ISO 13485:2016

Posted on Mar 1, 2016 in Newsletter

The third edition of ISO 13485 has been published as the replacement for ISO
13485:2003. ISO 13485:2016, Medical devices Quality management systems
Requirements for regulatory purposes , sets out the requirements for a quality
management system specific to the medical devices industry. The new edition was
issued to respond to the latest developments in quality management, technology, and
regulatory requirements.
With the standard applicable to so many types of products, the revision was no easy
task. A medical device is any product intended for use in the diagnosis, prevention,
and treatment of medical conditions. They range from simple products like wound
dressings to dentist chairs, cardiac pacers, life-support machines, and even in vitro
diagnostic reagents.
Improvements
The new version of the standard includes improvements such as broadening its
applicability to include all organizations involved in the life cycle of the product (from
concept to end of life), greater alignment with regulatory requirements, and a greater
focus on post-market surveillance, including complaint handling. There is also a
greater emphasis on having the appropriate infrastructure, particularly for the
production of sterile medical devices, and more focus on risk management.
Clause Changes
The eight clause structure of ISO 13485:2003 (which matches ISO 9001:2008) has been
carried over to ISO 13485:2016. The new ISO 13485 standard did not adopt the High
Level Structure of Annex SL used by other management system standards such as ISO
9001:2015 (quality), ISO 14001:2015 (environment), and ISO 27001:2003 (information
security).
The key clause changes from ISO 13485:2003 to ISO 13485:2016 were:
1. The addition of clause 4.2.3 for Medical device file. The Control of documents
was shifted to 4.2.4 and the Control of records moved to 4.2.5.
2. The title for clause 6.4 on Work environment has been expanded to include
Contamination control.
3. Clause 7.3 on Design and development has added sub-clause 7.3.1a for General,
7.3.8 on Design and development transfer, and 7.3.10 on Design and development

files. The other sub-clauses on Planning, Inputs, Outputs, Review, Verification, and
Changes remain, but have been renumbered because of the additions.
4. The sub-clauses under 7.5.1, Control of production and service provision, have
been elevated in the clause hierarchy, e.g., Installation activities at 7.5.1.2.2 is now
7.5.3. As a result, other sub-clauses have been renumbered, e.g., Customer property
at 7.5.4 is now 7.5.10. A new sub-clause 7.5.7 has been added on Particular
requirements for validation of processes for sterilization and sterile barrier systems.
5. New clauses 8.2.2 on Complaints handling and 8.2.3 on Reporting to regulatory
authorities have been added. These additions shifted the old clause entries to new
numbers, e.g., Internal audit is now 8.2.4.
6. Clause 8.3 on Control of nonconforming product has four new sub-clauses: 8.3.1
for General; 8.3.2 for Actions in response to nonconforming product detected
before delivery; 8.3.3 for Actions in response to nonconforming product detected
after delivery; and 8.3.4 for Rework.
Annex A and Annex B
Annex A of ISO 13485:2016 provides a comparison of the content between ISO
13495:2003 and ISO 13485:2016, while Annex B describes the correspondence
between ISO 13485:2016 and ISO 9001:2015.
Requirements Applicability
The processes required by ISO 13485:2016 that are applicable to the organization, but
are not performed by the organization, are the responsibility of the organization and
are accounted for in the organizations quality management system (QMS) by
monitoring, maintaining, and controlling the processes.
If applicable regulatory requirements permit exclusions of design and development
controls, this can be used as a justification for their exclusion from the QMS. These
regulatory requirements can provide alternative approaches that are to be addressed
in the QMS. It is the responsibility of the organization to ensure that claims of
conformity to ISO 13485:2016 reflect any exclusion of design and development
controls.
If any requirement in Clause 6 (Resource management), 7 (Product realization), or 8
(Measurement, analysis, and improvement) of ISO 13485:2016 is not applicable due to
the activities undertaken by the organization, or the nature of the medical device for
which the QMS is applied, the organization does not need to include such a
requirement in its QMS. For any clause that is determined to be not applicable, the
organization must record the justification as described in 4.2.2 (Quality manual).
Transition Timing

During the transition period, ISO 13485:2016 will co-exist with ISO 13485:2003. Due to
the requirement changes, users will have three years in which to update their quality
management systems to meet the requirements of ISO 13485:2016. It is
recommended that the users of ISO 13485:2003 work with their certification bodies or
registrars to schedule an upgrade audit at a convenient time within the transition
period.