2026-09-21 · KeXinMaterials Editorial Team
ISO 13485 Medical Device QMS + Protective Case B2B Compliance Guide
ISO 13485:2016 "Medical devices - Quality management systems - Requirements for regulatory purposes" is the global standard for medical device QMS. Required for medical device manufacturers + suppliers. Combined with MDR (EU) 2017/745 (EU) + FDA 21 CFR 820 (US). Below is the 2026 B2B procurement guide covering scope, ISO 14971 risk management, IEC 62304 software, CE marking, FDA 510(k), and protective case requirements for medical device B2B.
ISO 13485 Scope + Versions
ISO 13485:2016 current revision. Based on ISO 9001:2008 structure with medical device-specific additions. Required for medical device QMS.
ISO 13485:2016: Current edition (March 2016). Replaces ISO 13485:2003.
Publisher: ISO (International Organization for Standardization). TC 210 (Quality management and corresponding general aspects for medical devices).
Scope: QMS requirements for medical device manufacturers + suppliers + service providers.
Medical device definition: Per ISO 13485, any instrument, apparatus, implant, in vitro reagent, or other article intended for medical purposes.
Geographic: International standard adopted globally. EU MDR references ISO 13485. FDA 21 CFR 820 harmonizes with ISO 13485. Canada, Japan, Australia, Brazil recognize.
Certifying bodies: ANAB (US), UKAS (UK), DAkkS (Germany), COFRAC (France), BSI (Netherlands), TÜV SÜD (Germany). All IAF MLA accredited.
Certificate validity: 3 years initial + annual surveillance + recertification.
ISO 14971 (Risk Management): Required companion standard. All ISO 13485-certified organizations must implement ISO 14971.
IEC 62304 (Medical Device Software): Required for medical device software. Companion standard.
IEC 60601 (Medical Electrical Equipment): Required for medical electrical equipment. Companion standard.
B2B relevance: For box-beeaa B2B buyers in medical device / pharma / diagnostic, ISO 13485 compliance required for protective cases carrying medical devices + pharma cold chain + diagnostic equipment.
ISO 13485 Requirements
ISO 13485 includes 8 main clauses with medical device-specific additions on document control, design control, purchasing, production, traceability, validation.
Clause 4 - Quality Management System: Documented QMS + role responsibilities + management representative.
Clause 5 - Management Responsibility: Management commitment + customer focus + quality policy + quality objectives + management review.
Clause 6 - Resource Management: Human resources + infrastructure + work environment + contamination control.
Clause 7 - Product Realization: Planning + customer-related processes + design + development + purchasing + production + service.
Clause 8 - Measurement, Analysis, Improvement: Monitoring + measurement + control of nonconforming product + analysis + improvement + CAPA.
Section 4.2.4 - Control of Records: Medical device records retained per regulatory requirement (typically 2 years after device discontinuation or longer).
Section 7.3 - Design and Development: Design planning + inputs + outputs + review + validation + changes + transfer records. Documented design history file (DHF) for FDA.
Section 7.4 - Purchasing: Supplier evaluation + purchasing information + verification of purchased product. Supplier controls critical.
Section 7.5.1 - Control of Production: Production process controls + work instructions + monitoring equipment + in-process inspection.
Section 7.5.3 - Identification and Traceability: Each medical device uniquely identified. Traceability from raw material to delivered product + to patient (UDI per EU MDR + FDA).
Section 7.5.5 - Particular Requirements for Sterile Medical Devices: Sterilization process validation + routine monitoring.
Section 7.5.6 - Validation of Processes: Validation of production processes (IQ/OQ/PQ). Including software validation per IEC 62304.
Section 8.2.2 - Complaint Handling: Customer complaint recording + investigation + root cause analysis + corrective action + regulatory reporting (MDR vigilance for serious incidents).
Section 8.5 - Improvement: CAPA (Corrective Action / Preventive Action). Mandatory for medical device nonconformities.
B2B relevance: For B2B medical device cases, ISO 13485 compliance required. Supplier audit + DoC + ISO 14971 risk analysis + IEC 62304 (if embedded software).
ISO 14971 Risk Management
ISO 14971:2019 "Medical devices - Application of risk management to medical devices" - mandatory companion to ISO 13485.
ISO 14971:2019: Current edition (2019). Replaces ISO 14971:2007.
Risk management process: (1) Risk analysis. (2) Risk evaluation. (3) Risk control. (4) Residual risk evaluation. (5) Risk management review. (6) Production + post-production information.
Risk analysis: Identify hazards + estimate risks (severity x probability) for each hazard + hazardous situation.
Severity scale: Negligible, Minor, Serious, Critical, Catastrophic. ISO 14971:2019 simplified to 5 levels.
Probability scale: Improbable, Remote, Occasional, Frequent, Frequent. Probability per use / per device lifetime.
Risk acceptability: Risk matrix maps severity x probability. Unacceptable risks must be reduced (as low as reasonably practicable).
Risk control measures: Inherent safe design + protective measures (case / barrier) + information for safety (labeling / instructions).
Risk management file: Documents risk analysis + evaluation + control + residual risk + post-production plan. Required for CE marking.
Risk management plan: Defines scope + responsibilities + acceptability criteria + verification activities.
Post-production: Monitor actual incidents + complaints + recalls + service data. Update risk analysis based on real-world data.
