ISO 13485:2016 medical device quality management systems

The organization documents a quality management system and keeps it effective as the standard and the applicable regulatory requirements demand, recording the regulatory role or roles it holds (for example manufacturer, authorized representative, importer or distributor). It determines which processes the system needs and how they apply across the organization, taking those roles into account; controls those processes using an approach based on risk; and determines the order in which they run and how they interact. For every process it: determines the criteria and methods needed to run and control it effectively; makes sure the resources and information needed are available; carries out the actions required to reach the planned results; monitors, measures as appropriate and analyses the process; and keeps the records needed to show conformity to the standard and compliance with regulatory requirements. Any change to these processes is assessed for its effect on the quality management system and on the medical devices produced under it, and is controlled. Where the organization outsources a process that affects product conformity, it monitors and controls that process and remains responsible for conformity; the controls are proportionate to the risk and to the outside party's ability to meet requirements, and include written quality agreements. The organization documents procedures for validating software used within the quality management system, applied before first use and after changes, with an approach proportionate to the risk of using the software, and keeps records of the validation.

The documentation of the quality management system includes: documented statements of the quality policy and the quality objectives; a quality manual; the procedures and records that the standard requires to be documented; the documents, records included, that the organization decides it needs to plan, run and control its processes effectively; and any further documentation that applicable regulatory requirements call for.

The organization documents a quality manual. The manual sets out what the quality management system covers, with details of any exclusion or non-application and the reasons for it; includes or refers to the documented procedures; and describes how the processes of the system interact. It also outlines how the system's documentation is structured.

For each type or family of medical device, the organization sets up and keeps one or more files holding, or referring to, the documents produced to show the device conforms to the standard and complies with the regulatory requirements that apply. At a minimum the file content covers: an overall description of the device, what it is intended for, and its labelling, including instructions for use; the product specifications; the specifications or procedures for manufacture, packaging, storage, handling and distribution; the procedures for measuring and monitoring; and, where appropriate, the requirements for installation and the procedures for servicing.

Documents the quality management system requires are controlled, and a documented procedure sets the controls needed to: review and approve documents as adequate before they are issued; review them, bring them up to date where needed and approve them again; identify changes and the current revision status; make the relevant versions of applicable documents available where they are used; keep documents legible and easy to identify; identify the external documents the organization has decided it needs for planning and running the system, and control how they are distributed; prevent documents deteriorating or being lost; and prevent obsolete documents being used by mistake, identifying them suitably. Any change to a document gets its review and approval from the function that first approved it, or from another function designated for the purpose that has access to the relevant background information. The organization sets how long at least one copy of each obsolete controlled document is kept. That period must be at least as long as the device lifetime the organization has defined, must be no shorter than the retention of any record produced from the document, and must satisfy the regulatory requirements that apply.

Records are kept to show that requirements have been met and that the quality management system is operating effectively. A documented procedure sets the controls needed for identifying, storing, securing and keeping the integrity of records, for retrieving them, for how long they are retained and for their disposition. The organization defines and applies ways of protecting confidential health information held in records, in line with the regulatory requirements that apply. Records must stay legible, easy to identify and retrievable, and any change to a record must remain identifiable. The organization keeps records for no less than the device lifetime the organization has defined, or longer where regulatory requirements say so, and in any case for no less than two years after the organization released the device.

Top management provides evidence of its commitment to developing and implementing the quality management system and maintaining its effectiveness by communicating the importance of meeting customer and applicable regulatory requirements, establishing the quality policy, ensuring quality objectives are established, conducting management reviews and ensuring resources are available.

Top management makes sure both the customer's requirements and the regulatory requirements that apply are identified and satisfied.

Top management makes sure the quality policy fits the purpose of the organization; commits the organization to meeting requirements and to keeping the quality management system effective; gives a framework within which quality objectives are set and reviewed; is communicated to, and understood by, people in the organization; and is reviewed so it remains suitable.

Top management makes sure quality objectives are set at the relevant functions and levels of the organization, including the objectives needed to satisfy product requirements and the regulatory requirements that apply. The objectives must be measurable and must be in line with the quality policy.

Top management makes sure the quality management system is planned so that it satisfies the general requirements in 4.1 and the quality objectives, and that the system stays intact when changes to it are planned and made.

