified operating range, not just at a single nominal setting. For a sterilization process, that means testing at the upper and lower bounds of temperature, time, and pressure defined in the process specification — not only the target parameters.

Performance Qualification (PQ) confirms that the process consistently produces conforming output under actual production conditions, typically across multiple runs and, where risk warrants it, multiple operators, shifts, or lots. PQ is where most revalidation triggers get defined, since it establishes the baseline the process must continue to meet.

If you are validating a sterilization or bonding process for the first time → build your IQ/OQ/PQ protocol before ordering test units. Retrofitting an IQ after OQ testing has already started is a common finding, and it undermines the traceability an assessor is looking for.

If your process hasn’t changed but your equipment or facility has → IQ typically needs to be repeated even when OQ and PQ parameters stay the same, since IQ is tied to the specific installation, not the process design.

Skipping straight to PQ — running production and calling the passing output “validation” — is one of the most common shortcuts auditors flag, because it skips the evidence that the equipment itself is capable of consistently meeting the operating range the process depends on.

If you are outsourcing sterilization or bonding processes → your supplier controls documentation needs to show that you’ve verified the supplier’s process validation, not just received a certificate of conformance.

Software Validation Requirements

Software validation shows up in two places under ISO 13485, and conflating them is a recurring audit finding: software that is part of the device (or used in its production) versus software used for quality management purposes, such as electronic QMS platforms or CAPA tracking tools. Both require validation appropriate to their use, application, and risk — but the depth and method differ substantially, and design-control software validation should be traceable back to the same input/output structure as hardware verification.

What the FDA QMSR Changed for U.S. Manufacturers

The FDA’s Quality Management System Regulation replaced the legacy Quality System Regulation under 21 CFR Part 820, effective February 2, 2026, incorporating ISO 13485:2016 by reference rather than maintaining a separately worded U.S. regulation. For manufacturers who were already ISO 13485 certified, the operational impact on verification and validation practices is smaller than the documentation-mapping impact: DHF, DMR, and DHR content doesn’t necessarily need renaming, but it does need a clear mapping showing where ISO 13485 Clause 7.3 requirements are satisfied within existing U.S. records.

If you were operating under legacy QSR language only → this is the trigger to formally adopt ISO 13485 Clause 7.3 verification/validation terminology and structure, since FDA inspectors are now trained against the ISO clause structure, not the old Part 820 subparts.

Common V&V Documentation Failures

The same handful of gaps show up repeatedly in ISO 13485 QMS audits:

No traceability matrix linking design inputs to verification methods and results
Validation performed on prototypes rather than production-equivalent units
Missing revalidation criteria for processes that later change equipment, materials, or parameters
Software validation treated as one-size-fits-all instead of scaled to risk and application
Verification and validation dates, methods, and personnel not fully recorded, leaving conclusions without traceable support

👉 Before Your Next Notified Body Assessment

If you’re not confident your traceability matrix would hold up under document review, that’s the exact gap the ISO 13485 Gap Assessment Checklist was built to catch — in under 45 minutes. →

Building a Verification & Validation Plan That Holds Up

A defensible V&V plan starts with the traceability matrix, not the test protocols. Build it in this order:

List every design input and requirement
Map each input to a specific verification method and acceptance criterion
Identify which requirements also require validation evidence, and under what conditions
Define production-equivalent unit criteria before validation begins
Build revalidation triggers into the plan up front — not as an afterthought after a process change

This structure is what turns a stack of individual test reports into a Design History File that answers an assessor’s questions instead of prompting more of them.

Workflow infographic illustrating how verification and validation fit into the ISO 13485 design control process, from user needs and design inputs through production-equivalent units, validation, and Design History File documentation. — This workflow shows how verification and validation integrate into ISO 13485 design controls to produce a complete, traceable Design History File for regulatory compliance.

Quick Audit Checklist

✅ Every design input has a documented verification method and result
✅ Validation was performed on production or production-equivalent units
✅ Risk analysis is referenced in the validation rationale
✅ Process validation records include revalidation criteria
✅ Software validation is scaled to intended use and risk
✅ Verification and validation records include dates, methods, and personnel
⚠️ Watch for validation evidence copied from an earlier device without device-specific justification

FAQ

What is the difference between verification and validation in ISO 13485?

Verification confirms design outputs meet design inputs — did we build it correctly. Validation confirms the finished device meets user needs and intended use — did we build the correct thing. They require separate evidence and cannot substitute for each other.

Does ISO 13485 require validation on production units?

Yes. Clause 7.3.7 requires design validation on production or production-equivalent units under defined operating conditions, not on early prototypes or bench models that don’t reflect final manufacturing.

What processes require process validation under Clause 7.5.6?

Any process where output cannot be fully verified by later inspection or testing — common examples include sterilization, certain welding and bonding processes, injection molding, and adhesive curing.

How did the FDA QMSR affect verification and validation requirements?

The QMSR, effective February 2, 2026, incorporates ISO 13485:2016 into 21 CFR Part 820 by reference. Manufacturers now need documentation that maps clearly to ISO 13485 Clause 7.3, even if internal DHF/DMR/DHR naming stays the same.

Do low-risk devices still need design validation?

Yes, though the depth can scale with risk. A shorter, risk-justified validation plan is acceptable; skipping validation entirely is not.

Does software need separate validation from the device it’s part of?

Software validation is required both for software that’s part of or used in producing the device, and for software used for quality management purposes — but the required depth and method differ by application and risk.

What’s the most common finding auditors cite for validation?

Validation conducted on non-representative units — prototypes or early builds that don’t match production configuration or manufacturing conditions.

Where does risk management fit into verification and validation?

ISO 14971 risk management activities feed directly into what needs validation and how rigorously, particularly for design validation rationale and process revalidation triggers.

📥 Free Resources

ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements, including design control and V&V documentation gaps
ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification

Not Sure What to Do Next?

🔹 Still researching your V&V documentation gaps? Start with the ISO 13485 Gap Assessment Checklist — it maps directly to Clause 7.3 verification and validation requirements.

🔹 Ready to build a compliant V&V process? BSI Group’s ISO 13485 training covers Clause 7.3 requirements in the depth a design control rebuild needs.

🔹 Need the standard itself to build your traceability matrix against? Get ISO 13485:2016 from ANSI Webstore — code CC2026 takes 5% off, and international formats are available.

Verification proves your engineers met the specification. Validation proves your customers can safely use the product. Auditors expect both. Regulators require both. A complete Design History File demonstrates both through traceable evidence — not one comprehensive-sounding report that tries to do both jobs at once.

Stay Ahead of the Next V&V Finding

Design History File gaps rarely surface during routine work — they surface during an audit or inspection, when there’s no time left to fix them. Manufacturers who catch the verification/validation split early walk into assessments with a traceability matrix that answers questions before they’re asked. Manufacturers who don’t spend the assessment explaining why validation was performed on a prototype.

The Standards Navigator tracks ISO 13485, QMSR, and medical device compliance requirements as they develop — including changes that affect how verification and validation get documented.

👉 Get updates on ISO 13485 and QMSR compliance changes
👉 Be first to access new medical device gap assessment tools and checklists

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

ISO/TR 14969 Explained: What It Was, Why It Was Withdrawn, and What Replaces It in 2026

ISO/TR 14969:2004 — the companion guidance document for ISO 13485:2003 — was officially withdrawn when ISO 13485 was revised to its 2016 edition. Quality professionals still referencing it in QMS procedures are citing an obsolete document. This article explains what ISO/TR 14969 covered, why it was withdrawn, and what replaces it: the ISO 13485:2016 Practical Guide.

The guidance document for ISO 13485 has changed — here’s what medical device quality professionals need to know today

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Standard That Guided ISO 13485 Compliance Is Gone — Here’s What That Means

If you searched for ISO/TR 14969, you already ran into a dead end. The document is no longer current. It was officially withdrawn.

That matters more than it sounds. Quality professionals in the medical device space still reference ISO/TR 14969 in internal procedures, training materials, and supplier documentation. Some consultants still cite it. If you are building or auditing a QMS right now, you need to know what replaced it — and whether your documentation is anchored to an obsolete source.

ISO/TR 14969:2004 was withdrawn by ISO when ISO 13485 was revised to its 2016 edition. The technical report was tied to ISO 13485:2003. When the 2016 version introduced risk-based process controls, expanded post-market surveillance requirements, and global regulatory alignment language, the 2004 guidance became misaligned — and in some clauses, actively misleading. In its place, ISO published a new handbook: ISO 13485:2016 — Medical Devices — A Practical Guide.

Now, in 2026, the stakes are higher. The FDA’s Quality Management System Regulation (QMSR) took effect February 2, 2026, formally replacing 21 CFR Part 820 with ISO 13485:2016 as the baseline for U.S. device compliance. Organizations that built their QMS on ISO 13485:2003 interpretations — or whose procedures still reference ISO/TR 14969 — face a two-layer exposure: outdated guidance and regulatory non-alignment.

I’ve seen this pattern play out in quality systems that looked solid on paper. During a QMS documentation review I supported at a contract manufacturer with FDA-regulated device components, the team found five procedures that traced their CAPA language back to 14969 interpretation. The procedures hadn’t been reviewed since 2019. They weren’t wrong, exactly — but they were missing the risk-proportionate framing the 2016 standard requires. No findings yet. That changes when the next surveillance audit runs QMSR expectations against legacy documentation.

Before you go further — if your team is preparing for ISO 13485 certification or a surveillance audit, run a gap check first:

👉 Download the ISO 13485 Gap Assessment Checklist — Free checklist for medical device manufacturers assessing their QMS against ISO 13485:2016 requirements.

In This Guide

What ISO/TR 14969 was and what it covered
Why it was withdrawn
What replaced it — the ISO 13485:2016 Practical Guide, including its structure and chapter mapping
Why 2026 is the year this gap becomes a compliance liability (FDA QMSR)
How to update your QMS documentation to reflect current guidance
Where to purchase the current standard and guidance documents
FAQ

👉 Start Here — Top Resources

ISO 13485:2016 — ANSI Webstore — Purchase the current edition of the standard. Use code CC2026 for 5% off at checkout.
ISO 13485 Training — BSI Group — Implementation, internal auditor, and lead auditor courses aligned to ISO 13485:2016.
ISO 13485 Gap Assessment Checklist — Free download. Identify where your current QMS falls short before your next audit.

What Was ISO/TR 14969?

ISO/TR 14969:2004 was a Technical Report published by ISO’s Technical Committee 210 (ISO/TC 210), the group responsible for quality management and general aspects for medical devices.

TR stands for Technical Report. Unlike a full ISO standard, a Technical Report carries no requirements. It cannot be used as the basis for certification or regulatory inspection. Its purpose was interpretive: help organizations understand what ISO 13485 required and how to meet those requirements in practice.

ISO/TR 14969 provided clause-by-clause guidance on ISO 13485:2003. It explained intent, offered implementation examples, and clarified language that auditors and manufacturers found ambiguous. The document mirrored the clause structure of ISO 13485:2003 and covered:

Scope and application — how requirements applied across different organization types (manufacturers, service providers, distributors)
Quality management system (Clause 4) — documentation requirements, records, and what was required vs. recommended
Management responsibility (Clause 5) — how top management commitment was assessed and evidenced
Resource management (Clause 6) — personnel competency requirements, infrastructure, and work environment controls
Product realization (Clause 7) — planning, design controls, purchasing, production, and process validation
Measurement, analysis, and improvement (Clause 8) — feedback, internal audits, nonconformance control, CAPA, and data analysis

Most common finding: Organizations that built their QMS procedures using ISO/TR 14969 as a reference may have clause citations, interpretive notes, or CAPA language that is now misaligned with ISO 13485:2016. Those gaps become findings during document reviews and surveillance audits.

Why Was ISO/TR 14969 Withdrawn?

Comparison chart showing differences between withdrawn ISO/TR 14969 guidance and ISO 13485:2016 Practical Guide. — Compare legacy ISO/TR 14969 guidance with the current ISO 13485 implementation approach.

ISO/TR 14969:2004 was withdrawn because ISO 13485 itself was substantially revised in 2016. When the 2016 edition introduced new and modified requirements, the 2004 guidance document became misaligned — and in some areas, a liability.

Change Area	ISO 13485:2003 / TR 14969	ISO 13485:2016
Risk-based process control	Limited risk language	Risk-based approach embedded throughout QMS structure
Regulatory requirements	Aligned primarily to EU directives	Expanded global alignment (FDA, TGA, Health Canada, EU MDR)
Post-market surveillance	General requirements	Explicit feedback loop and monitoring requirements
Software validation	Basic guidance	Expanded requirements for QMS software validation
Outsourced processes	Covered in Clause 4.1	Risk-proportionate controls based on risk and external party capability
Supplier controls	Standard purchasing controls	Risk-proportionate controls with clearer documentation requirements

A technical report tied to the 2003 standard could not guide organizations through requirements that didn’t exist until 2016. ISO withdrew the document and directed users to the replacement handbook.

What Replaced ISO/TR 14969? Structure and Clause Mapping

Timeline showing ISO/TR 14969 withdrawal and transition to ISO 13485:2016 Practical Guide and FDA QMSR requirements. — See how ISO/TR 14969 evolved into today’s ISO 13485 guidance framework.

The current guidance document is the ISO 13485:2016 — Medical Devices — A Practical Guide, published by ISO in 2017 and authored by technical experts from ISO/TC 210. In the United States it was adopted by AAMI as AAMI/ISO 13485:2016 — A Practical Guide, available through the ANSI Webstore. AAMI explicitly identifies it as the replacement for ISO/TR 14969.

The handbook runs approximately 214 pages and is organized to mirror the clause structure of ISO 13485:2016, making it a direct lookup reference when you’re working through specific requirements. Here’s how it maps:

Handbook Section	ISO 13485:2016 Clause	Key Guidance Provided
Introduction & Scope	Clause 1	Applicability across organization types; what “regulatory purposes” means in practice
Quality Management System	Clause 4	Risk-based QMS design; documentation hierarchy; outsourced process controls
Management Responsibility	Clause 5	Top management commitment evidence; quality planning; management review inputs/outputs
Resource Management	Clause 6	Competency records; infrastructure qualification; work environment controls
Product Realization	Clause 7	Design controls; purchasing controls; production process validation; sterilization; servicing
Measurement, Analysis & Improvement	Clause 8	Feedback systems; complaint handling; internal audit; CAPA; statistical methods

Beyond clause-level guidance, the Practical Guide also includes:

Regulatory notes specific to different markets — particularly useful for EU MDR and FDA QMSR alignment
Worked examples of how to apply risk-based thinking to QMS process selection and documentation intensity
Transition guidance for organizations moving from ISO 13485:2003-based systems to the 2016 edition

One practical limitation worth knowing: the Practical Guide is a 214-page document that, despite its name, is not always light reading. Industry reviewers have noted that some sections contain circular references and that the guidance on risk-based approach — one of the biggest paradigm shifts in the 2016 standard — spans only a few pages for a topic that has generated ongoing debate between manufacturers and notified bodies. Having the Practical Guide alongside a current training course is more effective than relying on the handbook alone.

👉 If you’re preparing for Stage 1 audit and haven’t run a full clause-by-clause gap check, do that before you open the Practical Guide. Download the ISO 13485 Gap Assessment Checklist to identify gaps first — then use the handbook to close them.

Why This Matters More in 2026: FDA QMSR and Dual Compliance

This isn’t just a document housekeeping issue. In 2026, it’s a compliance liability with a hard regulatory edge.

The FDA QMSR took effect February 2, 2026. It formally replaced 21 CFR Part 820 — the U.S. Quality System Regulation that governed device manufacturing for nearly 30 years — with ISO 13485:2016 as the legal baseline for U.S. medical device quality systems. Manufacturers who previously maintained a 21 CFR Part 820-based QMS now need to be running against ISO 13485:2016 requirements, including the interpretive framework the 2016 standard uses.

That has a direct impact on ISO/TR 14969 references. Here’s why:

ISO/TR 14969 pre-dates both ISO 13485:2016 and FDA QMSR. Any QMS procedure, work instruction, or training record that traces its authority back to 14969 guidance — rather than the 2016 standard and current Practical Guide — is not aligned to the regulatory expectations your FDA inspector will be applying.

Specific areas where this creates dual exposure:

CAPA requirements — 14969 guidance on CAPA pre-dates the 2016 standard’s risk-proportionate framing. FDA inspectors applying QMSR expectations will scrutinize whether your CAPA process scales corrective action depth to risk level. Procedures built on 14969 interpretation often don’t.
Post-market surveillance — The 2016 standard significantly strengthened feedback loop requirements. 14969 guidance reflects the lighter 2003 language. Under QMSR, FDA expects active post-market data feeding back into the QMS — not just complaint logs.
Software validation for QMS applications — If your document control system, CAPA software, or ERP was validated against 14969 guidance language, that validation basis needs review under the 2016 standard’s expanded software validation requirements.

I worked with a team at a supplier to a large device OEM during QMSR transition prep. Their internal audit procedure had been solid for years — well-written, consistently followed. When we mapped it against QMSR expectations, the issue wasn’t procedure quality. It was that the criteria used to determine audit frequency and depth hadn’t been updated since the 2003-era documentation. Risk-based audit scheduling — required under the 2016 standard — wasn’t in the procedure. The OEM’s supplier quality team flagged it in a pre-audit review before the FDA did. That’s the window you want to catch this in.

For a detailed breakdown of the QMSR transition and what changes for manufacturers, see FDA QSR vs ISO 13485.

How to Update Your QMS for Current Guidance

Five-step workflow for updating QMS documentation from ISO/TR 14969 to ISO 13485:2016 guidance. — Use this workflow to systematically remove obsolete guidance from your QMS.

If your QMS procedures, work instructions, or training materials reference ISO/TR 14969, here’s how to address it systematically.

Step 1 — Document search Run a controlled search of your document management system for “ISO/TR 14969,” “TR 14969,” and “14969:2004.” Flag every document where the reference appears. Include training materials and supplier quality agreements.

Step 2 — Classify each reference Not every reference creates a compliance gap. Categorize:

✅ Citation-only reference — the procedure logic is sound; only the document reference needs updating
⚠️ Interpretive reference — procedure was built around 14969 guidance that may not align with current Practical Guide interpretation (CAPA framing, risk-based audit criteria, outsourced process controls)
⚠️ Training material reference — auditors check training records; outdated citations get flagged

Step 3 — Batch the citation updates For straightforward citation updates, consolidate them into a single planned revision cycle. Update the reference from “ISO/TR 14969” to “ISO 13485:2016” or the Practical Guide as appropriate. Document the rationale in your change control record.

Step 4 — Cross-reference interpretive references against the Practical Guide For procedures built on 14969 interpretation, map them against the equivalent clause in the ISO 13485:2016 Practical Guide. Pay specific attention to: CAPA (Clause 8.5), outsourced process controls (Clause 4.1), internal audit (Clause 8.2), and post-market surveillance feedback (Clause 8.2.1). These are the areas where the 2016 guidance diverges most from 2003-era interpretation.

Step 5 — Update internal auditor training records If your ISO 13485 internal auditor training references 14969, update the training materials and re-document competency verification. This is consistently one of the overlooked items in QMS transitions — and it surfaces in audits.

Do the gap assessment before you start revising. Chasing individual references without knowing your overall QMS posture is working in the wrong order. The ISO 13485 Gap Assessment Checklist gives you the full picture first.

✅ Quick Checklist: ISO/TR 14969 Reference Review

[ ] Searched QMS document system for all 14969 references
[ ] Searched training materials and supplier quality agreements
[ ] Classified references as citation-only or interpretive
[ ] Verified CAPA procedure aligns with 2016 risk-proportionate framing — not 14969
[ ] Verified internal audit frequency and depth criteria include risk-based logic
[ ] Verified post-market surveillance feedback procedure reflects 2016 requirements
[ ] Updated training materials to remove obsolete guidance document references
[ ] Confirmed training records reflect ISO 13485:2016 Practical Guide as current source
[ ] Completed a full ISO 13485:2016 gap assessment against all 8 clauses

Where to Buy ISO 13485 and the Current Guidance Handbook

Document	Description	Source
ISO 13485:2016	The current active standard — required for certification	ANSI Webstore
ISO 13485:2016 Practical Guide	214-page official guidance handbook replacing ISO/TR 14969	ANSI Webstore — available individually or in bundles
ISO 13485 / ISO 14971 Bundle	Standard + risk management standard package	ANSI Webstore bundle
ISO/TR 14969:2004	Withdrawn — historical reference only	Available as historical document only

Use coupon code CC2026 for 5% off at the ANSI Webstore — valid through December 31, 2026. ANSI serves international buyers and offers standards in multiple languages where available.

For more on building your ISO 13485 QMS documentation, see ISO 13485 Documentation Requirements and the ISO 13485 Implementation Roadmap.

FAQ

Is ISO/TR 14969 still valid?

No. ISO/TR 14969:2004 was officially withdrawn by ISO when ISO 13485 was revised to its 2016 edition. It is no longer current and should not be used as implementation guidance for an ISO 13485:2016-aligned QMS. It remains available as a historical document only. The replacement is the ISO 13485:2016 — Medical Devices — A Practical Guide.

What replaced ISO/TR 14969?

ISO/TR 14969 was replaced by the ISO 13485:2016 — Medical Devices — A Practical Guide, a 214-page companion handbook published by ISO in 2017 and authored by ISO/TC 210 technical experts. In the United States, it was adopted by AAMI as AAMI/ISO 13485:2016 and is available through the ANSI Webstore. AAMI explicitly identifies it as the replacement for ISO/TR 14969.

Can I still reference ISO/TR 14969 in my QMS procedures?

It is not prohibited, but it creates audit risk — especially now that FDA QMSR is in effect. A reference to a withdrawn guidance document signals that your documentation system may not be current. Best practice is to replace ISO/TR 14969 citations with ISO 13485:2016 clause references or the Practical Guide, and to verify that any procedure logic built on 14969 interpretation still holds against the 2016 standard.

Does ISO/TR 14969 apply to FDA QMSR compliance?

No. ISO/TR 14969 was guidance for ISO 13485:2003. The FDA QMSR — effective February 2, 2026 — harmonizes U.S. requirements with ISO 13485:2016. QMSR compliance requires alignment with the 2016 standard and its current guidance documents. Organizations still referencing 14969 in CAPA, audit, or post-market surveillance procedures should treat QMSR implementation as the trigger to complete that cleanup.

What is the difference between a Technical Report and an ISO standard?

