ISO 13485 · Basic · 14 min lesson
Why quality systems exist: medical device history, regulators and the lifecycle
ISO 13485:2016 clauses 4.1, 4.2.5, 7.5.9 and 8.2.2, MDR 2017/745 Articles 10(9) and 15, 21 CFR Part 820
What you will learn
- Explain why medical devices need a quality system and summarise how regulation developed.
- Name the main regulators and roles, and map the product lifecycle to the structure of ISO 13485.
- Tell a weak record from a compliant one and list what an auditor asks to see.
Key takeaways
- Quality systems exist because users cannot judge a device and hidden failures can harm many patients.
- Regulation grew after failures: US amendments of 1976, EU directives, then MDR 2017/745 from 26 May 2021 and IVDR from 26 May 2022.
- The manufacturer is accountable and must run a quality management system (MDR Article 10(9)); notified bodies assess but do not take over responsibility.
- The lifecycle runs from design through production to post market, and maps to ISO 13485 clauses 7.3 to 8.5.
- Records (clause 4.2.5) and traceability (clause 7.5.9) are the proof an auditor can examine.
Free practice question
Corvane Medical receives a complaint that a stem cracked. The quality assistant writes in the file: 'Surgeon called, informed him we are looking into it.' Nothing else is recorded, and no investigation number exists.
What does ISO 13485 expect for this complaint?
A documented complaint record with investigation, a decision on reporting, and links to corrective action where needed.
Correct. Clause 8.2.2 requires complaints to be documented, investigated and evaluated for reporting, with records kept under clause 4.2.5.
Nothing more, because a phone call is enough.
Not quite. Clause 8.2.2 asks for documented handling and records, so a phone call without a file entry is not sufficient.
Only an annual summary in management review.
Not quite. Clause 5.6 uses complaint data as an input, but clause 8.2.2 requires each complaint to be handled and recorded.
A new design validation for every complaint.
Not quite. Clause 7.3.7 design validation is triggered by design needs, and clause 8.2.2 only asks for investigation proportionate to the complaint.
Key terms
- quality management system: The set of processes, procedures, responsibilities and records through which an organisation controls quality (ISO 13485 clause 4).
- manufacturer: The party responsible for the design and manufacture of a device and for placing it on the market under its own name (MDR Article 2).
- notified body: An independent conformity assessment body designated under the MDR to assess manufacturers and certify devices.
- traceability: The ability to follow a device back to its materials and forward to its customers (clause 7.5.9).
- record: A document stating results achieved or providing evidence of activities performed (clause 4.2.5).
- quality control: Checking product or process against specification, such as measurement or inspection.
- quality assurance: Activities that give confidence that the system works, such as procedures, training and audits.
- risk class: The grouping of a device by risk, which decides the route to market (MDR Annex VIII; US classes I to III).
Official sources
- Regulation (EU) 2017/745 on medical devices (EUR-Lex)
- FDA - Quality Management System Regulation (QMSR)
- ISO 13485:2016 Medical devices - Quality management systems
- European Commission - Medical devices, new regulations
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.