Top management makes sure that, across the organization, responsibilities and authorities are set, written down and communicated. It documents how all the people who manage, carry out and verify work that affects quality relate to one another, and makes sure they have the independence and authority their tasks need.

Top management appoints a member of management who, regardless of any other duties, holds the responsibility and authority to: make sure the quality management system's processes are documented; report to top management on how effective the system is and on any improvement needed; and make sure people across the organization are made aware of the applicable requirements, both regulatory and those of the quality management system.

Top management makes sure suitable processes for communication are set up within the organization, and that people communicate about how effective the quality management system is.

The organization has documented procedures for management review. At documented, planned intervals, top management reviews the quality management system to make sure it remains suitable, adequate and effective. The review covers opportunities for improvement and whether the system, the quality policy or the quality objectives need to change. Management review records are kept.

The inputs to management review include, at a minimum, information from: feedback; handling of complaints; reports made to regulatory authorities; audits; monitoring and measuring of processes; monitoring and measuring of product; corrective action; preventive action; follow-up on actions from earlier management reviews; changes that might affect the quality management system; recommendations for improvement; and new or revised regulatory requirements that apply.

The output of management review is recorded. It includes the inputs that were reviewed and any decisions and actions on: improvements needed so that the system, and every process in it, stays suitable, adequate and effective; improving product in relation to customer requirements; changes needed in response to new or revised regulatory requirements that apply; and the resources needed.

The organization identifies and supplies the resources required to put the quality management system in place and keep it effective, and to satisfy customer requirements and the regulatory requirements that apply.

Anyone doing work that affects product quality must be competent, as shown by suitable education, training, skills and experience. For this, the organization documents its processes for building competence, giving the training needed and making people aware. It determines what competence the work affecting product quality requires; provides training, or acts in other ways, to reach or keep that competence; checks whether the action taken worked, using a method in proportion to the risk of the work; makes sure staff understand why their work matters and what it contributes to the quality objectives; and keeps suitable records of staff education, training, skills and experience.

The organization documents what infrastructure it needs to make product conform, to avoid product being mixed up and to keep product handled in an orderly way. Where appropriate, the infrastructure covers buildings, workspace and associated utilities; process equipment, both hardware and software; and supporting services such as transport, communication and information systems. Where maintenance, or a lack of it, could affect product quality, the organization documents maintenance requirements, including how often maintenance is done. Where appropriate, these requirements apply to equipment used in production, to controlling the work environment and to monitoring and measuring. Records of the maintenance are kept.

The organization documents what the work environment must be like for product to conform. If conditions in the work environment could harm product quality, it documents requirements for those conditions and the procedures for monitoring and controlling them. If contact between staff and the product or the work environment could affect how safe the device is or how it performs, it documents requirements for the health, cleanliness and clothing of staff. Anyone who has to work for a time under special environmental conditions must either be competent or work under the supervision of someone who is.

Where appropriate, the organization plans and documents arrangements for controlling product that is, or may be, contaminated, so that it does not contaminate the work environment, staff or other product. Where devices are sterile, the organization documents requirements for controlling contamination by particulate matter or microorganisms, and keeps the necessary level of cleanliness during assembly and packaging.

The organization plans and develops the processes it needs to realize the product, keeping them consistent with the rest of its quality management system processes. It documents one or more risk management processes covering product realization and keeps records of the risk management work done. When planning, it determines as appropriate: the product's requirements and quality objectives; whether product-specific processes, documents and resources are needed, including infrastructure and work environment; the product-specific activities for verification, validation, monitoring, measurement, inspection and testing, handling, storage, distribution and traceability, together with the criteria for accepting the product; and the records needed to show that the product and the realization processes meet requirements. The output of this planning is documented in a way that suits how the organization works.

The organization determines: the requirements the customer has specified, including delivery and post-delivery activities; requirements the customer did not state but which are needed for the specified or intended use, where known; the regulatory requirements that apply to the product; any training users need so the medical device performs as specified and is used safely; and any further requirements the organization itself decides on.