An ISO Technical Report carries no requirements and cannot serve as the basis for certification or regulatory inspection. ISO/TR 14969 was a TR — it existed to help organizations interpret and implement ISO 13485, not to define binding requirements. The ISO 13485:2016 Practical Guide serves the same interpretive purpose.

How is ISO/TR 14969 different from ISO 13485?

ISO 13485 is the requirements standard — it defines what a QMS must do to be certifiable. ISO/TR 14969 was guidance only — it explained how to interpret and meet those requirements. The standard is mandatory for certification; the guidance document was optional but widely used. ISO 13485:2016 is the current active standard.

Do I need to buy the ISO 13485:2016 Practical Guide separately from the standard?

Yes. The standard and the Practical Guide are separate publications. The standard defines the requirements; the Practical Guide explains clause intent and provides implementation examples. Bundle packages combining ISO 13485:2016, the Practical Guide, and ISO 14971 are available at the ANSI Webstore at savings compared to individual purchases. For manufacturers building or overhauling a QMS, having both is strongly recommended.

Where can I get ISO 13485 training that covers the current guidance?

BSI Group offers ISO 13485 training at awareness, requirements, implementation, internal auditor, and lead auditor levels — all aligned to the 2016 edition. BSI is both an accredited training provider and a recognized certification body. Pairing their implementation or internal auditor course with the Practical Guide gives you a working command of the 2016 requirements, not just familiarity with the document.

📥 Free Resources

ISO 13485 Gap Assessment Checklist — Free checklist for medical device manufacturers assessing their QMS against ISO 13485:2016 requirements before certification or a surveillance audit
ISO 9001 Roadmap — Step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — Practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — Evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification

Not Sure What to Do Next?

🔹 Still researching ISO 13485 requirements? Start with What Is ISO 13485? for a full breakdown of the standard’s scope, structure, and who needs it.

🔹 Building or upgrading your ISO 13485 QMS? The ISO 13485 Implementation Roadmap walks you through the sequence from gap assessment to certification-ready documentation. For training on the 2016 requirements, BSI Group’s ISO 13485 courses include implementation-level coverage that goes well beyond the handbook itself.

🔹 Ready to purchase the standard? Get ISO 13485:2016 at the ANSI Webstore in digital or print. Use code CC2026 for 5% off through December 31, 2026.

The Standards Navigator covers the full medical device compliance standards landscape — from ISO 13485 implementation to FDA QMSR alignment. If your QMS has to hold up against both ISO certification and FDA inspection, the guidance document you’re working from matters as much as the standard itself.

Stay Current on ISO 13485 and Medical Device Compliance

QMS procedures built on outdated guidance don’t fail audits immediately. They fail them on the third surveillance cycle, when nobody remembers where the language came from. The FDA QMSR has made that timeline shorter.

The Standards Navigator covers ISO 13485 implementation, QMSR transition, risk management requirements, and the documentation controls that keep QMS systems audit-ready across both regulatory frameworks.

👉 Get updates on the medical device compliance standards cluster 👉 Be first to access new ISO 13485 implementation resources and checklists

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

Medical Device Compliance Standards: What Manufacturers Need to Know in 2026

Medical device manufacturers face a layered compliance framework — ISO 13485, ISO 14971, FDA QMSR, and EU MDR each impose specific requirements that must work together as an integrated system. This guide explains the core standards, how they interact, and what manufacturers need to prioritize at each stage of the compliance process.

The regulatory framework every medical device manufacturer must understand before the first audit

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Compliance Gap That Gets Medical Device Manufacturers in Trouble

Most medical device manufacturers don’t fail audits because they ignored the requirements. They fail because they didn’t understand how the requirements connect — and which standards they were actually obligated to meet.

The medical device compliance standards landscape is layered. ISO 13485 sets the QMS framework. ISO 14971 governs risk management. FDA regulations run parallel to international standards and don’t always align. Supplier controls, sterilization validation, design controls, and labeling each carry their own standard reference. A manufacturer who treats these as independent checkboxes instead of an integrated system is building toward an audit finding — or worse, a product recall.

The stakes are not abstract. The FDA issued 483 observations totaling thousands of findings in the medical device sector last year. Most cited documentation gaps, inadequate CAPA processes, or failure to meet design control requirements — all areas governed by the standards covered in this guide.

I’ve worked in quality systems that span heavy industrial, energy, and manufacturing environments — and the pattern I’ve seen across every sector is the same: organizations that struggle with audits are usually managing compliance requirements in silos. In the medical device world, that problem is amplified because the regulatory framework is both more complex and less forgiving than most industrial standards. Getting the structure right before your first audit is not optional — it’s the difference between certification and a warning letter.

Before you map your compliance requirements, download the ISO 13485 Gap Assessment Checklist — it walks you through every clause so you can identify exactly where your QMS falls short before an auditor does → ISO 13485 Gap Assessment Checklist

In This Guide:

The core standards every medical device manufacturer must know
How ISO 13485, ISO 14971, and FDA regulations interact
US vs. EU regulatory requirements compared
Supplier control and special process standards
Decision-stage guidance: what to prioritize based on where you are in the compliance process

👉 Start Here — Top Resources

Buy ISO 13485:2016 — ANSI Webstore — the official QMS standard for medical device manufacturers (use code CC2026 for 5% off)
ISO 13485 Training — BSI Group — training courses and certification services for ISO 13485
Buy ISO 14971:2019 — ANSI Webstore — risk management standard required alongside ISO 13485

The Core Standard: ISO 13485:2016

ISO 13485:2016 infographic showing clause structure and comparison of ISO 13485 versus ISO 9001 requirements for medical device quality management systems. — A visual breakdown of ISO 13485:2016 requirements and how they differ from ISO 9001 for medical device manufacturers.

ISO 13485:2016 is the international standard for quality management systems specific to medical device manufacturers and their supply chains. It is the foundation of medical device compliance worldwide.

ISO 13485 is not simply ISO 9001 with medical device language added. The two standards share structural similarities through the harmonized high-level clause structure, but ISO 13485 imposes stricter requirements in several critical areas ISO 9001 leaves to organizational discretion:

Requirement Area	ISO 9001:2015	ISO 13485:2016
Risk management	Risk-based thinking (general)	Formal risk management required (links to ISO 14971)
Design controls	Required	More prescriptive — validation, verification, design transfer
CAPA	Required	More detailed — specific investigation and effectiveness checks
Regulatory requirements	Not addressed	Explicitly required — must identify and meet applicable regs
Sterile product controls	Not addressed	Specific controls for sterile devices
Supplier controls	Required	More stringent — supplier qualification and monitoring
Document and record retention	Not specified	Specific retention periods tied to device lifetime

If you are ISO 9001 certified and entering the medical device market, you are not starting from scratch — but you are adding significant requirements. The gap is larger than most manufacturers expect.

If you need the standard itself, ISO 13485:2016 is available through the ANSI Webstore — use code CC2026 for 5% off through December 31, 2026.

Most common finding: Inadequate document control — specifically, failure to control the review and approval of documents and maintain records of changes. ISO 13485 Clause 4.2 is one of the most frequently cited areas in FDA 483 observations.

Risk Management: ISO 14971:2019

ISO 14971 is the international standard for risk management applied to medical devices. It is not optional if you are manufacturing medical devices — ISO 13485 explicitly requires you to apply risk management throughout the product lifecycle, and ISO 14971 is the recognized method for doing it.

ISO 14971:2019 defines the process for:

Identifying hazards associated with a medical device
Estimating and evaluating associated risks
Controlling those risks
Monitoring the effectiveness of controls

The relationship between ISO 13485 and ISO 14971 is not optional. ISO 13485 Clause 7.1 requires organizations to establish risk management requirements for product realization. ISO 14971 is the standard that defines what “proper” risk management looks like. Auditors will look for evidence that your risk management file connects directly to your design controls, production processes, and post-market surveillance activities.

ISO 14971 vs. ISO 13485 — understanding how they interact is one of the most common questions from manufacturers building a QMS for the first time.

If your risk management files exist independently of your design control documentation — that is an audit finding waiting to happen. Most teams miss the linkage between hazard identification in the risk management file and the verification/validation activities in the design history file.

Run your gap assessment before you go further — most QMS gaps in medical device companies trace back to missing connections between ISO 14971 risk files and ISO 13485 design controls: ISO 13485 Gap Assessment Checklist

US Regulatory Requirements: FDA QMSR and 21 CFR Part 820

US medical device manufacturers operate under FDA jurisdiction. The Quality Management System Regulation (QMSR), which took effect February 2, 2026, replaced the legacy Quality System Regulation (QSR) under 21 CFR Part 820.

The QMSR represents a significant shift: it incorporates ISO 13485:2016 by reference as the baseline for device QMS requirements. This means FDA-regulated manufacturers who are ISO 13485 certified are closer to QMSR compliance than they were under the old QSR — but important differences remain.

Area	ISO 13485:2016	FDA QMSR (2026)
Scope	International	US market devices only
Complaints	Required	Required + specific MDR reporting timelines
Corrections and removals	Addressed in CAPA	Specific FDA reporting requirements (21 CFR Part 806)
UDI	Not addressed	Required for most device classes
Electronic records	Not specified	21 CFR Part 11 compliance required
Third-party audits	Required for ISO 13485 certification	FDA inspections — not third-party certification

Understanding the relationship between FDA QSR and ISO 13485 is essential for US manufacturers — the two frameworks are now more aligned than before, but they are not identical.

If you are selling devices in the US market, FDA QMSR compliance is a legal requirement, not a voluntary certification. ISO 13485 certification does not satisfy FDA obligations — it demonstrates QMS capability but does not substitute for an FDA inspection.

Comparison infographic showing US FDA QMSR and EU MDR regulatory pathways for medical device manufacturers and ISO 13485 quality system requirements. — A side-by-side comparison of US FDA QMSR and EU MDR pathways showing how medical device compliance differs across global markets.

EU Requirements: MDR and CE Marking

Selling medical devices in the European Union requires CE marking under the EU Medical Device Regulation (MDR 2017/745), which replaced the Medical Device Directive (MDD) and came into full effect in 2021. The transition deadline for legacy MDD-certified devices has been extended but enforcement has tightened significantly.

Key MDR requirements relevant to QMS:

MDR Requirement	Connection to ISO 13485
Technical documentation	Design history file / DHF requirements
Clinical evaluation	Post-market clinical follow-up (PMCF)
Unique Device Identification (UDI)	Traceability requirements
Post-market surveillance (PMS)	Customer feedback and complaint monitoring
Notified Body audit	ISO 13485 certification is typically required
Person Responsible for Regulatory Compliance (PRRC)	Management responsibility — ISO 13485 Clause 5

The MDR is more prescriptive than ISO 13485 in clinical evidence requirements. If you are exporting to the EU, your clinical evaluation report and post-market surveillance plan must meet MDR requirements that go beyond what ISO 13485 explicitly requires.

If you are selling in both the US and EU markets, you are managing two regulatory frameworks simultaneously. This is where a well-structured ISO 13485 QMS becomes particularly valuable — it provides the common foundation that both frameworks build on.

Supplier Controls and Special Process Standards

ISO 13485 Clause 7.4 imposes stricter supplier control requirements than most manufacturers new to the medical device space expect. You are not simply verifying that a supplier has a quality system — you are responsible for ensuring that purchased products and services meet specified requirements and that critical suppliers are evaluated, approved, and monitored.

For medical device manufacturers, supplier controls must address:

Supplier qualification — documented criteria for evaluation and approval
Incoming inspection — defined acceptance criteria for purchased product
Critical supplier monitoring — ongoing performance data, not just initial qualification
Supplier audits — for high-risk or critical component suppliers
Flow-down requirements — pushing your quality requirements into the supply chain

Special processes — sterilization, biocompatibility testing, coating, welding on implantable components — require additional validation documentation. The relevant standards include:

Process	Standard Reference
Sterilization (EO, radiation, steam)	ISO 11135, ISO 11137, ISO 17665
Biocompatibility	ISO 10993 series
Packaging validation	ASTM F2132, ISO 11607
Software validation	IEC 62304
Electrical safety	IEC 60601 series

These are not optional for manufacturers of the relevant device types. If your device is sterilized, you need sterilization validation documentation. If it contacts patient tissue, you need biocompatibility data. Gaps in special process validation are among the most serious findings an FDA inspector or Notified Body auditor can cite.

Design Controls and Validation Standards

ISO 13485 design controls infographic showing the Design History File process from inputs through outputs, verification, validation, and design transfer. — A visual guide to the ISO 13485 design controls process and how design inputs become validated, production-ready medical devices.

Design controls are where ISO 13485 certification and FDA compliance intersect most directly. ISO 13485 Clause 7.3 requires a structured design and development process covering:

Design and development planning
Design inputs (requirements)
Design outputs (specifications)
Design review at defined stages
Design verification (does it meet inputs?)
Design validation (does it meet user needs?)
Design transfer (can it be manufactured consistently?)
Design changes (controlled and documented)

The design history file (DHF) is the physical record of this entire process. It is the first thing an FDA inspector or Notified Body auditor will request. Manufacturers who build their DHF as a collection of unconnected documents — rather than as a traceable record linking inputs to outputs to verification to validation — create significant risk for themselves.

If you are new to building a medical device QMS and need a structured path through these requirements, the ISO 13485 Implementation Roadmap on The Standards Navigator covers the full sequence from gap assessment through certification.

BSI Group offers ISO 13485 training covering both requirements understanding and implementation — useful for teams building their first medical device QMS or transitioning from a general ISO 9001 system.

Labeling and Traceability Standards

Labeling compliance is a specific, frequently cited area in FDA 483 observations. Under both FDA QMSR and MDR requirements, device labeling must meet defined content and format requirements — and the label must be controlled as a quality record.

Key labeling standards and requirements:

ISO 15223-1 — symbols used in medical device labeling (required for EU MDR compliance)
21 CFR Part 801 — FDA labeling requirements for US devices
UDI requirements — FDA requires Unique Device Identification on most device labels, with submission to the GUDID database

Traceability connects directly to your CAPA and complaint handling processes. If a complaint involves a specific lot or device unit, your traceability records must be sufficient to identify affected products, investigate the root cause, and determine corrective action scope. ISO 13485 Clause 7.5.9 addresses traceability explicitly — and auditors will test it.

How the Standards Work Together

Layered medical device compliance standards infographic showing ISO 13485 as the foundation with ISO 14971, FDA QMSR, EU MDR, supplier controls, CAPA, and traceability requirements. — A visual framework showing how ISO 13485, FDA QMSR, EU MDR, and supporting standards connect into an integrated medical device compliance system.

The most important thing to understand about medical device compliance is that these standards are not independent — they form an integrated system. Here is how they connect:

Standard	Role in the System
ISO 13485:2016	QMS framework — the backbone that everything else connects to
ISO 14971:2019	Risk management process — required by ISO 13485, referenced throughout
FDA QMSR	US regulatory layer — builds on ISO 13485, adds FDA-specific requirements
EU MDR	EU regulatory layer — requires ISO 13485 certification via Notified Body
IEC 62304	Software lifecycle — required if your device includes software
ISO 10993	Biocompatibility — required for patient-contacting devices
ISO 15223	Labeling symbols — required for EU MDR labeling compliance

A manufacturer who has ISO 13485 certification, a complete ISO 14971 risk management file, and solid FDA QMSR documentation has built the framework that all additional standards layer onto. The common mistake is treating each standard as a separate compliance project rather than building the integrated system first.

If you are deciding between prioritizing FDA QMSR or ISO 13485 certification first: in most cases, building to ISO 13485 gives you the QMS foundation that both US and EU regulatory compliance require. The ISO 13485 Documentation Requirements article covers what your QMS documentation set must include.

Quick Compliance Checklist

Use this as a starting reference — not a substitute for a clause-by-clause gap assessment.

✅ ISO 13485:2016 obtained and QMS scope defined
✅ Risk management procedure in place referencing ISO 14971
✅ Design controls documented — inputs, outputs, verification, validation, transfer
✅ CAPA process established with effectiveness verification
✅ Supplier qualification and monitoring program documented
✅ Document and record control procedures in place with defined retention periods
✅ Internal audit program scheduled and resourced
✅ Management review process defined and conducted
✅ Complaint handling and MDR/vigilance reporting process established
✅ UDI requirements evaluated and implemented where applicable
✅ Applicable special process validations identified and documented
✅ Labeling reviewed against ISO 15223 (EU) and 21 CFR Part 801 (US)

⚠️ If you cannot check most of these — complete a formal gap assessment before committing to a certification timeline.

FAQ

Is ISO 13485 certification required to sell medical devices?

ISO 13485 certification is not legally required by US law — the FDA requires QMSR compliance, not ISO 13485 certification specifically. However, ISO 13485 certification is required to sell devices in the EU under MDR, and it is increasingly required by OEM customers and contract manufacturers as a condition of doing business. Most manufacturers targeting both markets pursue certification.

How is ISO 13485 different from ISO 9001?

ISO 13485 is a sector-specific standard derived from ISO 9001 but with significantly stricter requirements in risk management, design controls, CAPA, supplier controls, and regulatory compliance. It does not include the continual improvement emphasis that ISO 9001 requires — instead it focuses on consistent compliance with regulatory requirements. A detailed comparison is covered here.

Do I need ISO 14971 if I am ISO 13485 certified?

Yes. ISO 13485 explicitly requires risk management throughout the product lifecycle and references ISO 14971 as the applicable method. You are not ISO 13485 compliant if your risk management process does not meet ISO 14971 requirements. The two standards work together — you cannot separate them.

What is the FDA QMSR and how is it different from the old QSR?

The Quality Management System Regulation (QMSR) took effect February 2, 2026 and replaced 21 CFR Part 820 (the Quality System Regulation). The QMSR incorporates ISO 13485:2016 by reference, making it more aligned with the international standard. Key differences remain around FDA-specific reporting requirements, UDI obligations, and 21 CFR Part 11 electronic records requirements. A full breakdown of FDA QSR vs ISO 13485 is here.

How long does it take to get ISO 13485 certified?

For a manufacturer building a QMS from scratch, 12–18 months is a realistic timeline. Organizations with an existing ISO 9001 QMS can often close the gap in 6–12 months, depending on how many medical device-specific requirements need to be added. The ISO 13485 Implementation Roadmap covers the full timeline in detail.

What is a Notified Body and do I need one?

A Notified Body is an organization designated by EU member states to assess conformity of medical devices under the MDR. If you are seeking CE marking for Class IIa, IIb, or Class III devices, you must engage a Notified Body — they conduct the audits that verify ISO 13485 compliance and technical documentation. BSI Group is one of the major Notified Bodies offering both training and certification services.

What are the most common ISO 13485 audit findings?

The most frequently cited areas include: inadequate document and record control (Clause 4.2), incomplete CAPA processes with missing effectiveness verification (Clause 8.5.2), insufficient supplier qualification documentation (Clause 7.4), and gaps in design control records — particularly missing design verification and validation evidence (Clause 7.3). Common mistakes in ISO 13485 QMS implementation covers these in detail.

Do my suppliers need to be ISO 13485 certified?

Not necessarily — but you are responsible for ensuring purchased product meets specifications regardless. Whether a supplier needs ISO 13485 certification depends on their criticality and what they supply. Critical component suppliers and contract manufacturers of finished devices are typically expected to be certified. Commodity suppliers may only require documented incoming inspection.

📥 Free Resources

ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements — medical device articles only

ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system

Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments

Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts

AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification

Not Sure What to Do Next?

🔹 Still researching your compliance requirements? Start with a gap assessment against ISO 13485 before you invest in implementation. Download the free ISO 13485 Gap Assessment Checklist — it maps every clause so you know exactly where you stand.

🔹 Ready to build your QMS? ISO 13485 training through BSI Group covers requirements, implementation, and internal auditor training — the right sequence for a team building their first medical device QMS.

🔹 Need the standard itself? Buy ISO 13485:2016 through the ANSI Webstore — use code CC2026 for 5% off through December 31, 2026. International buyers can purchase in multiple languages.

Medical device compliance is not a single standard — it is a framework of interconnected requirements that must be built and maintained as a system. Understanding how ISO 13485, ISO 14971, FDA QMSR, and EU MDR relate to each other is the first step toward building a QMS that holds up under audit. The Standards Navigator covers each of these standards in depth — start with the resources above and build from there.

Stay Current on Medical Device Compliance

Regulatory changes in the medical device space don’t slow down. FDA QMSR took effect in 2026. EU MDR enforcement is intensifying. ISO 14971 continues to be misapplied by manufacturers who treat risk management as a documentation exercise rather than an integrated process.

Organizations that keep pace with these changes have one thing in common — they’re not waiting for an audit finding to tell them something changed. The ones that struggle are managing compliance reactively, updating their QMS only when a customer or inspector forces the issue.

The Standards Navigator covers ISO 13485, ISO 14971, FDA regulatory requirements, and the full medical device compliance framework — from standard purchase through certification and ongoing surveillance.

👉 Get updates when new medical device compliance articles publish
👉 Be first to access the ISO 13485 Documentation Kit when it launches

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

ISO 13485 Implementation Roadmap: How to Build a Compliant Medical Device QMS in 2026

ISO 13485:2016 is now US federal law under the FDA QMSR, making a compliant medical device QMS mandatory rather than optional. This roadmap walks manufacturers through a seven-phase implementation — from gap assessment and scope through risk management, documentation, CAPA, and certification — covering both the international certification path and FDA inspection readiness for US manufacturers building from the ground up.

A step-by-step guide to implementing ISO 13485:2016 — from gap assessment to certification and FDA QMSR readiness

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

Building a Medical Device QMS Is No Longer Optional in the United States

For years, ISO 13485 sat in a strange position for US manufacturers. It was the global benchmark for medical device quality management — required to sell in the EU, Canada, and most of the world — but inside the United States it was voluntary. You complied with FDA’s Quality System Regulation, and ISO 13485 was a nice-to-have for export.

That changed on February 2, 2026. FDA’s Quality Management System Regulation (QMSR) took effect, replacing the old Quality System Regulation and incorporating ISO 13485:2016 by reference directly into 21 CFR Part 820. The practical effect is blunt: ISO 13485:2016 is now part of US federal law. FDA inspections are conducted against it. The standard you could once ignore at home is now the framework your inspector arrives with.

So whether you are a US manufacturer preparing for your first QMSR-aligned FDA inspection, or an international supplier chasing your first ISO 13485 certificate to unlock the EU market, you face the same task: build a quality management system that survives outside scrutiny. This roadmap walks you through it — clause by clause, phase by phase — from the day you decide to start to the day a registrar or an FDA investigator walks through the door.

