Skip to content
Audit-Checklist

MedTech QMS · ISO Standards

ISO 13485: medical device QMS, design controls, and why 9001 is not enough

How MedTech teams implement ISO 13485:2016 — design and development, suppliers, and the records auditors and regulators expect.

6 min read

ISO 13485 is a quality management system standard for medical devices. It keeps the ISO management-system discipline but adds device-specific expectations for regulatory requirements, design and development, risk management, production, traceability, complaints, and corrective action.

The checklist helps execute the QMS, but the guide addresses the judgment. Medical device teams must decide what the device is, which regulatory markets matter, which processes affect safety and performance, and how design, suppliers, software, and post-market signals connect.

In 2026, SaMD, connected devices, AI-enabled features, outsourced manufacturing, and cloud infrastructure make ISO 13485 more cross-functional than a traditional quality binder. Engineering, clinical, regulatory, security, suppliers, and support all create QMS evidence. For ISO 13485, the guide should keep every quality record connected to patient or user risk. Design inputs should link to user needs and regulatory requirements; outputs should link to verification; validation should show intended use; risk controls should appear in design, labeling, production, and post-market monitoring. Suppliers deserve the same risk-based treatment. A cloud provider for SaMD, a sterilization vendor, a critical component maker, or outsourced complaint handler can affect safety and compliance even if they never appear in the final device label. The paired checklist should help teams trace one requirement, one design change, one supplier issue, and one complaint through the QMS without inventing records after the fact. A useful way to read the rest of this guide is to separate evidence from judgment. Evidence shows that an activity happened: a review, record, test, approval, training, scan, exercise, assessment, or decision. Judgment explains why the activity was scoped that way, why the risk treatment is proportionate, why an exception is acceptable, and what would cause the decision to change. The paired checklist should collect evidence and owners, while the guide should help teams avoid false certainty. For each topic, ask what a knowledgeable reviewer would challenge after seeing the first answer. They may ask whether the scope matches production, whether suppliers are included, whether recurring work is current, whether leadership approved trade-offs, and whether public or customer-facing claims match operations. That second layer is where preparation becomes credible. It also keeps teams from overclaiming, because a documented limitation with a plan is usually stronger than a broad statement no one can support. Keep a dated rationale beside the evidence so reviewers can see what changed, who approved the interpretation, and which operating signal would trigger a fresh review. Keep the reviewer-facing story specific enough that another team can repeat the analysis without guessing.

What ISO 13485 actually is

ISO 13485 defines QMS requirements for organizations involved in one or more stages of the medical device lifecycle. It is not ISO 9001 with a device logo. It is designed for regulated products where patient safety, effectiveness, traceability, and regulatory obligations shape quality work.

Design controls are central for many organizations. User needs, design inputs, design outputs, verification, validation, risk management, design transfer, and design changes need traceability. Agile delivery can work, but it must produce controlled records.

The QMS also covers purchasing, production, servicing, monitoring and measurement, complaints, nonconforming product, CAPA, records, competence, and infrastructure. Critical suppliers and outsourced processes need controls proportionate to product risk.

Decisions the checklist will not make for you

The checklist cannot decide regulatory strategy. Market, device classification, intended use, claims, clinical evidence, software role, and post-market obligations require regulatory leadership and, often, jurisdiction-specific expertise.

It also cannot define design validation. Teams must decide how to show the device meets user needs and intended use under expected conditions. Verification proves outputs meet inputs; validation proves the right product was built for users and use environments.

The checklist cannot classify supplier criticality by itself. Cloud hosting, sterilization, manufacturing, components, outsourced software, labeling, logistics, and calibration can all affect safety, performance, or regulatory compliance.

Where medical device teams actually fail

The first failure is treating ISO 13485 like ISO 9001 with extra labels. Generic quality procedures miss design history, device files, regulatory requirements, risk management links, traceability, and complaint handling expected in device audits.

Design validation is often thin. Teams show test cases, usability notes, or customer demos but cannot prove validation against intended use, users, patient context, or clinical workflow. Missing validation can undermine the whole design-control story.

Complaints are sometimes kept separate from CAPA. Support labels an issue as a complaint but never evaluates trends, reportability, investigation depth, risk impact, or corrective action. Critical suppliers are also left outside purchasing controls until an auditor samples them.

How to use the paired checklist

Use the checklist to connect product lifecycle records instead of collecting documents in isolation. Link intended use, requirements, risk controls, verification, validation, design changes, supplier controls, complaints, CAPA, and release records.

Attach evidence by process owner. Quality, regulatory, engineering, clinical, manufacturing, support, and supplier management should each provide records that reflect actual work, not a quality team reconstruction after the fact.

Before audit, trace a few product changes and complaints end to end. The paired checklist should help prove that signals from design, production, users, and suppliers feed risk management and improvement.

What teams get wrong

ISO 9001 readiness means ISO 13485 readiness.
ISO 13485 has device-specific requirements for regulatory obligations, design controls, risk management, traceability, complaints, suppliers, and records.
Verification and validation are interchangeable.
Verification checks design outputs against inputs. Validation checks that the device meets user needs and intended use in expected conditions.
Complaints are just support tickets.
Complaints require evaluation, investigation, trend review, reportability consideration, CAPA linkage, and controlled records where applicable.

When the checklist is enough — and when it is not

  • Use the checklist to organize QMS processes, design records, supplier controls, complaints, CAPA, and audit evidence.
  • Ask a notified body, registrar, regulatory consultant, or quality expert when scope, design validation, supplier criticality, or audit readiness is unclear.
  • Ask counsel when product claims, regulatory submissions, adverse events, market access, liability, or customer commitments are involved.
  • Treat this guide as practical orientation, not official ISO or regulatory text; use the licensed standard and applicable device regulations for authoritative requirements.

Related checklists

Related field notes

The checklists and field notes provided on this website are for educational and informational purposes only. They do not constitute legal, financial, or professional advice. Completing a checklist does not guarantee compliance, certification, or immunity from audits. Always consult with a certified auditor or legal counsel for your specific organizational needs. Full disclaimer