ISO 13485:2016 Requirements Breakdown

This document provides a comprehensive breakdown of ISO 13485:2016 requirements for medical device Quality Management Systems (QMS).

Table of Contents

1. Clause 4: Quality Management System
2. Clause 5: Management Responsibility
3. Clause 6: Resource Management
4. Clause 7: Product Realization
5. Clause 8: Measurement, Analysis and Improvement

Clause 4: Quality Management System

4.1 General Requirements

4.1.1 QMS Requirements

• Establish, document, implement, and maintain a QMS
• Maintain its effectiveness in accordance with ISO 13485
• Document the QMS processes and their interactions

4.1.2 Process Approach

• Identify processes needed for the QMS
• Determine sequence and interaction of these processes
• Determine criteria and methods for effective operation and control
• Ensure availability of resources and information
• Monitor, measure, and analyze processes
• Implement actions to achieve planned results and maintain effectiveness

4.1.3 Outsourced Processes

• Control any QMS process that is outsourced
• Ensure control is documented in the QMS
• Outsourcing does not relieve the organization of responsibility

4.1.4 General QMS Requirements

• Establish, document, implement, and maintain QMS requirements per ISO 13485
• Include requirements for medical devices and applicable regulatory requirements
• Establish documented procedures for QMS activities

4.1.5 Risk Management

• Establish documented requirements for risk management in product realization
• Maintain risk management records
• Ensure risk management is conducted according to documented requirements

4.1.6 Software Validation

• Validate computer software applications used in QMS
• Validation must be conducted prior to initial use and after changes
• Establish documented approach including:
  • Risk associated with the software application
  • Validation activities
  • Acceptance criteria
  • User responsibilities
  • Validation records

4.2 Documentation Requirements

4.2.1 General Documentation

QMS documentation must include:

• Quality policy and quality objectives
• Quality manual
• Documented procedures and records required by ISO 13485
• Documents required by organization for effective processes
• Records required by ISO 13485
• Medical device files as required by applicable regulatory requirements

4.2.2 Quality Manual

Establish and maintain a quality manual that includes:

• Scope of the QMS with details and justification for exclusions
• Documented procedures or reference to them
• Description of interaction between QMS processes
• Structure of documentation used in the QMS

4.2.3 Medical Device File

Establish and maintain a medical device file for each type or family that includes:

• General description, intended use/purpose
• Label and instructions for use specifications
• Specifications for product and/or manufacturing
• Specifications for procedures for purchasing, manufacturing, servicing
• Procedures for measuring and monitoring
• Installation requirements (if applicable)
• Risk management file(s)
• Verification and validation information
• Design and development file(s) when applicable

4.2.4 Control of Documents

Establish documented procedure to:

• Approve documents before issue
• Review, update, and re-approve documents
• Ensure changes and current revision status are identified
• Ensure relevant versions are available at points of use
• Ensure documents remain legible and readily identifiable
• Control distribution of documents
• Prevent unintended use of obsolete documents
• Apply suitable identification if retained for any purpose

Document changes must:

• Be reviewed and approved by original function unless otherwise designated
• Have access to pertinent background information
• Be identified in the document or appropriate attachments

4.2.5 Control of Records

Establish documented procedure for:

• Identification, storage, security, integrity, retrieval, retention time, and disposition
• Records must remain legible, readily identifiable, and retrievable
• Changes to records must remain identifiable
• Retention time must be at least the lifetime of the medical device
• Records may be stored on any media but must remain retrievable

Clause 5: Management Responsibility

5.1 Management Commitment

Top management must provide evidence of commitment by:

• Communicating importance of meeting regulatory and customer requirements
• Establishing quality policy
• Establishing quality objectives
• Conducting management reviews
• Ensuring availability of resources

5.2 Customer Focus

• Determine customer requirements and regulatory requirements
• Ensure customer requirements are met to enhance satisfaction
• Maintain documented requirements related to the medical device