This ISO 13485 implementation roadmap is a long article because building a medical device QMS is a long project. Use the table of contents to jump to where you are.

Before you build anything, find out where you actually stand. Most teams overestimate how compliant their existing processes are — and discover the gaps during the certification audit or FDA inspection, when fixing them is expensive and the clock is running. Run a clause-by-clause check against ISO 13485:2016 first.

👉 Download the free ISO 13485 Gap Assessment Checklist and benchmark your QMS in an afternoon, before you commit budget to implementation.

In This Guide

Why ISO 13485 implementation looks different in 2026 (QMSR, EU reforms)
The realistic timeline and cost of a full implementation
A seven-phase roadmap from gap assessment to certificate
How risk management (ISO 14971) and design controls fit into the QMS
The documentation you actually need — and where teams over-build
Internal audit, management review, and Stage 1 / Stage 2 audit preparation
FDA QMSR inspection readiness for US manufacturers
The mistakes that fail audits — and how to avoid them

👉 Start Here (Top Resources)

If you are implementing ISO 13485 from scratch, these are the three resources that move the project fastest:

Build your documentation without a consultant. A complete, pre-written ISO 13485 documentation kit gives you the quality manual, procedures, and records templates structured to the standard — so you spend your time tailoring, not drafting from a blank page. 👉 See the ISO 13485 documentation kits at 9001Simplified
Get the official standard. You cannot implement a clause you have not read. Buy ISO 13485:2016 from the ANSI Webstore — use code CC2026 for 5% off through December 31, 2026. ANSI serves international buyers and offers standards in multiple languages.
Train your internal team. Your management representative and internal auditors need formal training. BSI Group offers ISO 13485 training courses spanning awareness through lead auditor.

What Makes 2026 Different

ISO 13485:2016 is still the current edition — and it will be for a while. ISO postponed the next revision deliberately to let the 2016 edition “bed in,” with a new version not expected before roughly 2028–2029. So the standard you implement today is the standard you will operate under for years. That stability is good news: it means your implementation work has a long shelf life.

What has shifted is the regulatory context around the standard.

In the United States, the QMSR is the headline. FDA now incorporates ISO 13485:2016 into 21 CFR Part 820, layered with a handful of FDA-specific additions — labeling, UDI, and certain record and definition provisions — that go beyond the ISO text. A critical nuance: the QMSR is “version locked” to the 2016 edition. Future ISO 13485 revisions will not automatically apply in the US unless FDA initiates new rulemaking. Certification to ISO 13485 is still not legally required in the US — FDA inspects you directly — but building your QMS to the standard is now the most direct path to QMSR compliance.

In the European Union, the pressure point is notified body capacity, not the standard itself. EU Implementing Regulation 2026/977, published in May 2026 and applying from February 25, 2027, finally imposes hard maximum timelines on notified bodies — 30 days to review an application and sign a contract, 120 days for the QMS audit, 90 days for product verification, and 20 days to issue the certificate, with capped clock-stops and transparent quotations. For manufacturers, the message is that the certification path is becoming more predictable, but you still need a clean, audit-ready QMS to take advantage of it.

One more 2026 wrinkle worth flagging if your devices touch biocompatibility: FDA’s recognition of the sixth edition of ISO 10993-1 is partial. Notably, FDA does not recognize Clause 6.9 on biological risk estimation, holding that it conflicts with the recognized risk management standard ISO 14971:2019. If your risk files cite ISO 10993-1 wholesale, that is now a deficiency-letter risk in US submissions. Keep biological risk inside the ISO 14971 framework. We cover biocompatibility in depth separately — for this roadmap, just know that your risk management process is the anchor, not the 10993 series.

If you sell only in the US → build to ISO 13485:2016 for QMSR compliance and skip certification unless a customer demands it. If you sell internationally → you need an actual ISO 13485 certificate from an accredited registrar, so plan for a Stage 1 / Stage 2 audit. If you sell in both markets → build one QMS to ISO 13485:2016 and bolt on the FDA-specific QMSR additions; do not run two parallel systems.

QMSR vs ISO 13485 at a Glance

The two frameworks now share a core, but they are not identical. This is where US and international readers diverge — and where a single well-built QMS can serve both.

Dimension	ISO 13485:2016	FDA QMSR (21 CFR Part 820)
Legal status	Voluntary international standard	Mandatory US federal regulation
Core requirements	The full ISO 13485 QMS	Incorporates ISO 13485:2016 by reference
Proof of compliance	Certificate from accredited registrar	FDA inspection — no certificate issued
Added requirements	None beyond the standard	Labeling, UDI, certain records & definitions
Risk management	References ISO 14971	Requires ISO 14971 framework; rejects ISO 10993-1 Clause 6.9
Version handling	ISO may revise (~2028–2029)	“Version locked” to the 2016 edition
Who needs it	Anyone selling internationally	Any device manufacturer marketing in the US

For the full treatment, see our dedicated FDA QSR vs ISO 13485 comparison.

Timeline and Cost: What to Expect

A realistic ISO 13485 implementation runs 6 to 12 months for a small-to-mid-size manufacturer building from a limited starting point. Companies already operating a mature ISO 9001 system or a legacy QSR-based system can move faster; companies starting from informal processes should plan for the full year.

ISO 13485 implementation timeline infographic showing a phased 6 to 12 month roadmap for medical device manufacturers progressing from gap assessment through certification. — A visual roadmap showing a realistic ISO 13485 implementation timeline from assessment through certification readiness.

Phase	Typical duration	What drives it
Gap assessment & scope	2–4 weeks	Size of the gap between current practice and the standard
Process & documentation build	8–16 weeks	Whether you draft from scratch or start from templates
Implementation & operation	8–12 weeks	You need real records, not just documents — audits want evidence
Internal audit & management review	3–4 weeks	Must be complete before a registrar will proceed to Stage 2
Certification (Stage 1 + Stage 2)	6–10 weeks	Registrar scheduling and any nonconformity closure

On cost, the single biggest variable is whether you hire a consultant to draft your system or build it yourself from a structured template. Consultant-led implementations commonly run $15,000–$50,000+ depending on device class and company size. A template-driven build can cut the documentation labor dramatically. For a full breakdown, see our guide on how much ISO 13485 certification costs.

Phase 1 — Foundation: Scope, Standard, and Leadership Commitment

Everything downstream depends on getting three things right at the start.

Define your QMS scope. ISO 13485 lets you exclude certain requirements — for example, design and development (Clause 7.3) if you are a contract manufacturer building to a customer’s design. But exclusions must be justified and documented, and you cannot exclude something just because it is inconvenient. Map which clauses apply to your role: manufacturer, specification developer, contract manufacturer, sterilization provider, or importer. Your scope statement is the first thing a registrar reads and the boundary an FDA investigator works within.

Acquire and read the standard. This sounds obvious and gets skipped constantly. You cannot delegate compliance with a document nobody on the team has read end to end. Buy the official ISO 13485:2016 text from the ANSI Webstore — apply coupon CC2026 for 5% off through the end of 2026 — and have your management representative work through it clause by clause. If you also need the risk management standard, ISO 14971:2019 is available there too. ANSI’s catalog covers international buyers and multiple languages, which matters if your QMS spans sites.

Secure genuine leadership commitment. Clause 5 puts top management on the hook — quality policy, quality objectives, resource allocation, and management review are not delegable to a quality manager working in isolation. The fastest implementations have an executive sponsor who clears roadblocks. The ones that stall have a quality team trying to impose a system the leadership treats as paperwork.

If you are a contract manufacturer → document your design and development exclusion now, with justification, before you build the rest of the system around it.

⚠️ Common pitfall: Claiming a Clause 7.3 exclusion you can’t defend. If your team does any design input — even tweaking a customer’s spec for manufacturability — a registrar may reject the exclusion and you’ll be retrofitting design controls mid-project. Decide your true scope honestly before you build.

Most ISO 13485 projects don’t fail on the standard — they fail on documentation that nobody can find, follow, or defend in an audit. Before you write a single procedure, make sure you know which records the standard actually requires.

👉 Run the gap assessment and map your existing documents against the clauses — it turns “we think we’re covered” into a defensible list.

Phase 2 — Plan: Processes, Roles, and Competence

ISO 13485 is a process-based standard. Before documentation, map your actual processes and how they connect — the “sequence and interaction” the standard requires.

Identify your core processes. At minimum: management processes (planning, review, resourcing), product realization (design, purchasing, production, servicing), and support processes (document control, records, CAPA, internal audit). For each, define inputs, outputs, owners, and the records that prove it ran.

Appoint a management representative. Clause 5.5.2 requires a member of management responsible for the QMS. This person owns the system, reports its performance to leadership, and is typically the registrar’s main point of contact.

Plan competence and training. Clause 6.2 requires that personnel performing work affecting product quality are competent — with records to prove it. This includes your internal auditors, who must be trained and independent of the areas they audit. Formal training shortens the learning curve here; BSI Group’s ISO 13485 course catalog runs from awareness through lead auditor, and the lead-auditor tier is what equips your internal audit program to find problems before the registrar does. For audit methodology itself, note that the underlying guidance standard, ISO 19011, was updated to a 2026 edition in May 2026 — worth referencing when you write your internal audit procedure.

⚠️ Common pitfall: Treating internal auditor “independence” as a formality. Having someone audit their own department is one of the most common nonconformities — and it quietly undermines every finding that audit produces. Cross-train auditors so no one reviews work they own.

Phase 3 — Risk Management and Design Controls

This is where ISO 13485 separates itself from ISO 9001, and where the most consequential implementation decisions live.

Risk management is the spine. ISO 13485 threads risk-based thinking through the entire product lifecycle, and it leans on ISO 14971:2019 as the method. You need a risk management process, a risk management file for each device or device family, and evidence that risk controls are verified and monitored in production and post-market. As noted earlier, keep biological risk inside this ISO 14971 framework rather than importing a separate scoring approach — that alignment is exactly what FDA expects under the QMSR.

Design controls (Clause 7.3) apply if you develop devices. This is the discipline FDA investigators scrutinize hardest, because design failures are where patients get hurt. You need:

Design control element	What it requires
Design and development planning	A documented plan with stages, reviews, and responsibilities
Design inputs	Requirements derived from intended use, user needs, and regulation
Design outputs	Specifications that can be verified against inputs
Design review	Formal reviews at planned stages with independent reviewers
Design verification	Evidence outputs meet inputs
Design validation	Evidence the device meets user needs in actual or simulated use
Design transfer	Controlled handoff to production
Design changes	Controlled, reviewed, and documented changes
Design history file (DHF)	The complete record of the above

If you are a US manufacturer, the QMSR keeps design controls firmly in play — they map directly onto the ISO 13485 Clause 7.3 requirements, which is one reason a single ISO-aligned system now serves both purposes.

If you are preparing your first device submission → build the risk management file and design history file in parallel with the QMS, not after. Auditors and investigators expect to see them populated, not planned.

⚠️ Common pitfall: Building the risk file as a one-time document for the submission, then never touching it again. Risk management is a living, lifecycle requirement — production and post-market data have to feed back into it. A risk file frozen at launch is a finding waiting to happen.

Phase 4 — Build the Documentation

Now you write the system. ISO 13485 expects a defined documentation hierarchy: a quality manual, documented procedures, work instructions, forms, and the records they generate.

ISO 13485 documentation architecture infographic showing the five-layer quality management documentation hierarchy from quality manual through records. — A visual breakdown of the five documentation layers used to build and maintain an ISO 13485 quality management system.

The required documents. ISO 13485:2016 explicitly requires certain documented procedures — document control, record control, management review, internal audit, control of nonconforming product, CAPA, and several product-realization procedures among them. A medical device file (technical documentation) is required for each device type. Our breakdown of ISO 13485 documentation requirements lists exactly what the standard mandates versus what is optional.

Where teams over-build. The most common documentation mistake is writing procedures more detailed and rigid than the operation can actually follow. Every sentence in a procedure is a commitment an auditor can hold you to. If your procedure says calibration happens every 90 days and a record shows 95, that is a nonconformity you created with your own words. Write to what you do; improve what you do separately.

Start from a structured template, not a blank page. Drafting an entire ISO 13485 documentation set from scratch is where 6-month projects become 12-month projects. A complete documentation kit gives you the quality manual, every required procedure, and the records templates already structured to the clauses — so your team spends its hours tailoring language to your operation instead of reinventing the architecture of a QMS.

👉 See what’s included in the 9001Simplified ISO 13485 documentation kit — it is the no-consultant route most small manufacturers should evaluate first.

Set up document and record control before you generate volume. Clauses 4.2.4 and 4.2.5 require controlled documents and controlled records. Get the control mechanism — versioning, approval, retention, retrieval — working before you have hundreds of documents to retrofit.

⚠️ Common pitfall: Over-documenting. Teams write procedures so detailed and rigid that the floor can’t actually follow them — then every deviation from their own paperwork becomes a nonconformity. Document what you genuinely do, keep procedures lean, and push the specifics down into work instructions where they’re easier to change.

Phase 5 — Implement and Operate

A documented QMS proves nothing. Auditors and investigators want records that show the system ran.

This is the phase teams underestimate. You can write a CAPA procedure in a day; demonstrating that CAPA actually works requires real CAPAs opened, investigated, and closed over weeks. Plan for an operating period — typically 8 to 12 weeks minimum — where the system runs and generates genuine evidence: training records, calibration records, completed reviews, supplier evaluations, nonconformance reports, and CAPA records.

A registrar will not progress to a certification audit, and an FDA investigator will not be satisfied, by documents alone. Both want to trace a process from requirement to record to outcome. Build that evidence trail before you invite anyone to inspect it.

If you are under customer pressure to certify quickly → start operating the system in parallel with finishing documentation, so your evidence trail is already accumulating when the documents are signed off.

⚠️ Common pitfall: Booking the certification audit before the system has actually run. A registrar can tell the difference between a QMS that has operated for three months and one that generated all its records last week. Backdated or thin evidence is the fastest way to turn a Stage 2 audit into a list of nonconformities.

Phase 6 — CAPA, Supplier Controls, and Production Controls

Three areas generate the most audit findings and FDA 483 observations. Get them right and you de-risk the entire certification.

CAPA (Corrective and Preventive Action). This is the single most-cited area in medical device QMS audits. A weak CAPA system — actions opened and never closed, root causes not actually identified, effectiveness never verified — signals to an auditor that the whole system is decorative. Your CAPA process must show genuine root cause analysis, defined actions, and verified effectiveness. Our deep dive on CAPA requirements in ISO 13485 covers the failure modes in detail.

Supplier and purchasing controls (Clause 7.4). You are accountable for what your suppliers provide. You need defined supplier evaluation criteria, approved-supplier records, and controls proportionate to the risk the purchased product carries. Flow your quality requirements down in writing — handshake arrangements do not survive audits.

Production and process controls (Clauses 7.5). This includes process validation for any process whose output cannot be fully verified by later inspection — sterilization and certain welding or molding processes are classic examples — plus identification, traceability, and handling of product. Cleanliness, contamination control, and installation/servicing requirements apply where relevant to your device.

A documentation kit accelerates this layer too. The CAPA log, supplier evaluation forms, nonconformance records, and validation templates are exactly the high-stakes documents you do not want to invent under deadline.

👉 A structured kit gives you defensible templates for all three areas so your effort goes into running the processes, not formatting the paperwork.

Avoid the recurring traps documented in our guide to common mistakes in ISO 13485 QMS implementation — most failures are predictable.

⚠️ Common pitfall: Closing CAPAs without verifying effectiveness. “We retrained the operator” is not a closed CAPA — it’s an action with no proof it worked. Auditors reopen these constantly. Every CAPA needs a defined effectiveness check and evidence it passed before you close it.

Phase 7 — Internal Audit, Management Review, and Certification

Before any external party inspects you, inspect yourself.

Internal audit (Clause 8.2.4). Conduct a full internal audit of your QMS against ISO 13485 using trained, independent auditors. This is your dress rehearsal — the audit that finds problems while you still control the timeline and the narrative. Document findings, open CAPAs, and close them.

Management review (Clause 5.6). Top management formally reviews QMS performance against defined inputs — audit results, customer feedback, process performance, CAPA status, and more — and produces documented outputs and decisions. Registrars treat a missing or hollow management review as a serious gap.

The certification audit (international path). An accredited registrar conducts a two-stage audit:

Stage	Focus	Outcome
Stage 1	Documentation review and readiness	Confirms the system is ready for Stage 2; identifies gaps
Stage 2	On-site implementation audit	Verifies the system operates as documented; raises any nonconformities

Close any nonconformities, and the registrar issues your certificate — typically valid for three years with annual surveillance audits. Choosing an accredited registrar matters; verify accreditation through bodies like ANAB or the relevant IAF member. Our guide to the best ISO certification bodies walks through selection.

⚠️ Common pitfall: Running a hollow management review to check the box. A review that doesn’t actually examine audit results, CAPA status, and process performance — and produce real decisions — is treated by registrars as a serious gap, because it signals leadership isn’t engaged. Make it substantive, and keep the minutes.

FDA QMSR Inspection Readiness

If you are a US manufacturer, your “certification audit” may instead be an FDA inspection — and the bar is the QMSR, which now runs on ISO 13485:2016 plus FDA’s additions.

Practical readiness steps:

Map ISO 13485 to the QMSR additions. Most of your ISO-aligned system satisfies Part 820 directly. Layer in the FDA-specific requirements — labeling and packaging controls, UDI, and certain record and complaint-handling provisions — that exceed the ISO text.
Keep your records inspection-ready, not audit-ready-once. FDA inspections are unannounced or short-notice. The evidence trail from Phase 5 has to be standing, not assembled on demand.
Treat CAPA and complaint handling as the focal points. These are where 483 observations concentrate. A clean, closed-loop CAPA system is your strongest signal of control.
Understand the relationship between the two frameworks. Our comparison of FDA QSR vs ISO 13485 explains exactly what the QMSR changed and where the frameworks now align.

For US manufacturers selling internationally, the efficient move is one ISO 13485 QMS with the QMSR additions built in — not two systems. The frameworks now overlap by design.

Quick Implementation Checklist

Use this as a high-level progress tracker. Each item maps to a phase above.

✅ QMS scope defined and exclusions justified in writing
✅ Official ISO 13485:2016 (and ISO 14971:2019) acquired and read
✅ Top management commitment secured; quality policy and objectives set
✅ Management representative appointed
✅ Core processes mapped with owners, inputs, outputs, and records
✅ Personnel competence and internal auditor training in place
✅ Risk management process and risk management file established (ISO 14971)
✅ Design controls and design history file in place (if you develop devices)
✅ Quality manual, required procedures, and record templates written
✅ Document control and record control operating before volume builds
✅ System operated long enough to generate genuine records (8–12 weeks)
✅ CAPA system demonstrably closing the loop with verified effectiveness
✅ Supplier evaluation and purchasing controls documented and flowed down
✅ Process validation completed where output can’t be fully verified
✅ Full internal audit completed; findings closed
✅ Management review conducted with documented outputs
✅ Registrar selected (international) or QMSR inspection readiness confirmed (US)
✅ Stage 1 and Stage 2 audit passed; nonconformities closed

FAQ

How long does ISO 13485 implementation take?

For a small-to-mid-size manufacturer building from a limited starting point, plan for 6 to 12 months. Companies with a mature ISO 9001 system or a legacy QSR-based system can move faster, while organizations starting from informal processes should plan for the full year. The longest single phase is usually documentation, followed by the operating period needed to generate real records.

Is ISO 13485 certification required in the United States?

No. FDA inspects US manufacturers directly against the QMSR, which incorporates ISO 13485:2016 — certification by a third-party registrar is not legally required. However, building your QMS to ISO 13485 is now the most direct path to QMSR compliance, and certification is required to sell in the EU, Canada, and most international markets. Many US manufacturers certify anyway to serve global customers and demonstrate a recognized standard of control.

What is the difference between ISO 13485 and the FDA QMSR?

The QMSR, effective February 2, 2026, replaced FDA’s old Quality System Regulation and incorporates ISO 13485:2016 by reference into 21 CFR Part 820, plus FDA-specific additions covering labeling, UDI, and certain records. The two are now largely aligned by design. The QMSR is “version locked” to the 2016 edition, so future ISO 13485 revisions will not automatically apply in the US. See our full FDA QSR vs ISO 13485 comparison for detail.

Do I need ISO 14971 to implement ISO 13485?

Effectively, yes. ISO 13485 threads risk-based thinking through the product lifecycle and relies on the methodology in ISO 14971:2019 for risk management. You need a documented risk management process and a risk management file for each device. We explain the relationship in ISO 14971 vs ISO 13485.

Can a contract manufacturer exclude design controls?

Yes, if you build strictly to a customer’s design and do not perform design and development activities. ISO 13485 permits excluding Clause 7.3, but the exclusion must be justified and documented in your QMS scope. You cannot exclude a requirement simply because it is burdensome — only because it genuinely does not apply to your role.

What causes most ISO 13485 audit findings?

CAPA weaknesses lead the list — actions that never close, root causes not genuinely identified, and effectiveness never verified. Document and record control, supplier controls, and process validation are also frequent finding areas. Our guide to common ISO 13485 QMS mistakes covers the recurring patterns.

Should I hire a consultant or use a documentation kit?

It depends on device class, internal capacity, and budget. Consultant-led implementations offer hands-on guidance but commonly run $15,000–$50,000 or more. A structured documentation kit gives you the full QMS architecture — manual, procedures, and record templates — at a fraction of that cost, so your team tailors rather than drafts from scratch. Many small manufacturers start with a kit and bring in targeted consulting only for device-specific risk and design questions.

What is ISO 13485 and who needs it?

ISO 13485 is the international quality management system standard for organizations involved in the medical device lifecycle — design, production, storage, distribution, installation, and servicing. It applies to manufacturers, specification developers, contract manufacturers, sterilization providers, and importers. Our primer, What Is ISO 13485?, covers the fundamentals.

📥 Free Resources

Practical tools to support your implementation — download what fits your project:

ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements, clause by clause, before committing to implementation.
ISO 9001 Roadmap — step-by-step implementation guide for organizations building or improving a quality management system, useful if you operate an ISO 9001 base alongside 13485.
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments.
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts.
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification, for teams operating across aerospace and medical device lines.

Not Sure What to Do Next?

