ISO 13485 (Quality Management System for Medical Devices) is the international standard with requirements for the quality management system of medical device manufacturers for regulatory purposes. The 2016 edition is authoritative. FDA has incorporated it into the QMSR since February 2, 2026.
Purpose and classification
ISO 13485 bears the title “Medical devices, Quality management systems, Requirements for regulatory purposes.” It describes requirements for the quality management system (QMS) of a medical device manufacturer. FDA states that the standard is used internationally by many regulatory authorities either as the basis for, or as their own, QMS requirements for manufacturers. It also serves as a reference point in regulatory harmonization programs such as MDSAP.
The standard applies to the management system of the organization, not to an individual product. How a product is designed and how its usability is safeguarded is governed by other standards, which are covered in the section on distinctions. The text of the standard is subject to a fee and is not reproduced here. The following statements rely on legal texts and official publications that cite the standard.
Edition and status (as of October 2026)
The authoritative edition is the third edition of March 1, 2016 (ISO 13485:2016). This is how FDA incorporates it in 21 CFR 820.7(b). In Europe, the standard is maintained as EN ISO 13485:2016. Implementing Decision (EU) 2021/1182 on harmonized standards lists it together with the corrigendum EN ISO 13485:2016/AC:2018 and the amendment EN ISO 13485:2016/A11:2021 (version of June 17, 2026). The British list of designated standards includes the same combination (Notice 0129/26 of January 17, 2026, see UKCA Marking and MHRA).
None of the primary sources reviewed names a newer edition. FDA has stated that it will evaluate later revisions of the standard and, if appropriate, adapt its regulation through rulemaking. The ISO catalog page for the standard could not be retrieved for the research. Whether the standard is currently being revised was therefore not checked here.
Structure by publicly documented clauses
The standard is divided into numbered clauses. The complete outline is found in the text of the standard and in the ISO preview. The following clauses, among others, are publicly documented through FDA references:
| Clause | Title or subject according to FDA |
|---|---|
| 3 | Terms and definitions |
| 4.2.3 | Medical Device File |
| 4.2.5 | Control of Records |
| 7.1 | Planning of product realization |
| 7.3 | Design and Development, with subclauses 7.3.1 through 7.3.10 |
| 7.5.1 | Control of production and service provision |
| 7.5.8 and 7.5.9 | Identification, Traceability |
| 8.2.2 and 8.2.3 | Complaint handling, Reporting to regulatory authorities |
FDA also emphasizes that risk management is anchored throughout the standard, among others in clauses 4.1, 7.1, 7.3, 7.4, 7.5, 7.6, and 8.2 and certain subclauses of them.
Legal significance in the US, EU, and UK
US. The revised regulation 21 CFR Part 820, the Quality Management System Regulation (QMSR), has applied since February 2, 2026. It incorporates ISO 13485 by reference. Under 21 CFR 820.10(a), the manufacturer must document a QMS that meets the applicable requirements of the standard and of Part 820. FDA considers the requirements of the standard, taken as a whole, to be substantially similar to the former regulation. If a clause of the standard conflicts with the Federal Food, Drug, and Cosmetic Act or its implementing regulations, US law prevails (21 CFR 820.1(b)). FDA does not require an ISO 13485 certificate and does not issue one, and a certificate does not exempt a manufacturer from inspection. The regulation is covered in the term QMSR and Design Controls.
EU. Under Article 10(9) of the MDR, manufacturers must establish, document, implement, maintain, and continually improve a QMS. At a minimum, it must cover, among other things, risk management, clinical evaluation, product realization including design and development, and post-market surveillance. The standard is not named in this article. However, it appears in Implementing Decision (EU) 2021/1182 on harmonized standards. The assessment of this system is part of the conformity assessment by the Notified Body.
United Kingdom. The standard is a designated standard there under Regulation 3A of the Medical Devices Regulations 2002. Its application is not mandatory.
Design and development (clause 7.3)
Clause 7.3 is the relevant one for design and development. Under 21 CFR 820.10(c), manufacturers of class II and class III devices and of certain class I devices must meet this clause with all its subclauses. For class I, this concerns software-controlled devices and five device types listed in the regulation. The former section 820.30 with the design controls has been removed, and sections 820.20 through 820.30 are now without content (Reserved).
In an information event, FDA names the following titles: 7.3.1 general requirements, 7.3.2 design and development planning, 7.3.3 design and development inputs, 7.3.4 design and development outputs, 7.3.5 design and development review, 7.3.9 control of design and development changes. According to the rationale for the regulation, clause 7.3.7 concerns validation, and clause 7.3.10 requires the design and development file. This file contains or references all records that demonstrate fulfillment of the design and development requirements, including the plan and procedures. Manufacturers maintain it per device type or device family. The terms Design Input and Design Output, Verification, and Validation have their own explanations in the wiki.