The organization reviews product requirements before committing to supply (tender submission, acceptance of a contract or order, acceptance of a change) and ensures product requirements are defined and documented, differences from those previously expressed are resolved, applicable regulatory requirements are met, any user training identified is available or planned, and the organization can meet the defined requirements. Records of the review and resulting actions are maintained. Where the customer provides no documented statement the requirements are confirmed before acceptance. When product requirements change, relevant documents are amended and relevant personnel informed.

The organization plans and documents how it communicates with customers on product information, enquiries, contracts and handling of orders (amendments included), customer feedback (complaints included) and advisory notices. It communicates with regulatory authorities as the regulatory requirements that apply demand.

The organization documents procedures for design and development. The procedures carry the requirements of 7.3.2 to 7.3.10: how design is planned, how inputs are set and approved, what outputs contain and how they are approved, how reviews, verification, validation and transfer are conducted and recorded, how changes are controlled, and how the design and development file is kept for each device type or family.

The organization plans and controls how the product is designed and developed, and keeps the planning documents up to date as the work moves forward. The planning documents set out the stages of design and development; the reviews each stage needs; the verification, validation and design transfer work suited to each stage; responsibilities and authorities; how design outputs will be traced back to design inputs; and the resources required, including staff competence.

The organization determines and records the design and development inputs that relate to product requirements. These include the functional, performance, usability and safety needs arising from the intended use; applicable regulatory requirements and standards; relevant risk management outputs; information from earlier similar designs where appropriate; and any further requirements essential to designing the product and its processes. The inputs are reviewed for adequacy and approved. Requirements must be complete and unambiguous, must be capable of verification or validation, and must not contradict each other.

Outputs of design and development must satisfy the input requirements; give suitable information for purchasing, for production and for service provision; include or refer to the criteria for accepting the product; and set out the product characteristics that are essential to using it safely and properly. The outputs must be in a form that allows them to be checked against the inputs, must be approved before they are released, and are kept as records.

At suitable stages, systematic reviews of the design and development are performed according to planned and documented arrangements to evaluate the ability of the results to meet requirements and to identify and propose necessary actions. Participants include representatives of the functions concerned with the stage under review and other specialist personnel. Records of the reviews and actions include the identification of the design reviewed, the participants and the date.

Verification of design and development follows planned, documented arrangements and confirms that the outputs satisfy the input requirements. The organization documents verification plans setting out the methods, the acceptance criteria and, where appropriate, statistical techniques together with the reasoning behind the sample size. If the intended use means the device must connect or interface with other devices, verification must show the outputs meet the inputs in that connected state. Records are kept of verification results, conclusions and any actions needed.

Validation of design and development follows planned, documented arrangements and confirms that the finished product can satisfy what its intended use or specified application demands. The organization documents validation plans giving methods, acceptance criteria and, where appropriate, statistical techniques with the reasoning for the sample size. Validation is done on representative product, such as initial production units or batches or their equivalents, and the reasons for that choice are recorded. Clinical or performance evaluations of the device form part of validation, carried out as the relevant regulatory requirements demand; a device supplied for such an evaluation does not count as released to the customer. Where the intended use needs the device to connect or interface with other devices, validation must show the requirements are satisfied in that connected state. Validation must be finished before the product is released to the customer for use, and records of its results, conclusions and any actions are kept.

The organization has documented procedures for handing design and development outputs over to manufacturing. These procedures make sure the outputs are checked as fit for manufacture before they become the final production specifications, and that the production capability can achieve the product requirements. The results of the transfer and the conclusions drawn from it are recorded.

Changes to design and development are controlled through documented procedures. For each change the organization judges how significant it is for the device and its intended use, looking at function, performance, usability, safety and the regulatory requirements that apply. Every change is identified, then reviewed, verified, validated where appropriate and approved before it is put into effect. The review of a change weighs its effect on constituent parts, on product being made or already delivered, on the inputs and outputs of risk management, and on the processes used to realize the product. The organization keeps records of each change, of its review and of any actions the review found necessary.

For every medical device type or family, the organization keeps a design and development file. The file holds, or points to, the records produced to show the design and development requirements were met, together with the records of any changes made to the design.