Your next step depends on where you are in the project:

🔹 If you haven’t assessed your gap yet → start with the free ISO 13485 Gap Assessment Checklist. Don’t commit budget to implementation until you know the size of the gap.
🔹 If you’re ready to build documentation → evaluate a complete ISO 13485 documentation kit before paying consultant rates to draft from scratch. It is the fastest route to an audit-ready document set for most small manufacturers.
🔹 If you’re comparing the US and international paths → read FDA QSR vs ISO 13485 and how much ISO 13485 costs to scope budget and timeline before you choose.

Building an ISO 13485 QMS is a real project, but it is a known one. The clauses are fixed, the phases are sequential, and the failure modes are predictable. Move through it in order, build real evidence as you go, and inspect yourself before anyone else does — and a certification audit or FDA inspection becomes a confirmation, not a gamble. The Standards Navigator exists to make exactly this kind of industrial compliance work clear and survivable for the people who have to actually do it.

Most teams don’t fail ISO 13485 because they misunderstand the standard — they fail because they assumed they were compliant and found out during the audit. The organizations that struggle treat the QMS as paperwork to satisfy a registrar. The organizations that succeed treat it as the operating system that proves their devices are safe — and they build evidence from day one.

The Standards Navigator covers medical device compliance from QMSR readiness to risk management, CAPA, and certification — written from operational and quality management experience, not generic theory.

👉 Get updates on medical device QMS, ISO 13485, and FDA QMSR compliance
👉 Be first to access new gap assessment tools, documentation guides, and implementation resources

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

ISO 13485 Documentation Requirements (2026)

Every document and record ISO 13485 requires — with clause references, document control requirements under Section 4.2, record retention rules, how QMSR changed the documentation landscape, and the seven gaps auditors find most consistently. Built as a reference document quality managers can use before their next audit.

Every document your QMS must have, what auditors check first, and why the gaps between your procedures and your records are where most findings live.

Last Updated: May 2026

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

The Binder on the Shelf Is Not a QMS

Years ago, working in a nuclear component facility, I watched a certification audit go sideways in the first thirty minutes. The quality manager had spent six months building what looked like a complete quality management system — binders, procedures, forms, the works. The auditor asked to see the document register. The quality manager pointed to the binder. The auditor asked how documents were controlled at the point of use. The quality manager pointed to the binder again.

The binder was the system. It sat on a shelf in the quality office. The machinists on the floor had printed copies of procedures from three years prior. Nobody had a current revision of anything. The audit did not go well.

ISO 13485 documentation is not about having paperwork. It is about having the right documents, in the right format, accessible to the right people, at the right time — and being able to prove all of that during an audit. The standard is specific about what must be documented, what must be retained as records, and what that documentation must demonstrate.

Under QMSR, which took effect February 2, 2026, FDA now evaluates ISO 13485 documentation requirements against the framework directly. Organizations that treat documentation as a filing exercise rather than a quality system function are finding that gap at inspection.

This article covers every documentation requirement ISO 13485 imposes, where auditors look first, and what a compliant documentation system actually looks like in practice.

In This Guide

The difference between documents and records under ISO 13485 — and why it matters for audits
Every mandatory document the standard requires
Every mandatory record the standard requires
Document control requirements under Section 4.2
Record retention rules under Section 4.2.5
The most common documentation gaps auditors find
How QMSR changed the documentation landscape for U.S. medical device manufacturers
Decision-stage guidance for organizations at different points in their documentation journey

Start Here (Top Resources)

🔖 Get ISO 13485:2016 → ANSI Webstore — ANSI is the official U.S. distributor of ISO standards, ensuring you receive the controlled, compliant version required for certification audits. Use coupon CC2026 for 5% off.

🔖 Build compliant QMS documentation → 9001Simplified — 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

🔖 Train your team on ISO 13485 documentation requirements → BSI Group — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

🔖 Pursue or maintain ISO 13485 certification → ISOQAR — ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

Browse the What Is ISO 13485? pillar article for full clause context, or use the ISO 13485 Gap Assessment Checklist to identify your specific documentation gaps before your next audit.

Documents vs. Records: The Distinction That Drives Compliance

ISO 13485 treats documents and records as separate categories with different requirements. Confusing them is one of the most consistent sources of documentation findings in surveillance audits.

Documents are instructions, procedures, specifications, and plans — the things that tell people what to do. They are living documents: they can be revised, updated, and superseded. Section 4.2.4 governs their control.

Records are evidence that something was done — completed forms, test results, inspection reports, calibration data, training sign-offs. They are fixed in time: once a record is created, it cannot be altered without creating a documented amendment. Section 4.2.5 governs their control.

The practical distinction matters for two reasons. First, the control requirements differ. Documents need revision control, approval, distribution, and obsolescence management. Records need legibility, identification, storage protection, retrieval, and defined retention periods. A documentation system that applies the same controls to both will have gaps in one or the other.

Second, auditors evaluate them separately. When an auditor asks for a procedure, they are asking for a document. When they ask for evidence, they are asking for a record. Handing an auditor a completed form when they asked for a procedure — or a procedure when they asked for evidence — signals a documentation system that does not understand its own structure.

At this point, most quality managers building or auditing a documentation system should: → Map your document inventory against your record inventory separately. If your document register includes completed forms alongside controlled procedures, your system architecture has a structural problem. 9001Simplified’s documentation kits include pre-structured document and record registers built for ISO 13485 compliance. 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

Mandatory Documents Under ISO 13485

ISO 13485 requires specific documented procedures and plans across multiple clauses. These are not optional — certification bodies audit for their existence and their content.

ISO 13485 documentation infographic illustrating mandatory quality management system documents with interconnected process icons for quality manuals, risk management, design planning, procedures, records retention, purchasing controls, and document control requirements. — Certification bodies expect documented procedures, controlled records, and defined plans that demonstrate the quality system operates consistently and remains audit ready — see the full list in the table below.

Document	Clause	What It Must Cover
Quality Manual	4.2.2	Scope of the QMS, exclusions with justification, documented procedures or references, description of QMS process interactions
Document Control Procedure	4.2.4	Approval, review, revision control, distribution, obsolescence management, external documents
Records Control Procedure	4.2.5	Identification, storage, protection, retrieval, retention periods, disposition
Management Review Procedure	5.6	Inputs, outputs, frequency, documentation requirements
Competence, Training & Awareness Procedure	6.2	How competence is determined, how training is delivered, how competence is evaluated and recorded
Infrastructure Procedure	6.3	Maintenance of buildings, equipment, and supporting services affecting product quality
Work Environment Procedure	6.4	Control of work environment conditions where required for product conformity
Risk Management Procedure	7.1	Risk management process across the product lifecycle, per ISO 14971
Customer-Related Processes Procedure	7.2	Requirements determination, review, and customer communication
Design & Development Procedure	7.3	Planning, inputs, outputs, review, verification, validation, transfer, changes (if design is not excluded)
Purchasing Procedure	7.4	Supplier evaluation, selection, monitoring, and purchasing information
Production & Service Controls Procedure	7.5	Control of production and service provision, cleanliness, installation, and servicing
Identification & Traceability Procedure	7.5.3	Product identification throughout realization and traceability requirements
Customer Property Procedure	7.5.4	Control and safeguarding of customer-supplied product or data
Preservation Procedure	7.5.5	Preservation of product during processing and delivery
Monitoring & Measurement Equipment Procedure	7.6	Calibration, verification, and control of measuring equipment
Feedback Procedure	8.2.1	Post-market surveillance and feedback collection
Complaint Handling Procedure	8.2.2	Complaint receipt, investigation, and regulatory reporting decisions
Internal Audit Procedure	8.2.4	Audit planning, conduct, reporting, and follow-up
Nonconforming Product Procedure	8.3	Identification, segregation, evaluation, and disposition
CAPA Procedure	8.5.2 / 8.5.3	Corrective and preventive action process, including root cause analysis and effectiveness verification

⚠️ If your organization excludes design and development under Clause 7.3, that exclusion must be justified in the Quality Manual and documented. Exclusions without documented justification are a consistent finding in initial certification audits.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Mandatory Records Under ISO 13485

Records are the evidence your QMS operated as documented. The standard specifies which records must be maintained — these are the minimum. Your procedures may require additional records.

Record	Clause	What It Must Demonstrate
Management Review Minutes	5.6.3	Inputs reviewed, decisions made, actions assigned with owners and timelines
Education, Training, Skills & Experience	6.2	Competence evaluated, training completed, results recorded
Infrastructure Maintenance	6.3	Maintenance activities and results for quality-critical equipment
Risk Management Records	7.1	Risk analysis, risk evaluation, risk control, residual risk assessment, post-production monitoring
Customer Requirements Review	7.2.2	Requirements determined and confirmed before commitment
Design & Development Records	7.3	Inputs, outputs, reviews, verifications, validations, transfer, and changes (if not excluded)
Design & Development Changes	7.3.9	Change description, evaluation, verification, validation, approval
Supplier Evaluation Records	7.4.1	Evaluation criteria, results, and re-evaluation decisions
Production Process Validation	7.5.2	Validation protocols, results, equipment qualifications
Traceability Records	7.5.3.2	Unique device identification and traceability through production
Customer Property Records	7.5.4	Receipt, condition assessment, and disposition of customer property
Calibration Records	7.6	Equipment identification, calibration standard, results, next due date
Internal Audit Records	8.2.4	Audit plans, findings, nonconformances, corrective actions, follow-up
Product Monitoring & Measurement	8.2.6	Evidence of conformity and identification of release authority
Nonconforming Product Records	8.3	Nature of nonconformity, disposition decision, concession records if applicable
CAPA Records	8.5.2 / 8.5.3	Root cause analysis, action taken, effectiveness verification with criteria and evidence

➡️ 9001Simplified Documentation Kits — Pre-built ISO 13485 procedures, forms, and record templates covering every mandatory document and record listed above. 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

Document Control: What Section 4.2.4 Actually Requires

Section 4.2.4 sets out seven specific requirements for document control. Each one has a practical implementation implication — and each one is evaluated individually during audits.

1. Documents must be approved before use. Approval must be by authorized personnel. Your document control procedure must define who has approval authority for each document type. A document approved by someone outside that authority — or with no documented approval at all — is a nonconformance.

2. Documents must be reviewed, updated as necessary, and re-approved. Review frequency should be defined in your procedure. Documents that have never been reviewed since initial creation are a finding in surveillance audits — particularly if the regulatory environment or production process has changed.

3. Changes and current revision status must be identified. Every controlled document needs a revision identifier — a number, letter, or date — and your document register needs to reflect current revision status. Auditors check this against what is in use.

4. Relevant versions must be available at points of use. This is the binder-on-the-shelf failure. Current controlled versions must be accessible where work is performed. If people work from printed copies, you need a controlled printing process. If work is performed on a production floor, current procedures must be accessible there — not only in the quality office.

5. Documents must be legible and identifiable. This sounds obvious. It is consistently violated by organizations that allow handwritten annotations, informal updates, or degraded printed copies to remain in service.

6. External documents must be identified and controlled. This includes customer drawings, regulatory guidance documents, referenced standards, and supplier specifications. External documents that affect product quality must be listed in your document control system and their current version verified.

7. Obsolete documents must be prevented from unintended use. Obsolete documents must either be removed from all points of use or clearly marked as obsolete. Finding an active workstation with a superseded procedure is a major nonconformance — regardless of whether anyone was actually using it.

If you are under active FDA inspection pressure → BSI Group ISO 13485 Training covers document control implementation and audit preparation in depth. BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

Record Retention: What Section 4.2.5 Actually Requires

Section 4.2.5 requires that records be retained for a period at least equal to the lifetime of the medical device, but not less than two years from the date of product release by the organization.

That two-year floor is the minimum. In practice, most medical device records should be retained significantly longer:

Implantable devices — the device lifetime may span decades. Records need to match.
Devices with long service lives — the same logic applies.
FDA QMSR requirements — align with ISO 13485 on the two-year minimum but your complaint handling procedure may require longer retention for MDR-related records.
Customer contractual requirements — OEM customers increasingly specify record retention periods in their supplier quality agreements. These requirements take precedence where they are more stringent than the standard’s minimum.

Your records control procedure must define retention periods for each record type. A blanket “two years” policy applied to all records — including design history files and risk management records for long-life devices — is not compliant.

Provider	What You Get	Best For
ANSI Webstore	ISO 13485:2016 official standard	Any organization needing the controlled, compliant version of the standard
9001Simplif i ed	QMS documentation kits with record templates	Organizations building documentation from scratch or rebuilding after a major finding
BSI Group	ISO 13485 training courses	Teams implementing documentation systems or preparing for initial certification
ISOQAR	ISO 13485 certification	Organizations ready to pursue or maintain certification

Most organizations building documentation systems from scratch need all three:

The standard from ANSI Webstore (use CC2026 for 5% off)
Lead implementer training from BSI Group
A documentation kit from 9001Simplified

This combination covers the standard, the knowledge, and the implementation infrastructure.

The Most Common Documentation Gaps

ISO 13485 documentation gaps infographic illustrating seven common audit findings, including outdated document registers, incomplete supplier records, weak CAPA evidence, missing procedures, and disconnected risk management records within medical device quality systems. — Documentation failures rarely appear as isolated findings. They create chains of audit problems across CAPA, supplier controls, training, management review, and risk management. The gap is usually discovered long after it was created.

These are the findings that appear most consistently in ISO 13485 surveillance audits and QMSR inspections. Each one points to a specific procedure or record requirement.

The Quality Manual references procedures that don’t exist. A common initial certification shortcut is writing a Quality Manual that references a full set of documented procedures — then discovering during the surveillance audit that several of those procedures were never finalized. The Quality Manual and the document register must be synchronized.

The document register is not current. Document registers that haven’t been updated in months, that show revision numbers inconsistent with what is in use, or that are missing entire document categories are a consistent finding. The register is the first thing many auditors check.

Risk management records stop at design transfer. ISO 14971 requires risk management across the product lifecycle. Design-phase risk files with no post-production updates — no connection to complaint data, service reports, or CAPA findings — are incomplete regardless of how thorough the original analysis was. See ISO 14971 vs ISO 13485 for the full lifecycle requirement.

CAPA records close without effectiveness verification evidence. A CAPA record that reads “action implemented — problem resolved” with no supporting data is not a closed CAPA — it is an open finding waiting to be issued. For the complete breakdown of what effectiveness verification requires, see CAPA Requirements in ISO 13485.

Supplier qualification records are incomplete or outdated. An approved supplier list without corresponding qualification evidence, or qualification records for suppliers whose scope has changed without requalification, are consistently cited findings under Clause 7.4.

Training records prove attendance, not competence. Sign-off sheets showing who attended a training session are not competence records. The record must show what competence was evaluated, by what method, and what the result was. See Common Mistakes in ISO 13485 QMS for the full breakdown of this finding.

Management review minutes record presentations, not decisions. Minutes that describe what was presented in management review without documenting what was decided are a major finding under Section 5.6.3. Every input reviewed must produce a documented output — a decision, an action, or a rationale for no action.

How QMSR Changed the Documentation Landscape

FDA’s Quality Management System Regulation, effective February 2, 2026, aligns U.S. medical device QMS requirements with ISO 13485:2016. For documentation, the practical changes are significant.

The Device Master Record (DMR) structure is now explicitly required. Under QMSR, the DMR — which must include device specifications, production process specifications, quality assurance procedures, packaging and labeling specifications, and installation and maintenance procedures — is a specific documentation requirement that ISO 13485 certification alone does not fully address.

Complaint files under 21 CFR 820.198 remain a separate requirement. ISO 13485 requires a complaint handling procedure. QMSR additionally requires that complaint files contain specific elements — including the decision on whether the complaint required investigation and, if so, the results of that investigation — that go beyond what most ISO 13485 complaint procedures specify.

MDR procedures must be documented separately. Medical Device Reporting obligations are a regulatory requirement that sits outside ISO 13485 but must be addressed in your QMS documentation under QMSR.

⚠️ FDA QMSR compliance date was February 2, 2026. If your documentation system has not been reviewed against the four QMSR-specific bridge requirements since that date, that review is overdue. The ISO 13485 Gap Assessment Checklist covers all four QMSR bridge requirements explicitly alongside the standard ISO 13485 clause requirements.

For the full regulatory alignment picture, see FDA QSR vs ISO 13485.

Infographic explaining the major operational and regulatory changes introduced under the FDA QMSR, including terminology alignment, expanded risk management, inspection changes, and ISO 13485 document control requirements. — The FDA’s QMSR transition introduced major changes beyond terminology — expanding risk management expectations, changing inspection structure, and aligning medical device quality systems directly with ISO 13485.

Why Organizations Delay Getting Documentation Right

“We’ll clean it up before the surveillance audit.”

This is the most common delay rationalization — and it consistently produces the worst outcomes. Documentation gaps that accumulate over 11 months cannot be credibly remediated in the 30 days before a surveillance visit. Auditors can identify recently created records. A CAPA file dated three weeks before the audit for a problem that complaint data shows has existed for eight months is not evidence of a functioning QMS — it is evidence of audit preparation, which auditors treat as a different category of finding.

“Our documentation was good enough for initial certification.”

Initial certification evaluates documentation at a point in time against a system that was built to be audited. Surveillance audits evaluate whether that system has been maintained — which means they look at records created since the last audit, not at procedures written before it. Organizations that passed initial certification and then stopped maintaining their documentation systems often face multiple major nonconformances at the first surveillance visit.

“We don’t have the internal resources to build this properly.”

This objection is real — but the cost of building documentation properly before certification is substantially lower than the cost of remediation after a major nonconformance. A documentation kit from 9001Simplified covers every mandatory document and record template in a ready-to-use format. 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch. The internal labor required to customize a pre-built kit is a fraction of what is required to build from scratch — and a fraction of what remediation costs after a finding.

Frequently Asked Questions

What documents are required by ISO 13485?

ISO 13485 requires documented procedures covering quality manual, document control, records control, management review, training and competence, risk management, customer requirements, purchasing, production controls, identification and traceability, calibration, feedback, complaint handling, internal audit, nonconforming product, and CAPA. The full list with clause references is in the Mandatory Documents table above.

What records are required by ISO 13485?

ISO 13485 requires records covering management reviews, training and competence evaluations, risk management activities, design and development (if not excluded), supplier evaluations, calibration, internal audits, product monitoring, nonconforming product dispositions, and CAPA activities. The full list with clause references is in the Mandatory Records table above.

How long must ISO 13485 records be retained?

The standard requires retention for at least the lifetime of the device, with a minimum of two years from product release. For implantable devices and devices with long service lives, the retention period is typically longer and should be defined in your records control procedure. FDA QMSR aligns with this minimum but specific record types — particularly MDR-related records — may require longer retention.

Does ISO 13485 require a Quality Manual?

Yes. Section 4.2.2 requires a Quality Manual that defines the scope of the QMS, documents or references procedures, and describes the interactions between QMS processes. The Quality Manual is one of the first documents an auditor requests.

Can we use electronic records to meet ISO 13485 requirements?

Yes — electronic records are acceptable provided your document control system ensures they are controlled, legible, retrievable, and protected from unauthorized modification. Electronic systems used to manage controlled documents must themselves be validated if they affect product quality.

What is the difference between a controlled document and a record under ISO 13485?

A controlled document is an instruction, procedure, or specification that tells people what to do — it can be revised and must be version-controlled. A record is evidence that something was done — it is fixed in time and must be retained according to your records control procedure. Section 4.2.4 governs controlled documents; Section 4.2.5 governs records. The distinction is fundamental to building a compliant documentation system.

Does design and development documentation apply to all medical device manufacturers?

Only if the manufacturer performs design and development activities. If your organization manufactures to customer specifications and does not perform design activities, you may be eligible to exclude Clause 7.3 — but that exclusion must be documented and justified in your Quality Manual. Contract manufacturers who claim a 7.3 exclusion without justification are consistently cited at initial certification.

How do FDA QMSR documentation requirements differ from ISO 13485?

QMSR aligns with ISO 13485 but adds four specific requirements: the Device Master Record structure, complaint files under 21 CFR 820.198, Medical Device Reporting procedures, and corrections and removals procedures. ISO 13485 certification alone does not cover these four requirements. The ISO 13485 Gap Assessment Checklist addresses all four explicitly.

What is the first thing an auditor looks at for ISO 13485 documentation?

Most auditors start with the document register — to verify that controlled documents are listed, revision levels are current, and the register reflects what is actually in use. From there they move to the Quality Manual to verify scope and procedure references. Gaps in either of those two items typically expand the audit’s scope significantly.

Free Resources

📋 Free Download: Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all systems.

📋 Free Download: Supplier Quality Checklist — ISO 9001 Clause 8.4 — all supplier controls auditors evaluate, 45 items with scoring.

📋 Free Download: ISO 9001 Implementation Roadmap — The exact 5-phase process from gap assessment to Stage 2 audit clearance.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Not Sure What to Do Next?

→ You need the official ISO 13485:2016 standard → ANSI Webstore — Use CC2026 for 5% off. ANSI is the official U.S. distributor of ISO standards.

→ You need to build ISO 13485 documentation from scratch → 9001Simplified Documentation Kits — ready-to-use procedures, forms, and record templates for every mandatory document.

→ You need to train your team on documentation requirements → BSI Group ISO 13485 Training — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses.

→ You are ready to pursue ISO 13485 certification → ISOQAR — UKAS-accredited, one of the most recognized certification bodies in the industry.

→ You need to assess your documentation gaps before your next audit → ISO 13485 Gap Assessment Checklist — free, 64 items.

→ You need to understand how QMSR changed your documentation obligations → FDA QSR vs ISO 13485

→ You need to understand CAPA record requirements in depth → CAPA Requirements in ISO 13485

→ You need to understand the most common documentation audit findings → Common Mistakes in ISO 13485 QMS

→ You need to understand how risk management documentation connects to your QMS → ISO 14971 vs ISO 13485

→ You need to understand the full ISO 13485 clause structure → What Is ISO 13485?

→ You want to buy ISO 13485 → Buy ISO 13485

→ You want to browse all medical device standards → explore standards by compliance area

Still figuring out where to start?

If you are not ready to commit to a documentation build yet — that is normal. Most organizations spend several weeks between identifying gaps and starting remediation.

The best next step: → Download the free ISO 13485 Gap Assessment Checklist — it takes 20 minutes and tells you exactly which documents and records you are missing before you spend anything.

