ISO 9001 is a broad quality management standard that provides a strong foundation for ISO 13485, the internationally recognized Quality Management System (QMS) standard specifically developed for the medical device industry. Although both standards aim to ensure consistent quality and effectiveness, ISO 13485 includes additional requirements and modifications designed to address the regulatory, safety, and performance requirements associated with medical devices.

For more information, visit the Comparing ISO 9001 and ISO 13485 Quality Management Standards guide.

Part 1: Similarities Between ISO 9001 and ISO 13485

ISO 9001 and ISO 13485 share a similar foundation and both establish requirements for implementing a comprehensive Quality Management System (QMS).

Shared QMS FoundationISO 9001:2015 vs. ISO 13485:2016Process ApproachBoth standards use a process-based approach as the foundation for managing and controlling quality.Management ResponsibilitiesBoth require top management to demonstrate commitment to the QMS, including establishing quality policies and objectives.QMS PlanningBoth require organizations to plan their processes and improvements while maintaining the integrity and effectiveness of the QMS.Resource ManagementBoth standards require organizations to identify and provide appropriate resources, including competent and trained personnel, infrastructure, facilities, and process equipment.Operation/RealizationBoth address customer-related processes, design and development (Section 7.3 in ISO 13485 and Section 8.3 in ISO 9001), as well as the control of externally provided products and services.ImprovementBoth emphasize measurement, analysis, and improvement activities. They also include requirements for corrective action (CA) to address nonconformities and help prevent their recurrence.

Part 2: Key Differences and ISO 13485-Specific Requirements

ISO 13485 is a sector-specific standard intended for organizations involved in one or more stages of the medical device life cycle. ISO 9001, on the other hand, applies broadly across industries and places greater emphasis on customer satisfaction and continual improvement.

ISO 13485 gives greater priority to meeting applicable regulatory requirements and ensuring the safety and performance of medical devices.

ISO 13485-Specific RequirementKey FocusCorresponding ISO 9001 Clause StatusRegulatory RequirementsOrganizations must identify their roles within the applicable regulatory framework and incorporate the relevant requirements into their QMS. Regulatory compliance is a primary objective.ISO 9001 addresses statutory and regulatory requirements in general but does not have the same medical device-specific focus on safety and regulatory compliance.Risk ManagementRequires a risk-based approach to controlling relevant QMS processes, with risk specifically connected to the safety and performance of the medical device.ISO 9001 uses general risk-based thinking to address risks and opportunities across the organization.Documentation and RecordsRequires organizations to establish and maintain one or more Medical Device Files for each device type or family. These files may include product descriptions, specifications, manufacturing information, packaging, and servicing procedures. Requirements also address the protection of confidential health information.ISO 9001 requires documented information and records but does not have an equivalent requirement for a Medical Device File.Record RetentionRecords must generally be retained for at least the lifetime of the medical device as defined by the organization, and for no less than two years from the date of device release.ISO 9001 requires organizations to retain documented information necessary to support process operation and demonstrate conformity.Outsourced ProcessesRequires specific controls for outsourced processes, including written quality agreements where appropriate, with controls based on the level of risk involved.ISO 9001 covers the control of externally provided processes, products, and services but does not specifically require a written quality agreement.Special ProcessesIncludes requirements that are specific to medical devices, such as product cleanliness (7.5.2), installation activities (7.5.3), servicing activities (7.5.4), and specific requirements for sterile medical devices (7.5.5 and 7.5.7).ISO 9001:2015 does not contain equivalent medical device-specific requirements.Post-Delivery ActivitiesRequires documented processes for timely complaint handling (8.2.2), reporting adverse events and issuing advisory notices to regulatory authorities (8.2.3), and establishing traceability requirements for implantable medical devices (7.5.9.2).ISO 9001 addresses customer feedback and post-delivery activities more generally.

Part 3: Transitioning from ISO 9001 to ISO 13485

Organizations that are already certified to ISO 9001 have a significant advantage when moving toward ISO 13485 because many fundamental QMS elements are already established. These may include the process approach, management responsibilities, planning, resources, infrastructure, and quality controls.

However, transitioning from ISO 9001 to ISO 13485 requires the organization to adapt its existing QMS to meet the more specialized and regulatory-focused requirements of the medical device industry.

Key Areas That Need Adaptation

1. Define the Regulatory Context

The organization should first identify and document its role or roles within the medical device life cycle, such as manufacturer, distributor, or service provider. It must then determine the regulatory requirements that apply to its activities and target markets.

2. Integrate Risk Management with a Safety Focus

The existing risk-management approach should be adapted to focus specifically on the safety and performance of medical devices. Risk-management activities should be incorporated throughout the product realization process.

3. Strengthen Documentation

Organizations need to develop and maintain industry-specific documentation, particularly a Medical Device File for each device type or family. Records must also meet the required retention periods, including the device lifetime and the minimum two-year requirement.

4. Improve Outsourcing Controls

Organizations should establish appropriate controls for external suppliers and outsourced processes. Written quality agreements should be implemented where required, and supplier control and monitoring should be proportionate to the risks associated with the supplied product or process.

5. Implement Specialized Process Controls

Additional procedures and controls may be required for medical device-related activities, including:

  • Validation of software used within the QMS and production processes.
  • Product cleanliness and contamination-control requirements.
  • Installation and servicing procedures, where applicable.
  • Specific traceability requirements, especially for implantable medical devices.

6. Establish Strong Post-Market Procedures

Organizations should develop documented processes for managing customer feedback and complaints. These processes should also include methods for determining whether adverse events need to be reported or advisory notices need to be issued to the appropriate regulatory authorities.

Building on the ISO 9001 Foundation

ISO 13485 requires organizations to establish, implement, and maintain documented procedures and activities required by the standard and by applicable regulatory requirements.

Organizations that already have an ISO 9001 QMS can use that existing framework as a foundation when moving toward ISO 13485. However, the transition requires additional regulatory controls, documentation, risk-management practices, traceability, and medical device-specific processes.

For organizations involved in medical device manufacturing, including processes such as injection molding, building upon an established ISO 9001 quality system can provide a practical starting point. The existing QMS can be enhanced with the regulatory rigor and documented controls necessary to support medical device quality, safety, and performance.