5.3 Quality Policy

• Appropriate to the organization
• Includes commitment to meet requirements and maintain QMS effectiveness
• Provides framework for quality objectives
• Communicated and understood within organization
• Reviewed for continuing suitability

5.4 Planning

5.4.1 Quality Objectives

• Establish quality objectives at relevant functions and levels
• Must be measurable and consistent with quality policy
• Objectives must support conformity to product requirements

5.4.2 QMS Planning

• Plan to meet general requirements and quality objectives
• Maintain QMS integrity when changes are planned and implemented
• Document planning

5.5 Responsibility, Authority and Communication

5.5.1 Responsibility and Authority

• Define and communicate responsibilities and authorities
• Document roles that manage, perform, verify QMS work
• Identify interrelation of all personnel

5.5.2 Management Representative

Appoint a member of management who:

• Ensures QMS processes are established, implemented, and maintained
• Reports to top management on QMS performance and improvement needs
• Ensures promotion of awareness of regulatory and customer requirements

5.5.3 Internal Communication

• Ensure communication processes are established
• Ensure communication occurs regarding QMS effectiveness

5.6 Management Review

5.6.1 General

• Review QMS at planned intervals (at least annually)
• Review to ensure continuing suitability, adequacy, and effectiveness
• Include assessment of opportunities for improvement
• Maintain records of management reviews

5.6.2 Review Input

Include:

• Results of audits
• Customer feedback
• Process performance and product conformity
• Status of preventive and corrective actions
• Follow-up actions from previous reviews
• Changes affecting QMS
• Recommendations for improvement
• Applicable new or revised regulatory requirements

5.6.3 Review Output

Include decisions and actions related to:

• Improvements to QMS effectiveness and processes
• Product improvements related to customer requirements
• Resource needs
• Changes necessary to maintain QMS effectiveness

Clause 6: Resource Management

6.1 Provision of Resources

Determine and provide resources needed to:

• Implement and maintain QMS and its effectiveness
• Meet regulatory and customer requirements

6.2 Human Resources

6.2 General

Personnel performing work affecting product quality must be competent based on:

• Education, training, skills, and experience
• Documented evidence of competence

6.3 Infrastructure

Determine, provide, and maintain infrastructure including:

• Buildings, workspace, and associated utilities
• Process equipment (hardware and software)
• Supporting services

Infrastructure maintenance requirements:

• Document requirements including maintenance activities
• Document requirements when maintenance can affect product quality
• Maintain records of maintenance activities

6.4 Work Environment and Contamination Control

6.4.1 Work Environment

• Determine and manage work environment needed for product conformity
• Document requirements for work environment
• Document requirements if work environment can adversely affect product quality

6.4.2 Contamination Control

• When applicable to medical device, document requirements for control of contaminated or potentially contaminated product
• Establish special arrangements for control of contaminated product

Clause 7: Product Realization

7.1 Planning of Product Realization

Plan and develop processes needed for product realization including:

• Quality objectives and requirements for the product
• Need to establish processes, documentation, and resources
• Required verification, validation, monitoring, measurement, inspection, handling, storage, distribution, and traceability
• Records to provide evidence of conformity

Risk management requirements:

• Establish documented requirements for risk management throughout product realization
• Maintain risk management records

7.2 Customer-Related Processes

7.2.1 Determination of Requirements

Determine:

• Requirements specified by customer including delivery and post-delivery
• Requirements not stated but necessary for specified or intended use
• Applicable regulatory requirements
• Any additional requirements determined by organization

7.2.2 Review of Requirements

• Review product requirements before commitment
• Ensure requirements are defined and documented
• Ensure differences are resolved
• Ensure ability to meet requirements
• Maintain records of review results and follow-up actions

7.2.3 Communication

Establish and document effective arrangements for communication with customers concerning:

• Product information
• Inquiry, contract or order handling, amendments
• Customer feedback including complaints
• Advisory notices