Feature image promoting an ISO 13485 Gap Assessment Checklist for medical device manufacturers, contract manufacturers, and component suppliers preparing for certification and FDA QMSR compliance. — ISO 13485 Gap Assessment Checklist designed to help medical device manufacturers identify compliance gaps, prioritize actions, and prepare for certification and FDA QMSR requirements.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

The Binder Is Not the System

Documentation is not ISO 13485’s most technically demanding requirement. But it is the foundation every other requirement rests on. Without controlled documents, procedures cannot be consistently followed. Without records, there is no evidence that procedures were followed at all. Without a document control system that connects what is written to what people actually use, the gap between those two things grows quietly — until an auditor measures it.

The organizations that handle documentation audits well are not the ones with the most sophisticated quality management software or the thickest procedure binders. They are the ones whose documentation reflects how work actually gets done — current, accessible, and connected to the records that prove it.

That alignment takes discipline to build and discipline to maintain. It does not take complexity.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

Subscribe below to stay ahead.

Common Mistakes in ISO 13485 QMS (2026)

Seven ISO 13485 QMS mistakes that consistently produce major nonconformances — document control drift, management review gaps, supplier qualification failures, CAPA records closed without verification, risk management treated as a one-time activity, competence records that prove attendance not ability, and internal audits that never find anything. With clause references and fixes for each.

The audit findings that derail medical device manufacturers — and the fixes that prevent them.

Last Updated: May 2026

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Your QMS Passed Initial Certification. Now the Surveillance Audit Found Three Major Nonconformances.

This scenario plays out more often than most quality managers expect.

Initial certification audits are thorough — but they happen at a fixed point in time, against a QMS that was built specifically to pass them. Surveillance audits arrive 12 months later and evaluate how the system actually operates day to day. That gap between what was built and what runs is where most findings live.

The mistakes in this article are not obscure edge cases. They are the findings that certification bodies issue most consistently, that FDA investigators flag most frequently under QMSR, and that experienced quality practitioners see repeated across organizations of every size. Some of them look like documentation failures. Most of them are process failures wearing documentation’s clothes.

If you are preparing for a first certification audit, a surveillance visit, or an FDA QMSR inspection, this list tells you where to look before the auditor does.

In This Guide

The most common mistakes in ISO 13485 QMS by clause
Why document control failures are almost never about documents
The management review gap that catches organizations by surprise
How supplier qualification problems compound over time
What auditors find when they look at CAPA records
The risk management connection most QMS procedures miss
Decision-stage guidance for organizations at different points in their compliance journey

Start Here (Top Resources)

🔖 Train your team on ISO 13485 → BSI Group — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

🔖 Pursue or maintain ISO 13485 certification → ISOQAR — ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

Browse the What Is ISO 13485? pillar article for full clause context, or use the ISO 13485 Gap Assessment Checklist to identify your specific gaps before your next audit.

Mistake 1: Document Control That Controls Nothing

The clause: ISO 13485 Section 4.2 — Document Control

What auditors find: Obsolete procedures still accessible in shared drives. Forms in use that don’t match the current controlled version. Employees working from printed copies with no revision date. Documents approved by someone whose role no longer includes that authority.

Document control failures are the most consistently cited finding in ISO 13485 surveillance audits — not because organizations don’t have document control procedures, but because those procedures don’t match how people actually access and use documents day to day.

The standard requires that documents be reviewed and approved before use, that current versions are available at points of use, and that obsolete documents are prevented from unintended use. Each of those three requirements has failed in organizations that had a document control procedure on file.

The fix: Document control is an access problem, not a paperwork problem. The question is not “do we have a procedure?” — it’s “can an employee working right now reach a document that has been superseded?” If the answer is yes, your document control system is not functioning regardless of what your procedure says.

Audit your access architecture — shared drives, QMS software, printed SOPs at workstations — before an auditor does. Every document a user can reach should be the current controlled version. Everything else should require deliberate action to retrieve.

At this point, most quality managers in this position should: → Pull your document control procedure and map it against actual employee access. If those two things don’t match, 9001Simplified’s documentation kits include document control templates built specifically for ISO 13485 compliance. 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

Mistake 2: Management Review Without Documented Outputs

The clause: ISO 13485 Section 5.6 — Management Review

What auditors find: Meeting minutes that record attendance and agenda items but contain no documented decisions. Review inputs listed without evidence they were actually analyzed. Action items described without owners, deadlines, or follow-up records. Reviews conducted annually when the organization’s risk profile warranted more frequent review.

ISO 13485 Section 5.6.3 is explicit: management review outputs must include decisions and actions related to improvement of the QMS, improvement of product to meet customer requirements, and resource needs. A management review that happened but produced no documented decisions is a nonconformance — regardless of what was discussed in the room.

This finding catches organizations off guard because the review itself felt thorough. Leadership reviewed quality objectives, discussed complaint trends, walked through audit results. But the meeting minutes read like a summary of what was presented, not a record of what was decided.

The fix: Management review outputs need to look like decisions, not summaries. For each input reviewed, the record should show: what the data indicated, what conclusion was reached, and what — if anything — will be done about it. “Complaint trend reviewed — no action required” is a decision. “Complaint data presented” is not.

⚠️ Under QMSR, FDA inspectors now evaluate management review as part of every inspection. Inspectors who find management reviews without documented outputs routinely cite this as a systemic QMS failure, not an administrative lapse.

Mistake 3: Supplier Qualification on Paper Only

ISO 13485 supplier qualification infographic illustrating risk-based supplier controls under Clause 7.4, featuring a supplier risk tier matrix, qualification lifecycle process, ongoing monitoring activities, and common supplier management mistakes. — Supplier qualification under ISO 13485 is not a one-time approval exercise. Risk classification, qualification activities, performance monitoring, and periodic re-evaluation must work as a continuous lifecycle.

The clause: ISO 13485 Section 7.4 — Purchasing / Supplier Controls

What auditors find: An approved supplier list that has not been updated in years. Suppliers qualified based on a questionnaire with no follow-up evaluation. Critical suppliers with no documented performance monitoring. Qualification records for suppliers whose scope of supply has expanded beyond what was originally evaluated.

Supplier qualification failures compound over time in a way that most other QMS failures don’t. A supplier that was qualified five years ago may have changed ownership, changed manufacturing processes, changed subcontractors, or expanded into new product categories — none of which triggered a requalification because the procedure didn’t require one.

ISO 13485 requires that purchasing controls be proportionate to the risk the supplier presents to product quality and patient safety. That proportionality has to be reflected in your qualification criteria, your monitoring frequency, and your records. An approved supplier list populated with names and no evaluation data is not a supplier qualification program.

The fix: Supplier qualification is a living process, not a one-time gate. Your procedure should define evaluation criteria by supplier risk tier, monitoring frequency, requalification triggers, and what happens when a supplier fails to meet performance criteria. If you are using the Supplier Quality Checklist, the ISO 13485 Clause 7.4 section identifies every supplier control element auditors evaluate — including the ones most procedures leave undocumented.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Mistake 4: CAPA Records That Close Without Verification

ISO 13485 CAPA infographic comparing incorrect and correct closure methods, showing the difference between closing corrective actions without effectiveness verification and closing them with documented objective evidence under Clause 8.5.2. — CAPA is not complete when action is implemented. Under ISO 13485 Clause 8.5.2, closure requires effectiveness verification supported by defined criteria, monitoring, objective evidence, and documented results.

The clause: ISO 13485 Section 8.5.2 — Corrective Action

What auditors find: CAPAs closed at implementation with no effectiveness check. Effectiveness verifications that consist of a single sentence — “action implemented, problem resolved” — with no supporting data. Criteria for effectiveness that were defined after the action was taken rather than before. The same problem recurring in a subsequent audit cycle.

Closing a CAPA without effectiveness verification is one of the most consistently cited major nonconformances in ISO 13485 audits. The standard requires that corrective actions be reviewed for effectiveness — and that review must be documented, must use defined criteria, and must be supported by evidence.

The pattern most organizations fall into is treating CAPA closure as an administrative step rather than a quality decision. Someone implements the action, marks the record complete, and moves on. The question “did this actually work?” never gets formally answered.

The fix: Effectiveness verification criteria must be established before the corrective action is implemented — not after. The criteria should be specific enough that a different person reviewing the record could objectively determine whether they were met. “No recurrence for 90 days” is a criterion. “Situation improved” is not.

For a complete breakdown of CAPA requirements under ISO 13485 Clause 8.5.2 — including the InfuTronix case study and the six mandatory data inputs under Section 8.4 — see CAPA Requirements in ISO 13485.

➡️ BSI Group ISO 13485 Training — Covers CAPA, supplier controls, management review, and all major ISO 13485 clauses. BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

Mistake 5: Risk Management Treated as a One-Time Activity

The clause: ISO 13485 Section 7.1 / ISO 14971

What auditors find: Risk files created during design and never updated. Post-market surveillance data that has no documented connection to risk management. Field failures that triggered a CAPA but never prompted a review of the corresponding risk file. Risk management plans that reference ISO 14971 but contain no evidence of post-production monitoring.

Risk management documentation under Clause 7.1 is now the top QMSR inspection finding — 25 citations in the first three months of QMSR inspection data, ahead of CAPA. That displacement reflects a systematic failure in how most organizations treat risk: as a design-phase activity rather than a lifecycle responsibility.

ISO 14971 is explicit that risk management extends across the entire product lifecycle. Post-market surveillance data, complaint trends, service reports, and CAPA findings are all risk management inputs. When those data sources exist in separate systems with no documented connection to the risk file, the risk management process is incomplete — regardless of how thorough the original risk analysis was.

The fix: Your risk management procedure should define how post-production information feeds back into risk files. When a complaint trend reaches a defined threshold, when a CAPA is opened for a field failure, when a service report pattern emerges — each of those events should trigger a documented review of the relevant risk analysis. That review should produce a documented decision: residual risk is still acceptable, or risk control measures need updating.

For the full picture of how ISO 14971 and ISO 13485 interact at the clause level, see ISO 14971 vs ISO 13485.

Mistake 6: Training Records That Prove Attendance, Not Competence

The clause: ISO 13485 Section 6.2 — Human Resources / Competence

What auditors find: Training records that show who attended a session and when, with no evidence of what was covered or whether it was understood. Competence assessments that consist of a supervisor signature with no evaluation criteria. Personnel performing quality-critical tasks without documented evidence that they are qualified to do so. New employees signed off on procedures they completed training on — but with no record of how competence was evaluated.

ISO 13485 Section 6.2 requires that personnel performing work affecting product quality are competent — and that competence is evaluated and the results are recorded. Attendance is not competence. Completing a training module is not competence. Competence is the demonstrated ability to apply knowledge and skills to produce the required outcome.

This distinction becomes a major finding when an auditor pulls the training record for someone who made a quality-critical decision and finds a sign-off sheet.

The fix: Competence evaluation needs defined criteria for each quality-critical role — what knowledge and skill is required, and how it will be evaluated. That evaluation can be a practical demonstration, a written assessment, a supervised work period with documented sign-off, or another method appropriate to the task. The key is that the record shows what was evaluated and what the result was — not just that training occurred.

If you are building competence frameworks from scratch, BSI Group’s ISO 13485 training courses include role-based competency models that align with Section 6.2 requirements. BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

Mistake 7: Internal Audits That Don’t Find Anything

The clause: ISO 13485 Section 8.2.4 — Internal Audit

What auditors find: Internal audit programs that audit the same low-risk processes repeatedly while avoiding the areas where problems actually exist. Audit reports that describe observations as “satisfactory” or “no issues found” across every clause. Internal auditors who have never issued a nonconformance. Audit findings that are consistently minor and never escalate to CAPA.

An internal audit program that finds nothing is either auditing the wrong things or auditing them incorrectly. Certification bodies and FDA investigators specifically look at the output of your internal audit program — not just whether audits were conducted on schedule. If your internal audit findings never trigger a CAPA and never surface anything your surveillance audit finds, that incongruence is a finding in itself.

ISO 13485 requires that the internal audit program take into account the status and importance of the processes to be audited and the results of previous audits. A risk-based audit program will allocate more frequency and depth to high-risk processes — CAPA, supplier controls, complaint handling, design controls — and less to lower-risk administrative processes.

The fix: Evaluate your internal audit program against what your surveillance audits and FDA inspections have actually found. If there is a consistent gap — if surveillance audits find things your internal audits missed — that gap is the finding. Your audit program needs to be harder on the areas that matter most, not easier.

If you need to develop your internal audit capability, ISOQAR offers ISO 13485 internal auditor training and certification support. ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

At this point, most quality managers preparing for their next audit should: → Cross-reference your last three internal audit reports against your last surveillance audit finding. If the surveillance audit found something your internal audits missed, that’s the gap to close first. Get the ISO 13485 Gap Assessment Checklist to run a structured review across all clauses.

Common Misconceptions About ISO 13485 QMS

ISO 13485 infographic illustrating common misconceptions about quality management systems, comparing myths versus reality around certification, QMSR alignment, and major nonconformances in medical device quality systems. — Some of the most expensive ISO 13485 mistakes begin as assumptions. Certification is not a finish line, ISO 13485 and QMSR are not identical, and a major nonconformance does not automatically mean certification loss.

“Passing initial certification means the QMS is compliant.”

Initial certification confirms that a QMS met the standard’s requirements at a specific point in time, as evaluated against a specific set of records. Surveillance audits evaluate whether the system continues to operate as documented. Organizations that build a QMS to pass initial certification and then don’t maintain it operationally consistently accumulate findings by the first surveillance audit. Certification is not a destination — it is a recurring obligation.

“ISO 13485 and FDA QMSR requirements are now the same thing.”

QMSR, which took effect February 2, 2026, aligns FDA’s device QMS requirements with ISO 13485 — but does not make them identical. Four FDA-specific requirements exist in QMSR that ISO 13485 certification alone does not cover: complaint files under 21 CFR 820.198, MDR procedures, corrections and removals, and the device master record structure. An organization that is ISO 13485 certified is not automatically QMSR compliant. The ISO 13485 Gap Assessment Checklist covers all four QMSR bridge requirements explicitly.

“A major nonconformance means we will lose certification.”

A major nonconformance means the certification body has identified a significant gap in the QMS — one that has the potential to affect product quality or patient safety. It does not automatically result in suspension or withdrawal of certification. It triggers a corrective action requirement with a defined response timeline. Organizations that respond with a documented root cause analysis and credible corrective action plan typically resolve major nonconformances without losing certification. The risk is not the finding — it is the failure to respond adequately.

Frequently Asked Questions

What is the most common ISO 13485 audit finding?

Document control failures under Section 4.2 are consistently the most common finding in surveillance audits. CAPA effectiveness verification failures and management review output gaps follow closely. Under QMSR inspections, risk management documentation under Clause 7.1 is now the leading finding.

How many nonconformances are typical in an ISO 13485 surveillance audit?

There is no typical number. A mature QMS with active internal audit and CAPA programs may receive zero nonconformances. A QMS that has been maintained administratively rather than operationally may receive multiple majors. What matters is whether findings from one audit cycle are genuinely closed before the next one.

What is the difference between a major and minor nonconformance in ISO 13485?

A major nonconformance indicates a systematic failure that has the potential to affect product quality or patient safety — or the complete absence of a required process. A minor nonconformance indicates an isolated lapse or a process weakness that does not constitute a systematic failure. Major nonconformances require a documented corrective action plan with a defined response timeline. Minor nonconformances are typically addressed at the next surveillance audit.

Can we self-declare ISO 13485 compliance without certification?

Self-declaration against ISO 13485 is not recognized in the medical device industry in the way it is sometimes used in other sectors. Customers, regulatory bodies, and OEMs expect third-party certification from an accredited body. Self-declaration provides no audit trail and no independent verification of compliance. If you are building toward certification, ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

How long does it take to fix a major nonconformance?

Certification bodies typically allow 30 to 90 days to respond to a major nonconformance with a documented corrective action plan, evidence of root cause analysis, and initial implementation evidence. Full closure — including effectiveness verification — may take longer depending on the nature of the finding. The timeline should be proposed by the organization and accepted by the certification body.

What is the best way to prepare for an ISO 13485 surveillance audit?

Run a structured internal audit against the clauses most likely to surface findings — Section 4.2 (document control), Section 5.6 (management review), Section 7.4 (supplier controls), Section 8.2.4 (internal audit), and Section 8.5.2 (CAPA). Pull a sample of CAPA records and verify that effectiveness verifications are complete. Review your management review minutes for documented outputs. Check that your approved supplier list reflects current qualification status. The ISO 13485 Gap Assessment Checklist covers all of this in 64 structured items.

Do these mistakes also apply under FDA QMSR?

Yes — and in some cases the stakes are higher. QMSR inspections evaluate every subsystem, every inspection. Document control failures, CAPA gaps, and management review deficiencies that might result in a minor nonconformance from a certification body can result in a 483 observation or warning letter from FDA. See FDA QSR vs ISO 13485 for the full regulatory alignment picture.

Free Resources

📋 Free Download: Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all systems.

📋 Free Download: Supplier Quality Checklist — ISO 9001 Clause 8.4 — all supplier controls auditors evaluate, 45 items with scoring.

📋 Free Download: ISO 9001 Implementation Roadmap — The exact 5-phase process from gap assessment to Stage 2 audit clearance.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Not Sure What to Do Next?

→ You need the official ISO 13485:2016 standard → ANSI Webstore — Use CC2026 for 5% off. ANSI is the official U.S. distributor of ISO standards.

→ You need to assess your QMS gaps before your next audit → ISO 13485 Gap Assessment Checklist — free, 64 items

→ You need to build or rebuild QMS documentation → 9001Simplified Documentation Kits — 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

→ You need to train your team on ISO 13485 requirements → BSI Group ISO 13485 Training — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses.

→ You are ready to pursue or maintain ISO 13485 certification → ISOQAR — UKAS-accredited, one of the most recognized certification bodies in the industry.

→ You need to understand CAPA requirements in depth → CAPA Requirements in ISO 13485

→ You need to understand how risk management connects to your QMS → ISO 14971 vs ISO 13485 and What Is ISO 14971?

→ You need to understand how QMSR changed your compliance obligations → FDA QSR vs ISO 13485

→ You need to understand what ISO 13485 covers at the clause level → What Is ISO 13485?

→ You need to understand the cost of ISO 13485 certification → How Much Does ISO 13485 Cost?

→ You want to buy ISO 13485 → Buy ISO 13485

→ You want to browse all medical device standards → explore standards by compliance area

Still figuring out where to start?

If you are not ready to invest in training or documentation yet — that is normal. Most organizations take several weeks to move from identifying gaps to committing to a remediation plan.

The best next step for most organizations at this stage: → Download the free ISO 13485 Gap Assessment Checklist — it takes 20 minutes and tells you exactly where your QMS has gaps before you spend anything.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

The Gap Between What Was Built and What Runs

Most ISO 13485 QMS failures are not failures of intent. The organizations that receive major nonconformances typically built their systems with genuine effort. What they built, however, was optimized for initial certification — not for the ongoing operational reality that surveillance audits and FDA inspections evaluate.

Document control systems that work at go-live drift as people find workarounds. CAPA programs that close records efficiently lose track of effectiveness. Management reviews that felt thorough produce minutes that record what was presented rather than what was decided. None of these failures are dramatic. They accumulate quietly, and they surface at the worst possible time.

The difference between a QMS that passes surveillance audits consistently and one that doesn’t is not sophistication. It is the discipline to evaluate what the system actually does — not just what the procedures say it does — on a regular basis.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

Subscribe below to stay ahead.

CAPA Requirements in ISO 13485 (2026)

CAPA under ISO 13485 is more than corrective action paperwork. Learn what auditors and FDA investigators actually evaluate, common CAPA failures, Clause 8.5 requirements, effectiveness verification expectations, and how CAPA now fits into modern QMSR inspection strategy.

What the FDA’s newest inspection data reveals about where medical device manufacturers are still getting it wrong — and how to close the gaps before your next audit.

Last Updated: May 2026

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

The FDA Just Changed How It Measures Your CAPA System — And Most Manufacturers Haven’t Noticed

CAPA was the undisputed number-one FDA 483 finding for years. Not close. Not rotating with other subsystems. Every year, far and away.

That changed in 2026.

Three months of QMSR inspection data is in. Risk management documentation under Clause 7.1 now sits at number one — 25 citations. CAPA-related findings come in at 19 combined. On paper, that looks like good news. It isn’t — at least not entirely.

Here’s the nuance that matters: the inspection model changed. Under the old QSIT system, abbreviated inspections hit CAPA almost every single time. Other subsystems cycled in less frequently. CAPA’s dominance was partly an artifact of inspection structure, not a clean picture of where the industry actually struggled.

The new model looks at everything — every subsystem, every inspection. The categorization changed too. Under the old QSR, all CAPA requirements bundled into one code. Now they fragment. Two separate 8.5.2 entries already appear in the first dataset. CAPA didn’t disappear. The field just got wider.

If you’re managing a QMS for a medical device manufacturer, that means more exposure, not less.

In This Guide

What ISO 13485 Clause 8.5.2 actually requires — and what most procedures miss
The six mandatory data inputs for your CAPA process under Section 8.4
Why the InfuTronix case is the most instructive FDA enforcement example in recent years
The difference between measurement and analysis — and why confusing them causes most failures
How horizontal analysis works and why auditors look for it specifically
Common misconceptions that lead to major nonconformances
What to do before your next surveillance audit

Start Here (Top Resources)

🔖 Get ISO 13485 training → BSI Group — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

🔖 Build your CAPA documentation → 9001Simplified — 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

🔖 Pursue or maintain ISO 13485 certification → ISOQAR — ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

Browse the Standards Library to identify which standards apply to your compliance area, or view the most widely used standards in medical devices and manufacturing.

What Is CAPA Under ISO 13485?

CAPA cycle diagram showing ISO 13485 Clause 8.5.2 corrective action and Clause 8.5.3 preventive action steps: Identify, Prevent, Monitor, Improve, Correct, Root Cause — CAPA under ISO 13485 follows a closed-loop process: identify issues, determine root cause, implement corrective action, monitor effectiveness, and prevent recurrence through continual improvement.

CAPA — Corrective and Preventive Action — is the mechanism your QMS uses to identify problems, trace them to root cause, and prevent recurrence. Under ISO 13485:2016, CAPA spans two clauses: Clause 8.5.2 (corrective action) and Clause 8.5.3 (preventive action). They operate differently and auditors evaluate them separately.

Corrective action addresses a nonconformity that has already occurred. Preventive action addresses a potential nonconformity that has not yet materialized. The distinction matters because the procedures, triggers, and documentation requirements differ between them.