Distinction from risk management and usability standards
The three standards operate at different levels. ISO 13485 requires a management system for the organization. ISO 14971 (application of risk management to medical devices) describes the risk management process, and IEC 62366-1 (application of usability engineering to medical devices) describes the usability engineering process. The titles are taken from the lists of the EU and the United Kingdom.
- In 21 CFR Part 820, FDA incorporates only clause 3 of ISO 9000 alongside ISO 13485, but not ISO 14971. It acknowledges that the latter can be helpful. According to an FDA information event, any appropriately validated risk management process may be applied. An explanation is provided by the term Risk management.
- In the EU, ISO 13485 and ISO 14971 appear in Implementing Decision (EU) 2021/1182, but IEC 62366-1 does not (version of June 17, 2026, as of October 2026). In the United Kingdom, all three are included in the list of designated standards.
- The standards complement each other but do not replace each other. This is an inference from their different subject matters and not a statement by an authority. A separate term explains the usability standard.
Human factors connection
FDA links the QMS with human factors through the design inputs. In its human factors guidance (version of August 2026), it says in essence that manufacturers must take the results of their risk management into account when establishing design inputs and must include usability requirements in line with the intended use. The guidance classifies human factors validation testing as part of design validation and recommends understanding the tests as part of a robust design control system.
In practice, this means that the results of the usability engineering process belong in the design documentation of the QMS: usability requirements as inputs, their demonstration through verification and validation, and the results in the design and development file. This assignment is an inference from the guidance and the structure of the standard. Whether, and in what words, the text of ISO 13485 itself mentions usability cannot be presented here without access to the text, which is subject to a fee.
ISO 13485 sets requirements for the quality management system of medical device manufacturers. The authoritative edition is the third edition of 2016. FDA has incorporated it by reference into 21 CFR Part 820 since February 2, 2026, and in the EU and the United Kingdom it appears in the lists of harmonized and designated standards, respectively.
Clause 7.3 applies to design and development, with planning, inputs, outputs, review, verification, validation, changes, and the design and development file. Risk management is anchored throughout the standard. FDA does not require a certificate.
The standard replaces neither ISO 14971 nor IEC 62366-1. According to the FDA human factors guidance, usability requirements are part of the design inputs.
Frequently asked questions (FAQ)
Does FDA require an ISO 13485 certificate?
No. FDA does not require a certificate and does not issue one. A certificate also does not exempt a manufacturer from an FDA inspection, which is conducted on the basis of FDA regulations. However, the standard is substantively binding through 21 CFR Part 820.
Which edition of the standard applies?
FDA incorporates the third edition of March 1, 2016. In the EU and the United Kingdom, it is maintained as EN ISO 13485:2016 with corrigendum AC:2018 and amendment A11:2021. The sources reviewed name no newer edition (as of October 2026).
Does ISO 13485 replace ISO 14971?
No. FDA does not incorporate ISO 14971 but considers risk management to be anchored throughout the standard. In the EU and the United Kingdom, both standards appear independently in the standards lists.
Where is the design and development of a product addressed in the standard?
In clause 7.3 (Design and Development) with subclauses 7.3.1 through 7.3.10. Under 21 CFR 820.10(c), it applies to class II and III devices and certain class I devices.
What role does the standard play for human factors?
According to the FDA human factors guidance, usability requirements are part of the design inputs, and human factors validation testing is part of design validation. IEC 62366-1 describes usability engineering itself.
Are you building or reviewing your quality management system? We help you anchor usability requirements and evidence traceably in your design documentation.
More about our usability engineeringSources
- ISO 13485:2016, Medical devices, Quality management systems, Requirements for regulatory purposes
- ISO 14971:2019, Medical devices, Application of risk management to medical devices
- IEC 62366-1:2015+AMD1:2020, Medical devices, Part 1: Application of usability engineering to medical devices
- Regulation (EU) 2017/745 on medical devices (MDR)
- 21 CFR Part 820, Quality Management System Regulation (QMSR)
- FDA Guidance: Applying Human Factors and Usability Engineering to Medical Devices
- Federal Register, Final Rule: Medical Devices; Quality System Regulation Amendments, 89 FR 7496, February 2, 2024
- FDA: Quality Management System Regulation, Frequently Asked Questions
- FDA CDRH Town Hall: Quality Management System Regulation, Risk and Design and Development, January 14, 2026 (Transcript)
- Commission Implementing Decision (EU) 2021/1182 on harmonised standards for medical devices, consolidated version of 06/17/2026
- Regulation (EU) 2017/745 (MDR), consolidated version of 01/01/2026
- Department of Health and Social Care: Notice of publication 0129/26, references to standards for medical devices, January 17, 2026