7.3 Design and Development

7.3.1 General

• Establish, document, and maintain design and development procedures
• Document design and development plan for each medical device
• Maintain design and development files

7.3.2 Design and Development Planning

Plan and control design and development including:

• Stages of design and development
• Required review, verification, and validation activities
• Responsibilities and authorities
• Resources and interfaces
• Update plans as design progresses
• Document plans

7.3.3 Design and Development Inputs

• Determine inputs relating to product requirements
• Include functional, performance, usability, and safety requirements
• Include applicable regulatory requirements and standards
• Include applicable outputs of risk management
• Include appropriate information from previous similar designs
• Review inputs for adequacy and completeness
• Resolve incomplete, ambiguous, or conflicting requirements
• Maintain records

7.3.4 Design and Development Outputs

Provide outputs that:

• Meet design input requirements
• Provide appropriate information for purchasing, production, and service
• Contain or reference product acceptance criteria
• Specify characteristics essential for safe and proper use
• Document outputs and maintain as records

7.3.5 Design and Development Review

• Conduct systematic reviews at suitable stages
• Evaluate ability to meet requirements
• Identify problems and propose actions
• Include representatives of functions concerned
• Maintain records including results and follow-up actions

7.3.6 Design and Development Verification

• Perform verification per planned arrangements
• Ensure outputs meet input requirements
• Maintain records of verification results and follow-up actions

7.3.7 Design and Development Validation

• Perform validation per planned arrangements
• Ensure product meets specified application or intended use
• Conduct validation before delivery or implementation
• Include validation under defined operating conditions
• Maintain records of validation results and follow-up actions

7.3.8 Design and Development Transfer

• Document procedures for transfer to manufacturing
• Verify manufacturing output meets design output
• Ensure specification for materials, production, QC, servicing are appropriate
• Maintain records

7.3.9 Control of Design and Development Changes

• Identify, document, and control changes
• Review, verify, validate, and approve changes before implementation
• Evaluate effects on constituent parts, in-process product, and delivered product
• Maintain records of changes, review results, and follow-up actions

7.3.10 Design and Development Files

Establish and maintain design and development files for each type or family including:

• Design and development plan
• Design inputs
• Design outputs
• Design review, verification, validation records
• Design change records
• Risk management file

7.4 Purchasing

7.4.1 Purchasing Process

• Ensure purchased product conforms to purchase information
• Establish documented processes for purchasing activities
• Establish criteria for evaluation and selection of suppliers
• Base criteria on ability to supply per organization's requirements
• Monitor supplier performance
• Maintain records of evaluations and follow-up actions
• Establish process for notifying suppliers of changed product requirements

7.4.2 Purchasing Information

Purchasing information must include:

• Requirements for approval of product, procedures, processes, equipment
• Requirements for qualification of personnel
• Quality management system requirements
• Requirements for notification to organization of nonconforming product
• Agreement that suppliers provide notification of changes to purchased product
• Agreement that purchase information be communicated to sub-tier suppliers

7.4.3 Verification of Purchased Product

• Establish and implement inspection or other activities to ensure conformity
• Document extent of verification
• Verify at supplier's premises when customer intends to perform verification at supplier
• Document verification arrangements and method of product release

7.5 Production and Service Provision

7.5.1 Control of Production and Service Provision

Plan and carry out production under controlled conditions including:

• Availability of documented procedures and work instructions
• Availability of suitable infrastructure and work environment
• Availability of monitoring and measuring equipment
• Availability and use of suitable monitoring and measuring activities
• Implementation of product release, delivery, and post-delivery activities
• Implementation of defined operations for labelling and packaging
• Procedures for servicing if applicable

Document requirements for:

• Control of product cleanliness if applicable
• Control during installation and verification if applicable

7.5.2 Cleanliness of Product

Document requirements if:

• Product is cleaned per specified req