ISO 13485 places CAPA in the broader context of Clause 8.5, which also covers continual improvement. But the practical application of CAPA runs deeper — it pulls from data collected across Clause 8.4 (analysis of data) and connects to management review, internal audits, and post-market surveillance. A CAPA procedure that treats the clause as standalone almost always fails at audit.

Under the QMSR (Quality Management System Regulation), which took effect February 2, 2026, FDA now explicitly harmonizes its device QMS requirements with ISO 13485. CAPA requirements that previously lived in 21 CFR Part 820.100 now map directly to ISO 13485 Clause 8.5.2. FDA expects those requirements to be met — and QMSR inspections are actively evaluating them.

What Clause 8.5.2 Actually Requires

Clause 8.5.2 sets out six specific requirements for corrective action. Each one has a documentation implication.

1. Review nonconformities — including customer complaints. This means your CAPA trigger list must include complaint data, not just internal defect records. If complaints are logged in one system and CAPA is managed in another, there needs to be a formal connection between them. Auditors check that connection.

2. Determine the causes of nonconformities — root cause analysis is not optional. Documenting “operator error” or “process deviation” without supporting evidence of how that conclusion was reached is a common major nonconformance. You need a documented methodology — 5 Whys, fishbone, fault tree — and evidence it was applied.

3. Evaluate the need for corrective action — not every nonconformity requires a CAPA. The standard requires you to evaluate and document that decision. Organizations that open a CAPA for every minor deviation create administrative burden; organizations that never document the decision to not open a CAPA create audit vulnerability.

4. Determine and implement corrective action — the action must be proportionate to the effects of the nonconformity. This means documented implementation, not just a description of what was planned.

5. Record results of corrective action — effectiveness verification is required. You must demonstrate that the action you took actually resolved the problem. A corrective action record that closes without verification evidence is not compliant.

6. Review corrective action and its effectiveness — this step loops back into your data analysis process. If the same problem recurs, your record should capture that recurrence and the updated response.

The 2026 QMSR inspection data showing two separate 8.5.2 citations reflects how inspectors are now parsing these requirements individually. A finding against root cause determination is a different citation from a finding against effectiveness verification.

At this point, most quality managers in this position should: → Confirm your CAPA procedure addresses all six elements explicitly — and that your records can demonstrate compliance with each one. Get the ISO 13485 Gap Assessment Checklist to verify your current gaps across all 13485 clauses.

The Six Data Inputs for Section 8.4

Clause 8.4 requires you to analyze data from specific sources to drive CAPA and continual improvement. The standard names six:

Data Source	What It Covers
Feedback	Customer complaints, post-market surveillance data, service reports flagged by users
Product conformity	Inspection results, test data, nonconforming product records
Process and product trends	Statistical process control, yield trends, recurring deviations
Supplier performance	Supplier nonconformances, delivery performance, qualification data
Audit results	Internal audit findings, certification body findings, customer audits
Service reports	Field service records, repair data, failure modes reported post-delivery

Your CAPA procedure must document how data from each of these sources is collected, reviewed, and used to make CAPA decisions. The piece most manufacturers skip entirely is what experienced quality practitioners call horizontal analysis — looking across your data sources, not just within them.

The Analysis Failure: What InfuTronix Got Wrong

The InfuTronix case is the most instructive CAPA enforcement example to come out of FDA inspection activity in recent years. It illustrates the most common failure mode — and it isn’t what most people expect.

InfuTronix had a rule written directly into their CAPA procedure: ten complaints in a rolling 12-month window triggers a CAPA. Simple enough. Documented. Auditable on its face.

Between September 2020 and August 2021, they received 80 complaints reporting power issues, 31 for battery failures, and 67 for leaking administration sets. Not one CAPA was opened.

This was not a data collection failure. The complaints were logged. The threshold was documented. The system simply never connected what was being measured to what that data actually meant.

That is an analysis failure — and it is the most common one FDA finds.

Measurement gets you the number. Analysis tells you what to do with it.

ISO 13485 Section 8.4 requires both, and your procedure needs to address the full cycle: collect the data, analyze it against defined criteria, and produce a documented decision. The decision can be: open a CAPA, escalate to management review, or continue monitoring. All three are defensible. No decision — or a decision made without documentation — is not.

FDA found all of this during inspection. The warning letter that followed cited failure to establish and maintain procedures for implementing corrective action under 21 CFR 820.100(a). Under QMSR, that same finding maps directly to ISO 13485 Clause 8.5.2.

Source: FDA Warning Letter, InfuTronix LLC, June 16, 2022. Available at fda.gov.

ISO 13485 Section 8.4 infographic showing the measurement and analysis cycle with a process flow from data collection to analysis, documented decision making, and outcomes including CAPA, management review, or continued monitoring. — Measurement gets you the number. Analysis determines the response. Under ISO 13485 Section 8.4, organizations must collect data, analyze it against defined criteria, and document a defensible decision.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Horizontal Analysis: The Step Most QMS Procedures Skip

Vertical analysis — reviewing data within a single source — is what most CAPA procedures are built around. You run through complaints. You run through audit findings. You check supplier nonconformances. Each in its own silo.

Horizontal analysis means looking across those sources simultaneously — specifically for patterns that only become visible when you connect the data.

A complaint spike in Q2 means something different when it aligns with a supplier nonconformance from the same quarter. A field failure pattern means something different when it correlates with a process change implemented three months prior. A rising service report trend means something different when internal inspection data for the same product shows clean numbers — because that combination suggests the problem is post-delivery, not in-process.

These cross-source connections are where real problems get caught before FDA finds them. They are also where most QMS procedures have no documented methodology whatsoever.

Your CAPA procedure should require a formal cross-source review at defined intervals — typically aligned with management review. The review should produce a documented output: either a CAPA trigger, a decision to continue monitoring with rationale, or escalation to a different quality subsystem.

Certification bodies increasingly audit for this specifically. The question is not just “do you have a CAPA procedure?” It’s “does your analysis process look across all six data sources and produce a documented decision?”

➡️ ANSI Webstore — Get ISO 13485:2016, the standard your CAPA procedure must align with. ANSI is the official U.S. distributor of ISO standards, ensuring you receive the controlled, compliant version required for certification audits. Use coupon CC2026 for 5% off.

Common CAPA Misconceptions

“A CAPA is only needed when something goes seriously wrong.”

The standard doesn’t set a severity threshold for opening a CAPA — it requires a documented decision about whether a nonconformity warrants one. The mistake isn’t opening too many CAPAs. It’s failing to document the evaluation. Auditors don’t penalize organizations for opening few CAPAs; they penalize organizations that can’t show they evaluated the data and made a deliberate decision.

“Closing the CAPA once the action is implemented is sufficient.”

Clause 8.5.2 requires effectiveness verification — evidence that the corrective action actually resolved the problem. Closing a CAPA at implementation is one of the most consistently cited findings in ISO 13485 surveillance audits. Effectiveness verification must be documented, must use defined criteria, and must happen at a point in time when there is enough post-implementation data to draw a conclusion.

“Our CAPA system is separate from complaint handling and that’s fine.”

It isn’t. The connection between complaint data and CAPA decisions must be explicit and documented. A complaint handling procedure that logs data and a CAPA procedure that never receives it create exactly the kind of system failure the InfuTronix case illustrates. If there is no formal handoff between your complaint system and your CAPA trigger evaluation, that gap will be found.

What Auditors Look For in CAPA Reviews

Whether the auditor is from a certification body or an FDA investigator conducting a QMSR inspection, the CAPA review follows a consistent pattern. Understanding it in advance is the most effective preparation.

They start with your procedure. They read it. They look for whether it covers all six elements of Clause 8.5.2 and whether it explicitly addresses the six data inputs from Clause 8.4. Gaps in the procedure are flagged before they look at a single record.

They pull a sample of CAPA records. Typically 3–5 for a surveillance audit, more for initial certification or for-cause inspections. They are looking for: documented root cause methodology, proportionality between the action and the finding, effectiveness verification with criteria and evidence, and closure only after verification.

They look for records that should exist but don’t. This is where analysis failures surface. If complaint data shows a spike and no CAPA was opened, the auditor will ask for the documented decision that concluded no CAPA was needed. If that document doesn’t exist, that is a finding — regardless of whether the decision was actually reasonable.

They check the connection between data sources. Does your management review input include CAPA status? Does your internal audit program look at CAPA effectiveness? Does complaint data flow into your trend analysis? These connections are evaluated systematically.

They review effectiveness verifications. A CAPA closed with “action implemented — problem resolved” and no supporting data is a major nonconformance. Effectiveness verification requires defined criteria established before the action is taken, a monitoring period, and data that demonstrates the criteria were met.

ISO 13485 CAPA audit review infographic showing the key areas auditors evaluate during certification and FDA inspections, including procedures, CAPA records, missing records, data connections, and effectiveness verification. — CAPA audits follow a predictable path. Auditors review procedures, sample records, process connections, and effectiveness evidence to determine whether your system is functioning as designed.

If you are preparing for a certification audit or a QMSR inspection, the FDA QSR vs ISO 13485 (QMSR Transition Guide) is the clearest resource available on how the two frameworks now align.

If you are building CAPA procedures from scratch or rewriting existing ones, the What Is ISO 13485? pillar article covers the full clause-by-clause context you need before the documentation work begins. For a complete breakdown of how ISO 13485 and FDA QMSR requirements interact at the clause level, see ISO 9001 vs ISO 13485.

If you are under active FDA inspection pressure → Get BSI Group ISO 13485 training and ISOQAR certification support immediately. BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally. ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

Provider	What You Get	Best For
ANSI Webstore	ISO 13485:2016 official standard document	Any organization needing the controlled, compliant version of the standard
BSI Group	ISO 13485 training courses	Teams preparing for implementation, audit readiness, or CAPA procedure development
9001Simplified	QMS documentation kits	Organizations building CAPA and QMS documentation from scratch
ISOQAR	ISO 13485 certification	Organizations ready to pursue or maintain certification

Most organizations at this stage need all three:

The standard from ANSI Webstore (use CC2026 for 5% off)
Lead implementer training from BSI Group
A documentation kit from 9001Simplified

This combination covers the standard, the knowledge, and the implementation infrastructure.

Frequently Asked Questions

What does ISO 13485 require for CAPA?

ISO 13485 Clause 8.5.2 requires a documented procedure that covers reviewing nonconformities, determining root causes, evaluating the need for action, implementing corrective action proportionate to the problem, recording results, and verifying effectiveness. Preventive action under Clause 8.5.3 follows a parallel structure for potential — not actual — nonconformities.

What is the most common CAPA finding in ISO 13485 audits?

Failure to verify the effectiveness of corrective actions is consistently the most common major nonconformance in surveillance audits. The second most frequent is incomplete root cause analysis — particularly records that name a root cause without showing the methodology used to reach that conclusion.

How many CAPAs should a medical device manufacturer open per year?

There is no target number. A small manufacturer with a mature QMS might open fewer than ten CAPAs annually and pass every audit. What auditors evaluate is whether the documented decision-making process is defensible — not the volume of CAPAs opened. If you are in a situation where your data shows patterns and no CAPAs are being opened, the risk is high regardless of company size.

Does CAPA under QMSR differ from CAPA under the old QSR?

The substance is largely the same. The significant change is that QMSR now explicitly adopts ISO 13485 Clause 8.5.2 as the governing framework, and inspections evaluate every subsystem — not just CAPA, as abbreviated QSIT inspections frequently did. Two separate 8.5.2 citations already appear in early QMSR inspection data, reflecting more granular evaluation of individual requirements within the clause. Read the full FDA QSR vs ISO 13485 Transition Guide for a complete breakdown.

What is the difference between corrective action and preventive action in ISO 13485?

Corrective action (Clause 8.5.2) addresses a nonconformity that has already occurred. Preventive action (Clause 8.5.3) addresses a potential nonconformity that trend data or risk analysis suggests may occur. The distinction is more than semantic — auditors evaluate them separately, the documentation requirements differ, and the trigger criteria for each should be explicit in your procedure.

Can we use a single CAPA form for both corrective and preventive actions?

Yes — many organizations use a combined form with fields that distinguish the type of action. What matters is that the record clearly identifies whether the action is corrective or preventive, that the corresponding clause requirements are addressed, and that the effectiveness verification criteria are appropriate for the action type.

What data sources must feed our CAPA process under ISO 13485?

Clause 8.4 identifies six: feedback (including complaints), product conformity data, process and product trends, supplier performance, audit results, and service reports. Your CAPA procedure should document how each source is reviewed, at what frequency, and how that review produces documented CAPA decisions. If you are using the ISO 13485 Gap Assessment Checklist, the data analysis section will identify exactly where your current procedure has gaps.

How long do we need to keep CAPA records?

ISO 13485 Section 4.2.5 requires records to be retained for a period at least equal to the lifetime of the device, but not less than two years from the date of product release. FDA QMSR requirements align with this. For implantable devices or devices with extended service life, the retention period is typically longer and should be specified in your records control procedure.

Free Resources

📋 Free Download: Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all systems.

📋 Free Download: Supplier Quality Checklist — ISO 9001 Clause 8.4 — all supplier controls auditors evaluate, 45 items with scoring.

📋 Free Download: ISO 9001 Implementation Roadmap — The exact 5-phase process from gap assessment to Stage 2 audit clearance.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Not Sure What to Do Next?

→ You need the official ISO 13485:2016 standard → ANSI Webstore — Use CC2026 for 5% off. ANSI is the official U.S. distributor of ISO standards.

→ You need to understand how your CAPA requirements changed under QMSR → FDA QSR vs ISO 13485 Transition Guide

→ You need to train your team on ISO 13485 CAPA requirements → BSI Group ISO 13485 Training — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses.

→ You need to build CAPA documentation from scratch → 9001Simplified Documentation Kits — 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS.

→ You are ready to pursue ISO 13485 certification → ISOQAR — ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

→ You want to assess your full ISO 13485 gaps before spending anything → ISO 13485 Gap Assessment Checklist — free, 64 items

→ You need to understand what ISO 13485 covers before addressing CAPA specifically → What Is ISO 13485?

→ You need to understand how risk management connects to CAPA → What Is ISO 14971? and ISO 14971 vs ISO 13485

→ You need to compare ISO 13485 to ISO 9001 to understand CAPA differences → ISO 9001 vs ISO 13485

→ You want to buy ISO 13485 → Buy ISO 13485

→ You want to browse all medical device standards in one place → explore sector-specific standards or browse standards by compliance area

Still figuring out where to start?

If you are not ready to purchase yet — that is normal. ISO 13485 CAPA decisions typically take weeks from first research to implementation commitment.

The best next step for most organizations at this stage: → Download the free ISO 13485 Gap Assessment Checklist — it takes 20 minutes and tells you exactly where your CAPA and QMS gaps are before you spend anything.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

The Cost of an Analysis Failure

CAPA is not a form. It is not a procedure sitting in your document management system. It is the mechanism that connects everything your quality system measures to everything your quality system does about it. When that connection breaks — when data is collected, thresholds are documented, and no one asks what the numbers actually mean — FDA finds it. Certification bodies find it. And devices reach the field with problems that could have been caught.

The InfuTronix case isn’t an outlier. Organizations that receive 483 observations for CAPA failures almost always had a procedure. What they didn’t have was an analysis process that produced documented decisions. That gap is what inspection finds — and it’s the gap that costs the most to recover from after the fact.

Under QMSR, the inspection model is now broader. Every subsystem, every inspection. CAPA didn’t disappear from the top of the finding list — it fragmented into more specific citations. That means more exposure, not less.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

👉 Get updates on new standards, implementation strategies, and compliance insights 👉 Be first to access new guides, tools, and checklists

Subscribe below to stay ahead.

ISO 14971 vs ISO 13485: What’s the Difference and How Do They Work Together? (2026 Guide)

ISO 13485 requires risk management throughout the quality management system. ISO 14971 defines exactly how that risk management must be conducted. This guide covers the precise differences between the two standards, where they integrate clause by clause, and what the FDA’s QMSR means for both.

Last Updated: May 2026

ISO 13485 requires risk management. ISO 14971 defines how to do it. Understanding the precise relationship between these two standards — and what it means under the FDA’s QMSR — is the difference between a QMS that holds up under inspection and one that doesn’t.

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

📋 Free Download: ISO 13485 Gap Assessment Checklist Identify your compliance gaps before your first audit — 64 items across 7 sections including ISO 14971 risk management integration and all four FDA QMSR bridge requirements. Download Free Checklist

ISO 13485 Tells You to Manage Risk. ISO 14971 Tells You How.

That single sentence is the most important thing to understand about the relationship between these two standards — and it’s the part most manufacturers either misread or oversimplify.

ISO 13485:2016 is a quality management system standard. It requires risk-based thinking throughout the QMS — in design and development planning, production controls, supplier controls, complaint handling, and post-market surveillance. It references ISO 14971 in a note to Clause 7.1. But it does not specify how risk management must be conducted. It tells you risk management is required. ISO 14971 tells you how to do it.

ISO 14971:2019 is a risk management standard. It provides the structured framework — hazard identification, risk estimation, risk evaluation, risk control, overall residual risk evaluation, risk management review, and post-production monitoring — that gives ISO 13485’s risk management requirements their practical content.

Together they form the twin pillars of medical device quality and safety assurance. Neither is complete without the other for a manufacturer operating in any major regulated market. And under the FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, the relationship between the two standards now carries federal regulatory weight.

In This Guide

What ISO 13485 covers and what it requires on risk
What ISO 14971 covers and what it adds
The key differences between the two standards
The precise points where ISO 13485 references ISO 14971
The important nuance about whether ISO 14971 is truly mandatory
How the FDA QMSR changes the practical answer to that question
How to implement both standards together
Which standard to buy first and why
Frequently asked questions

✅ Start Here (Top Resources)

📋 Buy ISO 13485:2016 (official standard) → ANSI Webstore — ANSI is the official U.S. distributor of ISO standards, ensuring you receive the controlled, compliant version required for certification audits. Use coupon CC2026 for 5% off.

📋 Buy ISO 14971:2019 (required companion) → ANSI Webstore — Purchase both standards together for maximum savings. Use coupon CC2026 for 5% off.

📋 Save buying both standards → ISO Standards Bundles — Up to 50% Off — Purchasing ISO 13485 and ISO 14971 as a bundle through the ANSI Webstore saves significantly compared to individual purchases.

📋 Get ISO 13485 trained before implementation → BSI Group ISO 13485 Training — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

📋 Get ISO 13485 certified → ISOQAR ISO 13485 Certification — ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

What Is ISO 13485?

Medical device quality management infographic showing ISO 13485 certification concept with medical equipment and headline “What Is ISO 13485? Complete Guide (2026)”. — ISO 13485 defines the quality management system requirements for medical device manufacturers, focusing on regulatory compliance, risk management, and consistent product quality.

ISO 13485:2016 is the international standard for quality management systems specific to the medical device industry. It specifies requirements for a QMS that enables an organization to consistently design, develop, produce, and deliver safe and effective medical devices and related services.

ISO 13485 is used as the baseline QMS framework by regulatory authorities and certification bodies in most major medical device markets — including Health Canada, the EU MDR, MDSAP, and since February 2, 2026, the FDA’s QMSR under 21 CFR Part 820.

ISO 13485 covers the full scope of quality management system requirements:

Context of the organization and QMS scope
Management responsibility, quality policy, and management review
Resource management — personnel, infrastructure, and work environment
Product realization — design and development, purchasing, production, and service provision
Measurement, analysis, and improvement — internal audits, complaint handling, CAPA, and corrective action

What ISO 13485 requires on risk: ISO 13485 requires risk-based thinking throughout the quality management system. Risk management must be planned as part of product realization (Clause 7.1), integrated into design and development (Clause 7.3), applied to supplier controls (Clause 7.4), and fed by post-market surveillance feedback (Clause 8.2). The standard references ISO 14971 explicitly in its Clause 7.1 note and implicitly throughout its design and development requirements.

What ISO 13485 does not do is specify the methodology for risk management. It does not define how to identify hazards, estimate risks, evaluate acceptability, or control residual risk. That is what ISO 14971 does.

For a complete overview of ISO 13485 requirements, see What Is ISO 13485? Complete Guide.

What Is ISO 14971?

ISO 14971:2019 is the international standard for the application of risk management to medical devices. It provides the structured methodology — terminology, principles, and process — for identifying hazards, estimating and evaluating risks, implementing risk controls, and monitoring risk throughout the entire device lifecycle.

ISO 14971 covers:

Risk management planning — scope, lifecycle phases, risk acceptability criteria
Hazard identification — under both normal use and fault conditions
Risk estimation — probability of harm and severity of harm
Risk evaluation — comparison against acceptability criteria
Risk control — priority order: design, protective measures, information for safety
Evaluation of overall residual risk — including benefit-risk analysis where required
Risk management review — pre-release review with identified reviewers
Production and post-production information — systematic feedback into the risk management file

What ISO 14971 adds beyond ISO 13485: While ISO 13485 says risk management is required throughout the QMS, ISO 14971 specifies exactly how that risk management must be structured, documented, and maintained. The Risk Management File (RMF) — the central documentation output of the ISO 14971 process — is the evidence base that demonstrates a manufacturer has systematically identified hazards, evaluated risks, implemented controls, and monitored effectiveness.

For a complete overview of ISO 14971 requirements, see What Is ISO 14971? Risk Management for Medical Devices Explained.

Feature image for an ISO 14971 guide showing medical device risk management concepts, lifecycle risk controls, and the relationship between ISO 14971, ISO 13485, and FDA QMSR requirements. — ISO 14971 is the required risk management framework for medical devices, embedding risk analysis and control throughout the product lifecycle and supporting ISO 13485 and FDA QMSR compliance.