The organization has documented procedures that make sure what it buys conforms to the purchasing information it has specified. It sets criteria for evaluating and choosing suppliers that take into account whether the supplier can deliver product meeting the organization's requirements, how the supplier has performed, how the bought product affects the quality of the medical device, and the risk the device carries, in proportion. Monitoring and re-evaluation of suppliers are planned; supplier performance is monitored against the purchasing requirements, and the results feed the re-evaluation. Where a supplier fails to meet requirements, the organization takes it up with the supplier in proportion to the risk the purchased product carries and to its effect on regulatory compliance. Records are kept of supplier evaluation, selection, monitoring and re-evaluation and of any actions that result.

Purchasing information describes, or refers to, what is being bought. Where appropriate it covers product specifications; requirements for accepting the product, and for the procedures, processes and equipment involved; requirements for qualifying the supplier's staff; and quality management system requirements. Before passing purchasing requirements to a supplier, the organization makes sure they are adequate. Where applicable, the purchasing information includes a written agreement under which the supplier tells the organization about changes to the purchased product before making any change that affects whether the product still meets the purchase requirements. As far as traceability needs, the relevant purchasing information is kept as documents and records.

The organization sets up and carries out the inspection or other activities required to make sure what it buys meets the purchasing requirements. How much verification is done depends on the results of supplier evaluation and is proportionate to the risk the purchased product carries. When it learns of a change to purchased product, the organization decides whether the change has any effect on the device or on how the product is realized. If the organization, or its customer, plans to carry out verification at the supplier's site, the purchasing information states what verification is planned and how the product will be released. Records of verification are kept.

The organization plans, performs, monitors and controls production and service provision so as to make sure the product meets its specification. Where appropriate, the controls include: documented procedures and methods for controlling production; qualification of infrastructure; monitoring and measuring of product characteristics and process parameters; having monitoring and measuring equipment available and using it; defined operations for labelling and packaging; and carrying out product release, delivery and activities after delivery. For each medical device or batch, the organization sets up and keeps a record that gives traceability to the degree 7.5.9 requires and shows how many units were made and how many were approved for distribution; the record is verified and approved.

The organization documents requirements for product cleanliness or for controlling product contamination in five situations: it cleans the product itself before sterilization or use; the product is supplied non-sterile to be cleaned before sterilization or use; the product cannot be cleaned before sterilization or use but its cleanliness matters in use; the product is supplied for non-sterile use and its cleanliness matters in use; or process agents must be removed from the product during manufacture. In the first two situations, where the product is cleaned before sterilization or use, the 6.4.1 work environment requirements do not apply ahead of the cleaning step.

Where appropriate, the organization documents the requirements for installing the medical device and the criteria for accepting that installation has been verified. If the agreed customer requirements let an outside party, not the organization and not its supplier, install the device, the organization supplies documented requirements for installing and verifying the device. Records are kept of installation and verification work done by the organization or by its supplier.

If the device must be serviced as a specified requirement, the organization documents the procedures for servicing, together with the reference measurements and reference materials needed to carry out the servicing and to confirm the product still meets its requirements. Servicing records, whether the work was done in house or by a supplier, are analysed to decide whether any of the information should be treated as a complaint and, where appropriate, used as an input to improvement. Servicing records are kept.

For every sterilization batch, the organization records the parameters of the sterilization process applied, and these records can be traced back to each batch of medical devices produced.

Where the output of a production or service process is not or cannot be checked by later monitoring or measuring, which means faults would surface only after the product is being used or the service is complete, that process has to be validated. Validation must show the process can consistently deliver the planned results. The documented validation procedures cover: the criteria for reviewing and approving the process; qualification of equipment and of personnel; the particular methods, procedures and acceptance criteria to be used; where appropriate, statistical techniques with the reasoning for the sample size; what records are required; revalidation and the criteria that trigger it; and approval of changes to the process. The organization also documents procedures for validating the software used when producing product or providing services, applied before first use and after changes, in proportion to the risk, including the effect on product conformity. Records of validation results, conclusions and any actions are kept.

The organization has documented procedures for validating sterilization processes and sterile barrier system processes. Validation is carried out before these processes are first used and, where appropriate, again after changes to the product or the process. Records of the validation results, conclusions and any actions are kept.

