ISO 13485: Clauses, FDA's QMSR Reading, Certification

ISO 13485:2016 is the international quality management system standard for organizations in the medical device life cycle: design, production, storage, distribution, installation, servicing and disposal. It is the third edition, published in March 2016. ISO reviewed it in 2025 and confirmed it on 31 October 2025, so the 2016 text remains current.

Since 2 February 2026 the standard is also part of US law. 21 CFR Part 820 incorporates ISO 13485:2016 by reference (§ 820.7(b)), and § 820.10(a) requires a manufacturer to document a quality management system that complies with its applicable requirements. The QMSR page covers the regulatory change. This page covers the standard itself and the places where FDA says how it reads it.

ISO sells the text and holds the copyright, so this page paraphrases at the level of clause titles and quotes only what FDA and ISO publish.

Structure of the standard

Clauses 1 to 3 are scope, normative references and terms. Clause 3 points to the definitions in ISO 9000:2015, which FDA also incorporated. The requirements sit in clauses 4 to 8.

Clause 7.3 breaks into planning, inputs, outputs, review, verification, validation, transfer, changes and the design and development file (7.3.2 to 7.3.10). Clause 7.5 holds process validation (7.5.6), sterile device requirements (7.5.5, 7.5.7) and traceability (7.5.8, 7.5.9). The design change control post walks through clause 7.3.9.

FDA's inspection program, Compliance Program 7382.850, assigns these clauses to six inspection areas. The full clause list per area is in the QMSR page and is not repeated here.

What differs from ISO 9001

ISO's own page for ISO 9001 says the two standards differ in user group and application. ISO 9001 applies to any organization. ISO 13485 is built for the device industry with a focus on regulatory compliance, and it omits certain generic ISO 9001 requirements where regulatory requirements make them less relevant. ISO's page for ISO 13485 says it emphasizes meeting regulatory as well as customer requirements, risk management and process validation more than ISO 9001 does.

FDA's preamble describes the history. The first edition (1996) was a supplement to be used with ISO 9001. Over time it became a stand-alone standard.

Two consultancies, Kanriq and Coplain, publish comparisons that agree with this table. ISO 13485 itself has an annex that maps its clauses to ISO 9001:2015.

ISO published a new ISO 9001 on 16 September 2026. The 2026 edition keeps the Harmonized Structure and does not amend ISO 13485. Comparisons written before that date describe the 2015 edition of ISO 9001.

How FDA reads ISO 13485

The final rule preamble (89 FR 7496) answers several questions the standard leaves open.

• "Document" and "establish". The old QSR defined "establish" as define, document and implement. Commenters said ISO 13485's "document" is weaker. FDA agreed the two terms do not mean the same thing, and said it was not trying to replace one with the other. Its answer is that clause 0.2 of ISO 13485 clarifies that "document" encompasses establishing, implementing and maintaining (comment 30). Section 820.10(a) uses the same verb. A procedure that exists on paper but is not followed does not meet it.
• Notes. Notes in the standard are not legal requirements. FDA says they explain the provisions and can help in understanding them (comment 10).
• Introduction. FDA incorporated the whole introduction, including clause 0.2 on concepts and clause 0.4 on the relationship with ISO 9001 (comment 11).
• Other standards. Only ISO 13485 and Clause 3 of ISO 9000 are incorporated. ISO 14971 and the other standards the text cites are not (comment 9). FDA says they may help in understanding how to apply ISO 13485.
• Wording. The regulation uses "safety and performance", but § 820.1(a) says this does not change the statutory standard of safe and effective.
• Conflicts. Where a clause of ISO 13485 conflicts with the Federal Food, Drug, and Cosmetic Act or another FDA regulation, § 820.1(b) says those control.

What FDA kept for itself

ISO 13485 refers to "applicable regulatory requirements" throughout. Section 820.10(b) says what those are in the US for four clauses: unique device identification under part 830 (clause 7.5.8), tracking under part 821 (7.5.9.1), complaint reporting under part 803 (8.2.3) and advisory notices under part 806 (7.2.3, 8.2.3, 8.3.3). Section 820.10(c) limits design and development (clause 7.3) to class II, class III and a short list of class I devices. Section 820.10(d) extends implantable-device traceability (7.5.9.2) to devices that support or sustain life. Sections 820.35 and 820.45 add record content and labeling checks. The 21 CFR 820 page has each section.

Certification and FDA inspection

A certificate of conformity to ISO 13485 is issued by a certification body after an audit. The standard does not require one. FDA's QMSR FAQ (question 13) says:

• FDA will not require certificates of conformance to ISO 13485 and will not issue them.
• A certificate does not exempt a manufacturer from an FDA inspection.
• FDA inspections assess compliance to FDA regulations and are scheduled on risk factors. Third-party audits assess conformance to a standard and occur annually based on a three-year plan.

The preamble gives a reason. FDA cannot ensure that parts 803, 806, 821 and 830 are audited in an independent ISO 13485 audit. It does not oversee auditing organizations outside MDSAP and does not evaluate the content of their reports (comment 79). An ISO 13485 certificate is not accepted in place of an inspection or an establishment inspection report.

The exception is the Medical Device Single Audit Program. FDA uses reports from MDSAP audits, not the certificate. Canada goes further: Health Canada has accepted only MDSAP certificates for class II, III and IV licences since 1 January 2019.

What investigators have cited

FDA publishes the references cited on device inspections. Of the 404 inspections with posted citations that ended between 2 February and 20 October 2026, 375 cite an ISO 13485 clause and 19 cite 21 CFR 820. The clauses cited most often are 7.1 (124 inspections), 8.5.2 (96), 8.2.2 (91) and 7.4.1 (74). Clause 7.1 is product realization planning, including risk management. Clause 8.5.2 is corrective action. Clause 8.2.2 is complaint handling. Clause 7.4.1 is supplier evaluation and selection.

The full table, with FDA's wording and the caveats about posted citations being a subset, is in the 483 observations post. The inspection search shows the cited references for a single establishment.

Editions and what comes next

ISO 13485:2016 replaced ISO 13485:2003. ISO's catalogue shows the 2016 edition as current after the 2025 review. It lists no revision project.

FDA's preamble expects a future update. It says any new edition would have to be evaluated, and that changing the QMSR would take rulemaking under the Administrative Procedure Act and approval of the new incorporation by reference. FDA takes part in ISO/TC 210, the committee responsible (comment 16). The US rule therefore stays on the 2016 text until FDA amends it.

ISO is developing a guidance document, ISO/TS 23485, on applying ISO 13485:2016. ISO's catalogue lists it as a committee draft, with approval for registration as a draft international standard recorded on 16 July 2026. ISO describes it as guidance that does not add to, subtract from or modify the requirements. ISO gives no publication date.

Not covered here

EU MDR and IVDR conformity assessment, and the use of ISO 13485 by notified bodies, are outside this page. See notified body and EU MDR. Two clauses have their own pages: supplier qualification for clause 7.4 and corrective and preventive action for clause 8.5.