ISO 14971 vs ISO 13485 — Key Differences

Element	ISO 13485:2016	ISO 14971:2019
Standard type	Quality management system standard	Risk management standard
Purpose	Define QMS requirements for medical device manufacturers	Define the risk management process for medical devices
Scope	Entire quality management system	Risk management specifically
Risk coverage	Requires risk-based thinking throughout QMS	Specifies how risk management must be conducted
Key output	Certified, compliant QMS	Risk Management File (RMF)
Certification	Certifiable — third-party certification available	Not certifiable on its own
Published by	ISO Technical Committee 210 (ISO/TC 210)	ISO Technical Committee 210 (ISO/TC 210)
Current edition	ISO 13485:2016	ISO 14971:2019
Applies to	Manufacturers, suppliers, contract manufacturers	All organizations involved in device lifecycle
Risk methodology	Not specified	Six-step structured process
Hazard analysis	Referenced but not detailed	Defined in detail
Risk Management File	Not specified	Required
Benefit-risk analysis	Not addressed	Required when overall residual risk is unacceptable
Post-production monitoring	Addressed through complaint handling and feedback	Explicitly required as ongoing RMF input
QMSR status	Incorporated by reference into 21 CFR Part 820	Expected framework; referenced through ISO 13485

Best for:

ISO 13485: Any organization that designs, manufactures, or supplies medical devices and needs a certified quality management system
ISO 14971: The same organizations — it provides the risk management methodology that ISO 13485’s requirements assume is in place

Where ISO 13485 References ISO 14971

Infographic mapping ISO 13485 clauses to corresponding ISO 14971 risk management requirements, showing how quality management processes trigger risk management activities across the medical device lifecycle. — ISO 13485 establishes quality system requirements, while ISO 14971 provides the risk management framework that connects planning, design, purchasing, feedback, and improvement activities throughout the medical device lifecycle.

ISO 13485 references ISO 14971 at specific points throughout its clause structure. Understanding exactly where these references occur is critical for building a compliant integrated system.

Clause 7.1 — Planning of Product Realization

Clause 7.1 requires that risk management activities be planned as part of product realization. The note to this clause states: “Further information can be found in ISO 14971.” This is the most direct reference to ISO 14971 in the standard.

Clause 7.3 — Design and Development

The design and development requirements of ISO 13485 are where ISO 14971 integration is most intensive. Design inputs must include risk management outputs. Design verification and validation activities must address risks. The Design and Development File (DDF) must reference risk management records.

Clause 7.4 — Purchasing

ISO 13485 Clause 7.4 requires that purchasing controls be proportionate to the risk the external provider poses to the finished device. The extent of supplier qualification, incoming inspection, and monitoring is determined by risk — which requires a risk framework to apply.

Clause 8.2 — Monitoring and Measurement

Post-market surveillance and complaint handling data collected under Clause 8.2 must feed back into the risk management process. ISO 14971 Clause 11 (Production and Post-Production Information) specifies how this information must be systematically reviewed and how it triggers updates to the Risk Management File.

Clause 8.5 — Improvement

CAPA activities under Clause 8.5 must consider risk. Significant quality failures identified through corrective action must evaluate whether the risk management file needs to be updated — connecting the two standards at the improvement level of the QMS.

At this point, most organizations beginning ISO 13485 implementation should:

📋 Purchase both ISO 13485:2016 and ISO 14971:2019 together as a bundle — the clause-by-clause integration means implementing one without the other creates immediate documentation gaps that auditors will identify.

→ ISO Standards Bundle — ANSI Webstore — Save up to 50% purchasing both standards together

Is ISO 14971 Actually Mandatory Under ISO 13485?

This is one of the most debated questions in the medical device quality community, and the honest answer is more nuanced than most articles present.

The technical answer: ISO 14971 is not formally mandated by ISO 13485. The reference in Clause 7.1 is a note — informative guidance, not a normative requirement. A manufacturer could theoretically implement a risk management process using a different methodology and still demonstrate conformance to ISO 13485’s risk-based requirements.

The practical answer: In the real world, ISO 14971 is effectively mandatory for any organization pursuing ISO 13485 certification or operating in regulated markets. Here’s why:

Certification bodies expect it. When a UKAS-accredited certification body audits your ISO 13485 QMS, the auditors evaluating your risk management program will be assessing it against the ISO 14971 framework — because that is the internationally recognized methodology for medical device risk management. A risk management program that doesn’t follow ISO 14971’s structure will face significant findings regardless of the technical argument about normative versus informative references.

Regulatory bodies reference it. The EU MDR, Health Canada, TGA, and MDSAP all reference ISO 14971 as the expected risk management framework. Operating without it creates regulatory exposure in every major market.

FDA QMSR changes the equation significantly — which brings us to the most important development of 2026.

The QMSR Changes the Practical Answer

The FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, incorporated ISO 13485:2016 by reference into 21 CFR Part 820. Since ISO 13485 explicitly references ISO 14971, that reference now carries federal regulatory weight.

Under the FDA’s new inspection program — Compliance Program 7382.850 — FDA investigators are expected to start inspections by reviewing the risk management file and following risk documentation into other quality system areas. The risk management file is the inspection roadmap. If your risk management program is not structured against ISO 14971, your risk management file will not hold up under that inspection approach.

Additionally, the QMSR extended risk management expectations beyond design controls — where the old QSR concentrated them — to the entire quality system. This is precisely what ISO 14971 requires: risk management planning, hazard identification, risk control, and post-production monitoring integrated across the device lifecycle, not just in the design phase.

The bottom line under QMSR: Whether or not ISO 14971 is technically mandatory in the normative sense of ISO 13485, it is the framework FDA investigators will use to evaluate your risk management program. Operating without it under the current inspection regime is an inspection liability.

⚠️ QMSR effective February 2, 2026: If your risk management program is not built on the ISO 14971 framework, this is your highest-priority gap for QMSR compliance.

For the complete QMSR transition guide, see FDA QSR vs ISO 13485 — The Complete QMSR Transition Guide.

How the Two Standards Work Together in Practice

The integration of ISO 13485 and ISO 14971 is not a separate parallel process — it is woven into how the QMS functions. Here is how the two standards interact at each stage of the device lifecycle:

Concept and Planning Stage

ISO 13485 Clause 7.1 requires risk management to be planned as part of product realization. ISO 14971 provides the Risk Management Plan — the document that defines scope, lifecycle phases, risk acceptability criteria, and the methods that will be used throughout the device’s life.

Design and Development

ISO 13485 Clause 7.3 requires design inputs to include risk management outputs and design outputs to be reviewed against inputs. ISO 14971 provides hazard identification and risk analysis — the outputs of which flow directly into design input requirements, design verification criteria, and design validation protocols.

Purchasing and Supplier Controls

ISO 13485 Clause 7.4 requires supplier controls proportionate to supplier risk. ISO 14971’s risk framework defines what “risk” means in this context — the severity and probability of harm that could result from supplier failures. Risk level drives supplier classification, incoming inspection intensity, and qualification requirements.

Production

ISO 13485 Clause 7.5 requires controlled production conditions and validation of special processes. Risk management under ISO 14971 determines which processes require validation (those where outputs cannot be fully verified) and what monitoring is required during production.

Post-Market Surveillance and CAPA

ISO 13485 Clause 8.2 requires systematic collection of post-market information. ISO 14971 Clause 11 requires that production and post-production information be systematically reviewed and fed back into the risk management file. When complaint data or CAPA findings reveal new hazards or indicate that risk estimates were incorrect, the Risk Management File must be updated.

This is where the most common gap exists in practice: organizations that treat risk management as a design-phase deliverable and do not maintain the connection between post-market data and the risk management file. Under QMSR, this gap is visible to FDA investigators within the first day of an inspection.

📋 Free Download: ISO 13485 Gap Assessment Checklist Section 6 covers ISO 14971 risk management integration specifically — risk management plan requirements, RMF structure and completeness, post-production feedback, and QMSR inspection implications. Download Free Checklist

The Risk Management File — Where They Intersect Most Clearly

Infographic comparing ISO 9001 risk-based thinking with ISO 13485 and ISO 14971 medical device risk management requirements using an integrated Venn diagram layout. — Both standards require risk management — but the depth and formality differ significantly. ISO 9001 uses general risk-based thinking, while ISO 13485 requires formal medical device risk management aligned with ISO 14971 throughout the product lifecycle.

The Risk Management File (RMF) is the single most important integration point between ISO 13485 and ISO 14971. It is the documentation output of the ISO 14971 process, and it is the record that connects risk management to every other element of the ISO 13485 QMS.

The RMF is not a single document. It is an organized collection of records that includes:

Risk Management Plan — scope, lifecycle phases, acceptability criteria, methodology
Risk analysis records — hazard identification, risk estimation
Risk evaluation records — comparison against acceptability criteria
Risk control records — selected measures, implementation records, verification
Overall residual risk evaluation — benefit-risk analysis where required
Risk Management Review — pre-release review with identified reviewers
Post-production information records — systematic review of real-world performance data

Under ISO 13485, the DDF (Design and Development File) must contain or reference risk management records. Under the QMSR and CP 7382.850, the RMF is where FDA investigators begin their inspection — tracing risk documentation into design controls, CAPA, complaint handling, and post-market surveillance.

A Risk Management File that was completed at device release and has not been updated since is one of the most common and most significant findings under the current inspection approach. The RMF is a living document. It must be updated throughout the device’s commercial life as post-production information is gathered and evaluated.

If your organization is already ISO 13485 certified and is assessing QMSR readiness, the current state of your Risk Management File is the single most important thing to evaluate first.

At this point, most organizations preparing for QMSR inspection should:

📋 Conduct a formal review of whether your Risk Management File has been updated since device release — and whether post-market complaint and CAPA data is systematically feeding into it. This is the highest-frequency inspection gap under CP 7382.850.

From the Shop Floor

After 25 years in heavy industrial manufacturing and quality systems, the most consistent pattern I see when organizations implement both ISO 13485 and ISO 14971 is this: they implement risk management well during design and development, and then they stop.

The Risk Management File is completed before device release. The risk management review is signed off. The certification audit passes. And then for the next three years, every complaint, every CAPA, every production nonconformance is handled in its own system — with no connection back to the risk management file that is supposed to be the living record of everything known about how the device can cause harm.

Three years later, an FDA investigator arrives under CP 7382.850 with the risk management file as their starting point. They trace a complaint about device malfunction into the CAPA system. They find a corrective action that was opened and closed. They look for the connection back to the risk management file — the evaluation of whether this complaint revealed a new hazard or indicated that an existing risk estimate was incorrect. The connection doesn’t exist.

That is not an ISO 13485 finding. It is not an ISO 14971 finding. It is a QMSR finding, because under the QMSR that connection is an expected element of a functioning integrated quality and risk management system.

The organizations that handle this well are the ones that treat the RMF update as a standing agenda item in management review — not a corrective action triggered by an audit finding. Post-market data goes into the RMF review process because the system requires it, not because an investigator asked for it.

That is what the integration of ISO 13485 and ISO 14971 is supposed to produce. It is also what separates manufacturers who pass inspections from those who merely survive them.

Which Standard Do You Buy First?

Both ISO 13485 and ISO 14971 are required for any serious medical device quality management implementation. The practical question is which to acquire and read first.

Buy ISO 13485 first if your organization is beginning the certification journey. ISO 13485 defines the overall QMS framework — understanding its requirements first gives you the context for understanding where and why ISO 14971 integrates.

Buy ISO 14971 immediately after — or together as a bundle. You cannot build a compliant risk management program from summaries or paraphrases. Both standards must be purchased, controlled as external documents within your QMS (as required under QMSR), and read by the people building your system.

For a complete overview of available medical device standards, see the Standards Library — Medical Devices Section.

The bundle option saves significantly. The ANSI Webstore offers the ISO 13485 and ISO/TR 14969 Quality Management Systems Medical Devices Package which includes both documents together at a meaningful discount versus individual purchases.

📋 ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off

📋 ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off

📋 ISO Standards Bundle — Save up to 50%

Frequently Asked Questions

What is the main difference between ISO 14971 and ISO 13485?

ISO 13485 is a quality management system standard that defines what a medical device manufacturer’s QMS must cover — including the requirement that risk management be applied throughout the system. ISO 14971 is a risk management standard that defines how risk management must be conducted — the six-step process, the required documentation, and the Risk Management File structure. ISO 13485 requires risk management. ISO 14971 specifies how to do it.

Is ISO 14971 required if you have ISO 13485?

ISO 14971 is not formally mandated by ISO 13485’s normative requirements — the reference in Clause 7.1 is a note, not a normative requirement. However, certification bodies evaluate risk management programs against the ISO 14971 framework, and under the FDA’s QMSR (effective February 2, 2026), risk management expectations now carry federal regulatory weight. For practical purposes, ISO 14971 is effectively required for any organization pursuing ISO 13485 certification or operating in regulated markets.

Can you be certified to ISO 14971?

No. ISO 14971 is not a certifiable standard — there is no third-party certification to ISO 14971 itself. ISO 13485 is the certifiable standard. However, ISO 13485 certification implicitly requires that risk management is conducted in a way consistent with ISO 14971, since that is the framework certification bodies evaluate against.

Which came first — ISO 13485 or ISO 14971?

Both standards have long histories. ISO 14971 was first published in 2000, with major revisions in 2007 and 2019. ISO 13485 was first published in 1996, revised in 2003, and again in 2016. The 2016 edition of ISO 13485 was developed with the intent of aligning more closely with the 2012 draft of ISO 14971, ensuring stronger integration between the two standards.

Does ISO 14971 apply to software as a medical device?

Yes. ISO 14971:2019 explicitly applies to Software as a Medical Device (SaMD). The companion document ISO/TR 24971 provides specific guidance on applying ISO 14971 to software, including cybersecurity risk considerations.

How does the QMSR affect the relationship between ISO 13485 and ISO 14971?

The QMSR (effective February 2, 2026) incorporated ISO 13485 by reference into 21 CFR Part 820. Since ISO 13485 references ISO 14971, that reference now carries federal regulatory weight. FDA investigators under the new Compliance Program 7382.850 start inspections with the risk management file — which is the primary output of the ISO 14971 process. The QMSR also extended risk management expectations across the entire QMS rather than concentrating them in design controls as the old QSR did.

What is the Risk Management File and which standard requires it?

The Risk Management File (RMF) is the organized collection of records that documents all risk management activities for a specific medical device — risk management plan, hazard analysis records, risk evaluation records, risk control records, overall residual risk evaluation, risk management review, and post-production information records. It is required by ISO 14971, not ISO 13485 directly. However, under ISO 13485, the Design and Development File must contain or reference risk management records — and under the QMSR, the RMF is what FDA investigators use as their inspection roadmap.

Do I need ISO/TR 24971 as well?

ISO/TR 24971:2020 is the technical report companion to ISO 14971:2019. It provides practical guidance on implementing ISO 14971’s requirements — methods for hazard identification, risk estimation, benefit-risk analysis, and software risk management. Unlike ISO 14971, it is guidance rather than a standard with requirements. For organizations building or rebuilding their risk management program, ISO/TR 24971 is a valuable implementation companion. It is not required, but it is practically useful.

How does ISO 14971 differ from ISO 31000?

ISO 14971 is specific to medical device risk management and defines risk in terms of patient harm — the combination of probability and severity of harm to people. ISO 31000 is a broader enterprise risk management standard with a wider definition of risk that includes any effect on objectives. The two are not interchangeable in the medical device context. ISO 14971 is the expected framework for medical device risk management. ISO 31000 is not.

✅ Free Resources

📋 ISO 13485 Gap Assessment Checklist — 64 items across 7 sections including ISO 14971 risk management integration requirements and all four FDA QMSR bridge requirements. Identify your gaps before your first audit.

📋 Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all compliance systems.

📋 Supplier Quality Checklist — ISO 9001 Clause 8.4 — all supplier controls auditors evaluate, 45 items with scoring.

📋 ISO 9001 Implementation Roadmap — The exact 5-phase process from gap assessment to Stage 2 audit clearance.

Not Sure What to Do Next?

✅ You need the official ISO 13485:2016 standard 📋 ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off

✅ You need the official ISO 14971:2019 standard 📋 ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off

✅ You want to save buying both standards together 📋 ISO Standards Bundle — ANSI Webstore — Save up to 50%

✅ You want to identify your ISO 13485 and QMSR compliance gaps before spending anything 📋 Download the Free ISO 13485 Gap Assessment Checklist

✅ You need ISO 13485 training before implementation 📋 ISO 13485 Training — BSI Group

✅ You are ready to pursue ISO 13485 certification 📋 ISOQAR ISO 13485 Certification

✅ You want to understand what ISO 13485 requires 📋 What Is ISO 13485? Complete Guide

✅ You want to understand what ISO 14971 requires 📋 What Is ISO 14971? Risk Management for Medical Devices

✅ You want to understand the FDA QMSR and its impact 📋 FDA QSR vs ISO 13485 — The Complete QMSR Transition Guide

✅ You want to compare ISO 9001 and ISO 13485 📋 ISO 9001 vs ISO 13485 — Key Differences

✅ You want to understand ISO 13485 purchase options and cost 📋 Buy ISO 13485 — Complete Guide 📋 How Much Does ISO 13485 Cost?

✅ You want to browse all available medical device standards 📋 Standards Library — Medical Devices & Regulated Manufacturing 📋 Popular Standards — Most Frequently Purchased

Still Figuring Out Where to Start?

If you’re not ready to purchase or certify yet — that’s normal. ISO 13485 and ISO 14971 implementation decisions typically take three to six months from first research to commitment.

The best next step for most organizations at this stage:

📋 Download the free ISO 13485 Gap Assessment Checklist — it covers all 64 clause requirements including the ISO 14971 integration section and the four QMSR bridge requirements. It takes 30 minutes and tells you exactly where your gaps are before you spend anything.

Download Free Checklist — No Cost

ISO 13485 and ISO 14971 Are Not Optional to Each Other

ISO 13485 tells you risk management is required across your quality management system. ISO 14971 tells you how to conduct it. One without the other produces either a QMS with undefined risk methodology or a risk management program without a quality system framework to integrate it.

Under the FDA’s QMSR, effective February 2, 2026, that integration is no longer just a best practice — it is what federal regulatory inspection expects. FDA investigators start with the risk management file. They follow it into design controls, CAPA, complaint handling, and post-market surveillance. A quality management system that treats risk management as a design-phase deliverable rather than a lifecycle discipline will not hold up under that inspection approach.

The organizations that get this right are the ones that treat the Risk Management File as a living operational document — not a certification artifact. They update it because post-market data flows into it systematically. They connect CAPA to it because the system requires the connection. They identify new hazards from real-world performance data because that is what ISO 14971 Clause 11 requires and what QMSR now enforces.

That is what implementing both standards properly actually produces.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

✅ Get updates on new standards, implementation strategies, and compliance insights ✅ Be first to access new guides, tools, and checklists

Subscribe below to stay ahead.

What Is ISO 14971? Risk Management for Medical Devices Explained (2026 Guide)

ISO 14971 is not optional supplementary guidance for ISO 13485 — it is the required risk management framework woven throughout the medical device lifecycle. This guide covers what ISO 14971:2019 requires clause by clause, how its six-step process works across the device lifecycle, what changed in the 2019 edition, and why the FDA’s QMSR makes a well-maintained Risk Management File more critical than ever.

ISO 14971 is not optional supplementary guidance for ISO 13485 — it is the required risk management framework woven throughout the medical device lifecycle. Here’s what it requires, how it works, and why the FDA’s QMSR makes understanding it more important than ever.

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

From the Shop Floor

Risk management in manufacturing is not a new concept. Every process engineer who has ever run a failure modes and effects analysis on a production line understands the core logic: identify what can go wrong, estimate how likely it is and how bad it would be, put controls in place, and verify those controls work.

What ISO 14971 adds to that foundation is structure, lifecycle scope, and documentation discipline.

After 25 years in heavy industrial manufacturing — including quality systems, process control, and operational risk — the single most consistent gap I see in medical device risk management is the treatment of the Risk Management File as a design-phase deliverable rather than a living operational document. Teams build an impressive RMF during product development, get through their certification audit, and then let the file sit static while the real world generates new information about how the device actually performs.

That approach worked well enough under the old QSR. It does not work under the QMSR.

FDA investigators under CP 7382.850 are not looking at your RMF to confirm it was done — they are using it as a roadmap to evaluate whether your entire quality system is functioning as an integrated risk management framework. A risk management file that hasn’t been updated since device release is not a minor documentation gap. It is evidence that your risk management process is not integrated with complaint handling, CAPA, and post-market surveillance the way the QMSR requires.

The organizations I have seen handle this well treat the RMF update as a standing agenda item in management review — not a corrective action triggered by an audit finding. If post-market data is generating complaints, those complaints are being evaluated in the context of the risk management file every quarter. That is the operating model QMSR expects.

ISO 14971 Is the Standard Your QMS Is Already Required to Implement

If you are pursuing ISO 13485 certification, operating under the FDA’s QMSR, or manufacturing medical devices for any major regulated market, ISO 14971 is not a standard you get to choose whether to implement.

ISO 13485:2016 explicitly requires risk management per ISO 14971 throughout the medical device lifecycle — in design controls, production processes, supplier controls, complaint handling, and post-market surveillance. Under the FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, that requirement now carries federal regulatory weight. FDA investigators under Compliance Program 7382.850 are expected to use the risk management file as their inspection roadmap.

Yet despite being one of the most referenced standards in medical device regulation, ISO 14971 remains one of the least understood. Most manufacturers know it exists. Far fewer understand what it actually requires, how its six-step process works across the device lifecycle, or why the 2019 edition introduced changes that many organizations still haven’t fully implemented.

This guide covers all of it — what ISO 14971 is, what it requires clause by clause, how it integrates with ISO 13485 and the QMSR, and what your risk management program needs to look like in practice.

In This Guide

What ISO 14971 is and why it exists
Who needs ISO 14971
The six-step ISO 14971 risk management process
Key clause-by-clause breakdown
What changed in the 2019 edition
The Risk Management File — what it contains and how it’s structured
ISO 14971 and ISO 13485 — how they integrate
ISO 14971 under the FDA QMSR
ISO/TR 24971 — the companion guidance document
How to buy the official standard
Frequently asked questions

✅ Start Here (Top Resources)

📋 Purchase the official ISO 14971:2019 standard → ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026

📋 Purchase the official ISO 13485:2016 standard — required companion → ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off

📋 Save up to 50% buying both standards as a bundle → ISO Standards Packages — ANSI Webstore

📋 Get ISO 13485 training that covers ISO 14971 integration → BSI Group ISO 13485 Training

📋 Get ISO 13485 certified with an accredited certification body → ISOQAR ISO 13485 Certification

What Is ISO 14971?

ISO 14971 is the international standard for the application of risk management to medical devices. The current version — ISO 14971:2019 — is the third edition, published in December 2019. It specifies the terminology, principles, and a structured process for identifying hazards associated with medical devices, estimating and evaluating the associated risks, controlling those risks, and monitoring the effectiveness of controls throughout the entire device lifecycle.