The organization has documented procedures for identifying product, and identifies product by appropriate means from start to finish of product realization. Throughout production, storage, installation and servicing, it identifies where product stands against its monitoring and measurement requirements, so that product is dispatched, used or installed only when it has passed the inspections and tests required or has been released under an authorized concession. When regulatory requirements call for it, the organization documents a system for giving the medical device its unique device identification. It also documents procedures that keep returned medical devices identified and separate from product that conforms.

The organization has documented traceability procedures. They set how far traceability must reach, in line with the regulatory requirements that apply, and which records must be kept for it.

For implantable devices, the traceability records cover the components and materials used, and the conditions of the work environment, wherever any of these could lead the device to fall short of its specified safety or performance. Distributors and suppliers of distribution services are required by the organization to keep distribution records that permit traceability, and to produce those records when an inspection calls for them. The name and address of whoever receives each shipping package are kept on record.

As long as the organization holds or uses customer property, the organization identifies, verifies, protects and safeguards any such property supplied to be used in the product or built into it. When customer property is lost or damaged, or proves unfit for use, the organization tells the customer and keeps records of what happened.

The organization has documented procedures for keeping product conforming while it is processed, stored, handled and distributed, and extends this preservation to each constituent part of the device. It guards product against alteration, contamination or damage from the conditions and hazards it can be expected to meet during those stages, by designing and building suitable packaging and shipping containers, and by documenting requirements for any special conditions needed where packaging on its own cannot preserve the product. Any special conditions required are controlled and recorded.

The organization decides what monitoring and measuring must be done, and what equipment is needed, to give evidence that product conforms, and documents procedures so that monitoring and measuring can be, and actually are, done in a way consistent with the requirements. Where valid results depend on it, measuring equipment is: calibrated or verified, or both, at set intervals or before use, against measurement standards that trace back to national or international standards (if none exist, whatever basis is used for calibration or verification is recorded); adjusted or re-adjusted as needed, with each adjustment recorded; identified so its calibration status can be seen; protected from adjustments that would invalidate the results; and protected from damage and deterioration. Calibration and verification are done according to documented procedures. If equipment turns out not to conform, the organization assesses and records whether earlier measurement results are still valid, and acts on the equipment and on any product affected. Records of calibration and verification are kept. The organization also documents procedures for validating software used in monitoring and measuring, applied before first use and after any change, in proportion to the risk, including the effect on product conformity, and keeps records of the validation results, conclusions and actions.

The organization plans and carries out the monitoring, measuring, analysis and improvement it needs in order to show product conforms, to make sure the quality management system conforms and to keep the system effective. This includes deciding which methods are suitable, statistical techniques among them, and how far they are used.

The organization gathers and monitors information on whether it has satisfied customer requirements, as one of the measures of how effective the quality management system is, and documents the methods used to obtain and use that information. It documents procedures for a feedback process that collects data from production and from post-production activities. The information gathered through feedback serves as a possible input to risk management, for monitoring and keeping product requirements current, and to the product realization and improvement processes. If regulatory requirements call for the organization to gain particular experience from post-production activities, reviewing that experience is part of the feedback process.

The organization has documented procedures for handling complaints promptly, as the regulatory requirements that apply demand. At a minimum these procedures set the requirements and responsibilities for: receiving and recording information; deciding whether a piece of feedback counts as a complaint; investigating complaints; deciding whether the information needs to be reported to the appropriate regulatory authorities; handling product connected to a complaint; and deciding whether corrections or corrective actions must be started. If a complaint is not investigated, the reason is documented, and any correction or corrective action that comes out of complaint handling is documented. If an investigation shows that activities outside the organization played a part, the relevant information is shared with the outside party involved. Records of complaint handling are kept.

If the applicable regulatory requirements call for the organization to notify complaints meeting set reporting criteria for adverse events, or to issue advisory notices, the organization documents procedures for notifying the relevant regulatory authorities. Records of such reporting are kept.

At planned intervals, the organization carries out internal audits to establish whether the quality management system meets the planned and documented arrangements, the requirements of the standard, the requirements the organization has set for its own system, and the applicable regulatory requirements, and whether it is implemented and maintained effectively. A documented procedure sets out who is responsible for planning and carrying out audits and for recording and reporting their results, and what those activities involve. The audit programme is planned taking into account how important and how sound the processes and areas to be audited are, and what earlier audits found. The criteria, scope, frequency and methods of each audit are defined and recorded. Auditors are chosen, and audits are carried out, in a way that keeps the audit process objective and impartial, and no auditor audits their own work. Audit records and results are kept, and they identify which processes and areas were audited and what was concluded. The management responsible for the area audited makes sure any corrections and corrective actions needed are taken promptly, and follow-up activities check the actions taken and report the results of that check.