ISO 14971 + IEC 62304 integration: Software risk classification + testing requirements per IEC 62304 (Class A / B / C software).
B2B medical case risk management: Identify hazards (drop, vibration, ESD, temperature, contamination, loss of data) + estimate severity (e.g., wrong diagnostic = critical) + apply controls (case + cushioning + labeling) + verify.
B2B recommendation: For medical device cases, require ISO 14971 risk management file + risk analysis for case + IEC 62304 (if embedded software) + post-production monitoring plan.
MDR (EU) 2017/745 + FDA 21 CFR 820
MDR (EU) 2017/745 (EU Medical Device Regulation) + FDA 21 CFR 820 (US Quality System Regulation) are regional regulatory frameworks. ISO 13485 harmonizes with both.
MDR (EU) 2017/745: EU Medical Device Regulation. Entered force May 2017. Apply from May 2021 (with extensions). Replaces MDD 93/42/EEC.
MDR scope: All medical devices placed on EU market. Includes accessories + devices for cleaning / disinfection / sterilization.
MDR classification: Class I (low risk) + Class IIa (low-medium) + Class IIb (medium-high) + Class III (high). Higher class = stricter requirements.
MDR conformity assessment: Class I self-declaration. Class IIa + IIb + III require Notified Body (e.g., TÜV SÜD, BSI, DEKRA) certification.
MDR technical documentation: Technical File or Design Dossier per device class. Must include ISO 14971 risk analysis.
MDR Unique Device Identification (UDI): Each device has UDI-DI (device identifier) + UDI-PI (production identifier). Per Article 27.
MDR post-market surveillance: PMS plan + PMS report + PSUR (Periodic Safety Update Report) for Class IIa/IIb/III.
MDR vigilance reporting: Serious incidents must be reported to competent authority within 15 days (death / serious deterioration). Field Safety Corrective Action (FSCA) if needed.
FDA 21 CFR 820: US Quality System Regulation. 30 years old (current version 2024 update). ISO 13485 harmonized via 2018 agreement.
FDA classification: Class I (general controls) + Class II (general + special controls, often 510(k)) + Class III (PMA, premarket approval).
FDA 510(k): Premarket notification for Class II devices. Demonstrate substantial equivalence to predicate device.
FDA PMA: Premarket approval for Class III devices. Full clinical data required.
FDA Establishment Registration: All medical device manufacturers must register FDA Establishment + list devices annually.
B2B recommendation: For US + EU markets, require ISO 13485 + MDR compliance (EU) + FDA 21 CFR 820 (US) + 510(k) or PMA documentation as applicable.
ISO 13485 + B2B Procurement Workflow
B2B procurement workflow for medical device protective cases. 5-step + ISO 13485 supplier qualification + documentation.
Step 1: Determine medical device class (I, IIa, IIb, III) per MDR or FDA classification rules.
Step 2: Specify ISO 13485:2016 certification requirement + ISO 14971 risk management for case.
Step 3: Specify regional regulatory compliance. MDR (EU) / FDA 21 CFR 820 / Japan PMDA / China NMPA / Health Canada.
Step 4: Specify validation requirements. IEC 62304 (if software) + IQ/OQ/PQ (production process) + sterilization validation (if sterile).
Step 5: Specify labeling + UDI requirements. EU MDR UDI-DI + UDI-PI + FDA UDI per 21 CFR 830.
Supplier qualification: ISO 13485 audit (Stage 1 + Stage 2 + annual surveillance) + management representative interview + CAPA history + complaint handling review.
Case validation: Drop test + vibration test + temperature test + ESD test + cleaning test + sterilization compatibility (if sterile device).
Material biocompatibility: ISO 10993-1 if case contacts medical device. Cytotoxicity + sensitization + irritation testing.
Sterilization compatibility: If case or device undergoes sterilization (EtO, gamma, steam, plasma), verify case material compatibility + cycle validation.
Labeling: ISO 15223-1 (medical device symbols) + 21 CFR 801 (US labeling) + MDR Annex I Chapter III (EU labeling). Includes UDI carrier + CE mark + manufacturer + sterility + expiry.
Recordkeeping: 10 years minimum for medical device records (varies by regulation). DHF (Design History File) + DMR (Device Master Record) + DHR (Device History Record).
Cost impact: ISO 13485 + ISO 14971 + IEC 62304 adds 10-25% to medical device component cost. Premium for safety-critical devices.
B2B recommendation: For medical device protective cases, require ISO 13485:2016 + ISO 14971 risk management + regional compliance (MDR / FDA) + IEC 62304 (if software) + ISO 10993-1 (if biocompatibility). Annual audit + recordkeeping.
Key Takeaways
- ISO 13485:2016 is the global medical device QMS standard, required for market access in EU + US + Japan + China + Canada.
- ISO 14971:2019 (Risk Management) is mandatory companion standard. Process: analyze + evaluate + control + monitor.
- MDR (EU) 2017/745 + FDA 21 CFR 820 are regional regulatory frameworks harmonized with ISO 13485.
- Medical device classes I / IIa / IIb / III determine conformity assessment path (self-declaration vs Notified Body vs PMA).
- B2B recommendation: For medical device protective cases, require ISO 13485 + ISO 14971 + regional compliance (MDR/FDA) + IEC 62304 (if software) + ISO 10993-1 (if biocompatibility). Annual audit + 10-year records.
FAQ
q
a
q
a
q
a
q
a
q
a