What is ISO 13485? Is it mandatory for medical device compliance?

Reading time 7 mins

As we explored earlier this month, medical device regulations ensure that products are safe, efficient and compliant. Medical devices can help to save lives, so medical device compliance isn’t a choice – and we need to have standards that are accepted globally. The International Organization for Standardization (ISO) develops and publishes international standards, and ISO 13485 is the standard for medical device manufacturing ^[1]:

• ISO 13485:2016 is an international standard which specifies the requirements for quality management systems (QMS) for the design, production, installation, and servicing of medical devices and related services
• Certification to the standard requires an organisation’s QMS to pass a third-party Medical Device Single Audit Program (MDSAP)
• Also used by internal and external parties, such as certification bodies, to help them with their auditing processes
• Certification shows that a management system, manufacturing process, or documentation procedure has all the requirements for standardisation, quality assurance and continual improvement
• It does not define medical device quality
• It demonstrates to regulators that organisations have met the requirements of the standards. This includes documented processes outlining ^[2]:
  – Management responsibility (in terms of commitment, customer focus, planning, risk management, and quality policy)
  – Resource management (e.g. infrastructure, human resources)
  – Product realisation (e.g. planning, design/development, purchasing, equipment controls)
  – Measurement, analysis, improvement

Which then begs the question: If ISO 13485 isn’t in itself a medical device certification, what are the benefits, and is it mandatory to have one for UK medical device compliance?

What are the benefits of having ISO 13485?

In the UK, all medical devices placed on the Great Britain market (England, Wales, and Scotland) must have their products registered with the Medicines and Healthcare products Regulatory Agency (MHRA). One of this agency’s primary functions is to supervise UK Approved Bodies designated by the MHRA to assess whether a medical device manufacturer and their medical devices meet the requirements set out by the UK Medical Devices Regulations. Thus the benefits of ISO 13485 certification ^{[3] [4]}

• It’s the medical device industry’s most widely used standard for quality management
• A QMS is a requirement for meeting MHRA conformity assessment and medical device compliance
• It will help you meet regulatory requirements and conformity assessment audits conducted by UK Approved Bodies
• A robust QMS increases efficiency, cuts costs, and highlights weaknesses in your supply chain’s performance
• Rigorous risk management requirements encourage you to consider the risk associated with a medical device life cycle from conception through to end-of-life disposal
• It outlines how you can improve processes across your organisation and product development
• Having an internationally approved, audited and certified management system makes it easier to place your products on global markets
• It puts essential systems in place (e.g. provisions on how to report adverse events)
• Meeting international standards improves your credibility and helps to meet customer expectations

Can you get UK medical device compliance without ISO 13485?

The short answer: yes

Although the UK MDR and MHRA require an organisation to have an accredited QMS in place to meet medical device compliance, it is not specified or mandated that this be ISO 13485 ^[5].

However, if you intend to place your medical device in other markets, having a QMS that other countries will recognise makes sense. For example, putting your device on the European market will – depending on the type of device – requires you to conform with the EU MDR and have the Conformité Européenne (CE) mark, as opposed to the UK Conformity Assessed (UKCA) mark for Great Britain. The ISO 13485 is an acceptable requirement for both regulatory bodies, which makes for a more logical choice.

Does your QMS meet regulatory and legal requirements for a medical device?

While ISO 13485 isn’t mandatory, it is helpful – not simply for placing your medical device in other markets.

By implementing its requirements, you can save yourself a lot of time further down the line. Because this certification can be costly, some organisations may find it more cost-effective to create their own QMS or use another provider. But bearing in mind that what you’re developing is a medical device that’s intended to help – and not harm – people, you don’t want it to meet the bare minimum regulatory requirements: you want it to exceed them. ISO 13485 is arguably the best route to achieving that.

1. ISO 13485 — Medical devices. (2019, December 18). ISO. https://www.iso.org/iso-13485-medical-devices.html
2. Jardine, J. (2022, June 9). ISO 13485 Requirements: FAQ About the Top Medical Device Quality Management Standard. MasterControl. https://www.mastercontrol.com/gxp-lifeline/iso-13485-requirements-medical-devices/
3. Imam, W. (2017, October 19). MHRA and ISO 13485 – How they fit together. 13485Academy. https://advisera.com/13485academy/blog/2017/10/19/mhra-in-the-uk-what-does-it-do-and-how-can-iso-13485-help/
4. Keen, J. (2022, June 16). ISO 13485 – Medical Devices. RKMS. https://www.rkmsuk.co.uk/consultancy/iso-13485-medical-devices/
5. Davidson, L. (2022, June 29). New UK MHRA Medical Devices Regulations Published. NAMSA. https://namsa.com/uk-mhra-medical-device-regulations-published/