The organization uses suitable methods to monitor each process in the quality management system and, where appropriate, to measure it. The methods must show whether each process can reach its planned results. Where a process falls short of its planned results, correction and corrective action are taken as appropriate.

The organization monitors and measures the characteristics of the product to confirm product requirements are met. This is done at the relevant stages of product realization, following planned, documented arrangements and documented procedures. Evidence that the acceptance criteria were met is kept. The person who authorized release of the product is identified in the records, and where appropriate the records identify the test equipment used for the measurement activities. Product is not released and services are not delivered until the planned arrangements have been completed satisfactorily. For implantable medical devices, the organization records who carried out each inspection or test.

The organization makes sure product that fails to meet requirements is identified and controlled so it is not used or delivered by mistake. A documented procedure sets the controls, and the responsibilities and authorities, for identifying, documenting, segregating, evaluating and disposing of nonconforming product. Evaluating a nonconformity includes deciding whether an investigation is needed and whether any outside party responsible for the nonconformity must be told. Records are kept of what each nonconformity was and of the action taken afterwards, covering the evaluation, any investigation and the reasons behind the decisions made.

The organization handles nonconforming product in one or more of these ways: acting to remove the nonconformity found; acting to stop the product being used or applied as originally intended; or authorizing it to be used, released or accepted under concession. Product that does not conform may be accepted under concession only when a justification is given, approval is obtained and the regulatory requirements that apply are satisfied. Records are kept of each concession and of who authorized it.

If nonconforming product is found after it has been delivered, or after use has begun, the organization takes action suited to the effects, actual or potential, of the nonconformity, and keeps records of that action. The organization documents procedures for issuing advisory notices as the regulatory requirements that apply demand; these procedures can be put into operation at any time. Records are kept of actions connected with advisory notices.

Rework is done under documented procedures that consider any harm the rework could do to the product. Those rework procedures are reviewed and approved in just the way the original procedure was. Once rework is finished, the product is checked to confirm it satisfies the acceptance criteria and regulatory requirements that apply. Records of rework are kept.

The organization has documented procedures for deciding on, gathering and analysing the data needed to show the quality management system is suitable, adequate and effective. These procedures include choosing suitable methods, including statistical techniques, and deciding how far to use them. The analysis covers data produced by monitoring and measuring and by other relevant sources, and at a minimum includes input from: feedback; conformity to product requirements; how processes and product are trending and what their characteristics are, improvement opportunities included; suppliers; audits; and service reports where appropriate. Where analysis reveals that the system falls short of being suitable, adequate or effective, the organization uses that analysis as an input to improvement as 8.5 requires. The results of each analysis are kept as records.

The organization identifies and makes whatever changes are needed so that the quality management system stays suitable, adequate and effective and the medical device stays safe and performs as it should. It draws on the quality policy, the quality objectives, the results of audits, post-market surveillance, data analysis, corrective and preventive actions, and management review to do so.

The organization acts to remove the causes of nonconformities so they do not happen again. It does this promptly and in proportion to the effects of the nonconformities found. A documented procedure sets the requirements for: reviewing nonconformities, complaints included; finding what caused them; deciding whether action is needed so they do not recur; planning, documenting and carrying out the action required, updating documentation where appropriate; checking that the action does not harm regulatory compliance or the device's safety and performance; and reviewing whether the corrective action worked. Records are kept of investigation results and of the action taken.

The organization identifies action to remove the causes of nonconformities that could occur, so they do not happen, in proportion to the effects the possible problems would have. A documented procedure sets the requirements for: identifying possible nonconformities and what causes them; deciding whether action is needed to stop them happening; planning, documenting and carrying out the action required, updating documentation where appropriate; checking that the action does not harm regulatory compliance or the device's safety and performance; and, where appropriate, reviewing whether the preventive action worked. Records are kept of any investigation and of the action taken.