The standard applies to:

Physical medical devices of all classifications
Software as a Medical Device (SaMD)
In vitro diagnostic (IVD) medical devices
Combination products where the device constituent part requires risk management

Before ISO 14971, there was no universally accepted methodology for risk management in the medical device industry. Different manufacturers used different approaches, different terminology, and different standards for what constituted acceptable risk. ISO 14971 introduced a standardized process that could be consistently applied across the industry globally — giving regulators, certification bodies, and trading partners a shared framework for evaluating whether a manufacturer’s risk management is adequate.

Risk, as defined by ISO 14971, is the combination of two components:

The probability that harm will occur
The severity of that harm

This definition is important because it shapes the entire risk management process. A high-severity potential harm that is extremely unlikely to occur produces a different risk level than a moderate-severity harm that occurs frequently. ISO 14971 requires manufacturers to evaluate both dimensions systematically — not rely on intuition or experience alone.

Who Needs ISO 14971?

ISO 14971 is effectively required for any organization involved in the medical device supply chain. Specifically:

Organizations that must implement ISO 14971:

Medical device manufacturers — it is explicitly required by ISO 13485 and referenced throughout FDA QMSR, EU MDR, Health Canada, TGA (Australia), and most other major regulatory frameworks
Design-responsible organizations developing medical devices or device software
Contract manufacturers producing devices under a design owner’s technical file

Organizations that should implement ISO 14971:

Component suppliers whose products are incorporated into medical devices — risk management requirements are increasingly flowed down through quality agreements
Software developers producing SaMD or software incorporated into medical devices
Sterilization service providers — sterilization process risk must be managed within the device’s overall risk management framework

A critical distinction: ISO 14971 is not legally mandated in the same way a regulation is — regulators like the FDA do not list it as a statutory requirement. However, regulators worldwide recognize ISO 14971 as the state of the art for medical device risk management. Non-conformance with ISO 14971 — or the absence of a risk management program built on its framework — creates significant regulatory exposure. For practical purposes, ISO 14971 is mandatory for any organization intending to demonstrate that their device is safe and effective.

The ISO 14971 Risk Management Process — Six Steps

Infographic illustrating the six-step ISO 14971 medical device risk management process: Risk Analysis, Risk Evaluation, Risk Control, Overall Residual Risk, Risk Management Review, and Post-Production Information. — The six-step ISO 14971 risk management process creates a structured lifecycle approach for identifying hazards, controlling risks, evaluating residual risk, and continuously improving medical device safety.

ISO 14971 defines a six-step risk management process that applies across the entire device lifecycle — from initial concept through design, production, and post-market activities.

Step 1 — Risk Analysis

Risk analysis is the systematic use of available information to identify hazards and estimate the risks associated with a medical device. It consists of two activities:

Hazard identification: Identifying all reasonably foreseeable hazards associated with the device under both normal use conditions and fault conditions. The 2019 edition specifically requires both normal and fault conditions to be considered — a change from the 2007 edition which emphasized fault conditions primarily.

Sources of hazards include:

Device energy sources (electrical, thermal, mechanical, radiation)
Device materials and their biological interactions
Use environment and user characteristics
Reasonably foreseeable misuse
Software failures and cybersecurity vulnerabilities
Interactions with other devices

Risk estimation: For each hazardous situation identified, estimating the risk by determining the probability of occurrence of harm and the severity of that harm. ISO 14971 does not specify acceptable risk levels — manufacturers must establish their own objective criteria based on regulatory requirements, industry standards, and clinical context.

Step 2 — Risk Evaluation

Risk evaluation is the process of comparing estimated risks against the manufacturer’s defined risk acceptability criteria to determine whether risk reduction is required. If the estimated risk exceeds acceptable levels, the process moves to risk control. If the risk is within acceptable limits, it is documented as acceptable residual risk and monitored.

Step 3 — Risk Control

Risk control is the process of implementing and verifying measures to reduce risks that exceed acceptable levels. ISO 14971 requires risk control measures to be implemented in a defined priority order:

Inherent safety by design — eliminate or reduce hazards through design decisions (preferred)
Protective measures — guards, alarms, interlocks in the device or manufacturing process
Information for safety — warnings, instructions for use, training requirements (last resort)

After implementing risk control measures, the residual risk — the risk remaining after controls — must be estimated and evaluated again. The process is iterative: if residual risk is still unacceptable, additional risk control measures must be implemented.

Risk control measures must also be evaluated for introduced risks — a control measure that eliminates one hazard may introduce a new one.

Step 4 — Evaluation of Overall Residual Risk

After all individual risks have been addressed, the overall residual risk of the device must be evaluated — not just each individual risk in isolation. If the overall residual risk is not acceptable using the manufacturer’s risk acceptability criteria, a benefit-risk analysis must be performed.

Benefit-risk analysis (introduced as a formal requirement in the 2019 edition) evaluates whether the clinical benefits of the device outweigh the overall residual risk in the context of the device’s intended use. If the benefits outweigh the risks, and appropriate information is provided to users, the device may be released. If the benefits do not outweigh the risks, the device cannot be released — additional risk control measures are required.

Step 5 — Risk Management Review

Before a device is released for distribution, a formal risk management review must be completed. The 2019 edition changed the title of this clause from “Risk Management Report” to “Risk Management Review” — a deliberate signal that this is an active review activity, not simply a summary document.

The review must confirm:

The risk management plan has been fully implemented
The overall residual risk is acceptable
Appropriate methods are in place to collect and review production and post-production information

Reviewers must be identified in the risk management plan in advance — they cannot be appointed after the fact.

Step 6 — Production and Post-Production Information

Risk management does not end when the device is released. ISO 14971 requires a systematic process for collecting and reviewing information from production and post-market activities throughout the device’s commercial life. This includes:

Complaint data and adverse event reports
Post-market surveillance information
Production nonconformances and CAPA trends
New scientific and technical information relevant to device safety

When this information indicates that the risk management process needs to be updated — that a new hazard has been identified, or that an existing risk estimate was incorrect — the risk management file must be revised and risk control measures re-evaluated.

ISO 14971 Clause-by-Clause Breakdown

Clause	Title	Key Content
1	Scope	Applicability to all medical devices, SaMD, IVDs, combination products
2	Normative references	ISO 9000:2015 for defined terms
3	Terms and definitions	31 defined terms including risk, hazard, harm, hazardous situation, benefit
4	General requirements	Risk management system requirements, management responsibilities, competence requirements
5	Risk management planning	Risk management plan requirements — device scope, lifecycle phases, risk acceptability criteria
6	Risk analysis	Intended use, hazard identification, risk estimation
7	Risk evaluation	Comparison to acceptability criteria, benefit-risk analysis (Clause 7.4)
8	Risk control	Control option analysis, measure implementation, residual risk evaluation, introduced risks
9	Evaluation of overall residual risk	Overall residual risk acceptability, benefit-risk if needed
10	Risk management review	Pre-release review requirements, reviewer identification
11	Production and post-production activities	Information collection, new hazard identification, risk file updates

What Changed in ISO 14971:2019

The 2019 edition is the third edition of ISO 14971, replacing the 2007 version. Several changes have practical implementation implications:

Benefit-risk analysis is now a formal requirement. The 2019 edition formally introduced benefit-risk analysis as a defined process step (Clause 7.4) when overall residual risk is not acceptable under the manufacturer’s criteria alone. The 2007 edition referenced this concept but did not treat it as a structured requirement. The FDA’s influence here is direct — the FDA revised its language to place “benefit” before “risk” for novel device submissions, and the ISO 14971 committee adopted this framing in the 2019 revision.

Both normal and fault conditions must be analyzed. Clause 5.4 of the 2019 edition explicitly requires identification of anticipated hazards under both normal use and fault conditions. The 2007 edition emphasized fault conditions — the 2019 edition closes that gap. This has direct implications for FMEA and hazard analysis documentation.

Post-production requirements are more prescriptive. The requirements for production and post-production information collection (Clause 11) are more detailed in the 2019 edition, with stronger emphasis on systematic feedback of real-world performance data into the risk management file.

Risk Management Review replaces Risk Management Report. The title change in Clause 9 (from “report” to “review”) reflects a substantive intent: the activity must be an active review with identified reviewers, not a passive summary document compiled at device release.

EN ISO 14971:2019 + A11:2021 for EU MDR. The European version of the standard includes Amendment A11:2021, which maps ISO 14971 requirements to the General Safety and Performance Requirements (GSPR) of the EU Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR). Organizations selling into the EU need the A11 annex — organizations selling only in the U.S. do not, but the normative requirements are identical in both versions.

The Risk Management File

The Risk Management File (RMF) is the central documentation output of the ISO 14971 process. It is the organized collection of records that demonstrates a manufacturer has systematically identified hazards, evaluated risks, implemented controls, and monitored the effectiveness of those controls throughout the device lifecycle.

The RMF is not a single document. It is a defined collection of records that includes:

Risk Management Plan (RMP): Defines the scope of risk management activities, the lifecycle phases covered, the risk acceptability criteria, the risk estimation methodology, and the verification activities planned
Risk Analysis records: Hazard identification outputs, risk estimation records, FMEA or other analysis tool outputs
Risk Evaluation records: Comparison of estimated risks against acceptability criteria
Risk Control records: Selected control measures, implementation records, verification that controls achieved their intended risk reduction, evaluation of introduced risks
Overall Residual Risk evaluation: Documentation of the overall residual risk assessment and benefit-risk analysis if required
Risk Management Review: Pre-release review record with identified reviewers
Post-Production information records: Systematic records of production and post-market information reviewed against the risk management file

A common audit finding is a Risk Management File that functions as a static document compiled at device release — rather than a living record updated throughout the device’s commercial life as post-production information is gathered. Under the QMSR, FDA investigators start inspections with the risk management file. A static RMF that hasn’t been updated since initial device release is a significant inspection vulnerability.

📋 How does your risk management program measure up? Section 6 of the free ISO 13485 Gap Assessment Checklist covers ISO 14971 integration specifically — risk management plan requirements, RMF structure, post-production feedback, and the QMSR inspection implications. Download Free Checklist

ISO 14971 and ISO 13485 — How They Integrate

ISO 14971 and ISO 13485 are companion standards — not alternatives. ISO 13485 is the quality management system framework. ISO 14971 is the risk management framework that ISO 13485 requires to be implemented throughout that QMS.

ISO 13485 references ISO 14971 in multiple clauses:

Clause 7.1 — Planning of product realization: Risk management activities must be planned as part of product realization
Clause 7.3 — Design and development: Risk management must be integrated throughout design and development activities
Clause 7.4 — Purchasing: Supplier controls must reflect risk — suppliers of higher-risk components require more rigorous qualification
Clause 8.2.1 — Feedback: Post-market feedback must be evaluated in the context of risk management
Clause 8.5 — Improvement: CAPA and continual improvement activities must consider risk management outputs

ISO 14971 is not optional supplementary guidance for ISO 13485. Organizations implementing ISO 13485 must purchase and implement ISO 14971. It is an external document that must be controlled under ISO 13485 Clause 4.2.4 — registered, version-controlled, and accessible to relevant personnel.

For a complete comparison of how ISO 13485 and risk management requirements interact, see ISO 9001 vs ISO 13485 — Key Differences.

📋 Buy ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off

ISO 14971 Under the FDA QMSR

The FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, incorporated ISO 13485:2016 by reference into 21 CFR Part 820 — and with it, ISO 13485’s explicit requirement for risk management per ISO 14971.

Under QMSR, several specific changes elevate the practical importance of ISO 14971:

Risk management now extends across the entire QMS. Under the old QSR, risk management was concentrated primarily in design controls. Under QMSR, risk-based thinking is required throughout the entire quality system — supplier controls, production processes, CAPA, complaint handling, and post-market surveillance. ISO 14971 is the expected framework for implementing this expanded risk management scope.

FDA investigators start inspections with the risk management file. Under Compliance Program 7382.850 — the new inspection program that replaced QSIT on February 2, 2026 — FDA investigators are expected to begin inspections by reviewing the risk management file and following risk documentation into other quality system areas. A well-maintained, current risk management file is inspection preparation. An incomplete or static risk management file is an inspection liability.

Post-market surveillance feeds the risk management file. The QMSR’s requirements for production and post-production information — complaint handling, MDR, field corrections — are expected to feed systematically into the risk management file. Organizations that maintain complaint handling and risk management as separate, unconnected systems have a QMSR gap.

For the complete QMSR transition guide, see FDA QSR vs ISO 13485: The Complete QMSR Transition Guide.

ISO/TR 24971 — The Companion Guidance Document

ISO/TR 24971:2020 is the technical report published as a companion to ISO 14971:2019. Unlike ISO 14971, which is a normative standard (its requirements are mandatory for certification purposes), ISO/TR 24971 is guidance — it does not add requirements but provides practical methodology for implementing ISO 14971’s requirements.

ISO/TR 24971:2020 covers:

Guidance on risk management planning
Practical methods for hazard identification and risk estimation
Guidance on benefit-risk analysis
Application of risk management to software
Application of risk management to usability and human factors
Guidance on production and post-production information processes

For organizations building or rebuilding their risk management program, ISO/TR 24971 is the practical implementation companion to ISO 14971’s requirements. Many experienced quality and regulatory professionals recommend reading both together.

📋 ISO/TR 24971:2020 — ANSI Webstore — use coupon CC2026 for 5% off

How to Buy ISO 14971

ISO 14971 is a copyrighted document and must be purchased from an authorized source. It cannot be legally downloaded for free.

ANSI Webstore — Recommended U.S. Source

The ANSI Webstore is the authorized U.S. distributor for ISO standards. ISO 14971:2019 is available in PDF format with immediate download after purchase.

📋 ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026

Bundle with ISO 13485 — Save Up to 50%

Organizations implementing ISO 13485 need both standards. Purchasing as a bundle through the ANSI Webstore saves significantly compared to individual purchases.

📋 ISO Standards Bundles — Save up to 50%

For the complete guide to purchasing ISO 13485, see Buy ISO 13485 — Complete Purchasing Guide.

Frequently Asked Questions

What is ISO 14971 used for?

ISO 14971 is the international standard for applying risk management to medical devices. It provides the structured process — hazard identification, risk estimation, risk evaluation, risk control, overall residual risk evaluation, and post-production monitoring — that manufacturers must use to demonstrate that their devices are safe for their intended use.

Is ISO 14971 required for ISO 13485 certification?

Yes. ISO 13485 explicitly requires risk management per ISO 14971 throughout the medical device quality management system. Organizations cannot achieve ISO 13485 certification without demonstrating that their risk management program is built on the ISO 14971 framework. ISO 14971 must be controlled as an external document within the ISO 13485 QMS.

Is ISO 14971 required by the FDA?

ISO 14971 is not listed as a statutory FDA requirement. However, the FDA recognizes ISO 14971 as the state of the art for medical device risk management. Under the QMSR, effective February 2, 2026, ISO 13485 is incorporated by reference into 21 CFR Part 820 — and ISO 13485 explicitly requires ISO 14971. FDA investigators under CP 7382.850 use the risk management file as their inspection starting point. For practical purposes, ISO 14971 is effectively mandatory for any FDA-regulated medical device manufacturer.

What is the difference between ISO 14971:2007 and ISO 14971:2019?

The 2019 edition introduced several substantive changes: benefit-risk analysis is now a formal requirement when overall residual risk is not acceptable; both normal use and fault conditions must be analyzed during hazard identification; post-production requirements are more prescriptive; and the Risk Management Report was renamed Risk Management Review to signal an active review activity rather than a passive document.

What is the Risk Management File?

The Risk Management File (RMF) is the organized collection of records that demonstrates a manufacturer has systematically implemented the ISO 14971 risk management process. It includes the Risk Management Plan, hazard analysis records, risk evaluation records, risk control records, overall residual risk evaluation, risk management review, and post-production information records. The RMF is a living document — it must be updated throughout the device’s commercial life as post-production information is gathered.

What is ISO/TR 24971?

ISO/TR 24971:2020 is the technical report companion to ISO 14971:2019. It provides practical guidance on implementing ISO 14971’s requirements — methods for hazard identification, risk estimation, benefit-risk analysis, software risk management, and post-production information processes. It does not add normative requirements but is an essential practical companion for organizations building or rebuilding their risk management programs.

What is the difference between ISO 14971 and ISO 31000?

ISO 14971 is specific to medical device risk management and defines risk purely in terms of harm to people — the combination of probability of harm and severity of that harm. ISO 31000 is a broader enterprise risk management standard with a wider definition of risk that includes any effect on objectives, including positive risks (opportunities). The two standards serve different purposes and are not interchangeable in the medical device context.

Does ISO 14971 apply to software as a medical device?

Yes. ISO 14971:2019 explicitly applies to Software as a Medical Device (SaMD). ISO/TR 24971 provides specific guidance on applying ISO 14971 to software. The companion standard IEC 62304 — Medical Device Software Lifecycle Processes — also references ISO 14971 risk management requirements throughout its software development lifecycle requirements.

📥 Free Resources

👉 ISO 9001 Roadmap — Step-by-Step Implementation Guide
👉 Manufacturing Compliance Checklist — verify all compliance areas before your certification audit
👉 Supplier Quality Checklist — material supplier and tooling supplier qualification requirements

Not Sure What to Do Next?

✅ You need the official ISO 14971:2019 standard 📋 ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026

✅ You also need ISO 13485:2016 — the required companion QMS standard 📋 ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off

✅ You need the ISO/TR 24971 implementation guidance companion 📋 ISO/TR 24971:2020 — ANSI Webstore — use coupon CC2026 for 5% off

✅ You want to save buying multiple standards together 📋 ISO Standards Bundles — Save up to 50% — ANSI Webstore

✅ You need ISO 13485 training that covers ISO 14971 integration 📋 BSI Group ISO 13485 Training

✅ You are ready to pursue ISO 13485 certification 📋 ISOQAR ISO 13485 Certification

✅ You want to understand what ISO 13485 requires 📋 What Is ISO 13485? — Complete Guide

✅ You want to understand the FDA QMSR and how ISO 14971 fits 📋 FDA QSR vs ISO 13485 — The Complete QMSR Transition Guide

✅ You want to compare ISO 9001 and ISO 13485 📋 ISO 9001 vs ISO 13485 — Key Differences

✅ You want to understand ISO 13485 purchase options and cost 📋 Buy ISO 13485 — Complete Purchasing Guide 📋 How Much Does ISO 13485 Cost?

Risk Management Is Not a Deliverable. It’s an Operating Model.

ISO 14971 is not a checkbox on a certification audit list. It is the framework that determines whether the medical devices your organization produces — or supplies components for — are demonstrably safe for their intended use.

Under the FDA’s QMSR, effective February 2, 2026, that framework now carries federal regulatory weight. Risk management under QMSR extends across the entire quality system, and FDA investigators under CP 7382.850 are using the risk management file as their inspection roadmap.

The organizations that navigate this environment successfully are the ones that treat risk management as an operating discipline — not a documentation exercise. The Risk Management File is updated because post-market data is being systematically reviewed, not because an audit is scheduled. CAPA is connected to the risk management file because the quality system is integrated, not because an investigator asked to see the connection.

That is what ISO 14971, properly implemented, actually produces.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

✅ Get updates on new standards, implementation strategies, and compliance insights ✅ Be first to access new guides, tools, and checklists

Subscribe below to stay ahead.

The Question That Stalls Every EU Market Entry Meeting

In This Guide

Table of Contents

👉 Start Here

What Is EU MDR 2017/745?

What Is ISO 13485?

MDR vs. ISO 13485: Core Differences

Why Manufacturers Conflate the Two

Where MDR and ISO 13485 Overlap

MDR Transition Timelines: Where Things Stand in 2026

Do You Need Both? A Decision Framework

Common Mistakes That Surface in Notified Body Review

Quick Reference Checklist

FAQ

Does ISO 13485 certification satisfy MDR requirements?

Is ISO 13485 mandatory for the EU market?

Do U.S.-only manufacturers need to worry about MDR?

What’s the current MDR transition deadline for legacy devices?

Is the EU actually changing MDR requirements soon?

What’s the biggest documentation gap Notified Bodies flag?

Can one gap assessment cover both ISO 13485 certification readiness and MDR technical file readiness?

Where should a manufacturer start if pursuing both?

📥 Free Resources

Not Sure What to Do Next?

Stop Guessing Where Your MDR Gap Actually Is

Subscribe

The Documentation Gap That Fails Design History Files

In This Guide

Table of Contents

👉 Start Here (Top Resources)

Verification vs. Validation: The Core Distinction

Verification and Validation in Practice: An Infusion Pump Example

Design Verification Requirements

👉 Before You Build Another Test Protocol

Design Validation Requirements

Process Validation Under Clause 7.5.6

Software Validation Requirements

What the FDA QMSR Changed for U.S. Manufacturers

Common V&V Documentation Failures

👉 Before Your Next Notified Body Assessment

Building a Verification & Validation Plan That Holds Up

Quick Audit Checklist

FAQ

What is the difference between verification and validation in ISO 13485?

Does ISO 13485 require validation on production units?

What processes require process validation under Clause 7.5.6?

How did the FDA QMSR affect verification and validation requirements?

Do low-risk devices still need design validation?

Does software need separate validation from the device it’s part of?

What’s the most common finding auditors cite for validation?

Where does risk management fit into verification and validation?

📥 Free Resources

Not Sure What to Do Next?

Stay Ahead of the Next V&V Finding

Subscribe

The Standard That Guided ISO 13485 Compliance Is Gone — Here’s What That Means

In This Guide

Table of Contents

👉 Start Here — Top Resources

What Was ISO/TR 14969?

Why Was ISO/TR 14969 Withdrawn?

What Replaced ISO/TR 14969? Structure and Clause Mapping

Why This Matters More in 2026: FDA QMSR and Dual Compliance

How to Update Your QMS for Current Guidance

✅ Quick Checklist: ISO/TR 14969 Reference Review

Where to Buy ISO 13485 and the Current Guidance Handbook

FAQ

Is ISO/TR 14969 still valid?

What replaced ISO/TR 14969?

Can I still reference ISO/TR 14969 in my QMS procedures?

Does ISO/TR 14969 apply to FDA QMSR compliance?

What is the difference between a Technical Report and an ISO standard?

How is ISO/TR 14969 different from ISO 13485?

Do I need to buy the ISO 13485:2016 Practical Guide separately from the standard?

Where can I get ISO 13485 training that covers the current guidance?

📥 Free Resources

Not Sure What to Do Next?

Stay Current on ISO 13485 and Medical Device Compliance

Subscribe

The Compliance Gap That Gets Medical Device Manufacturers in Trouble