ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The ISO 13485 medical device file is the collection of documents, or references to them, that shows each device type or family conforms to the standard and to regulatory requirements. Clause 4.2.3 requires one file per device type or family, and it is one of the first things auditors sample.
This guide lists the required contents, explains how the file differs from the design file and EU technical documentation, and gives a practical structure. It builds on the design controls and quality manual guides.
Free gap assessment
How much of ISO 13485 could you evidence today?
Score clauses 4 to 8, free, with the FDA QMSR and EU MDR duties kept separate so you can see what is the standard and what is the regulator.
Run the free ISO 13485 gap assessment → or View premium report sample
Clause 4.2.3 requires you to establish and maintain one or more files for each medical device type or family, containing or referencing documents generated to demonstrate conformity with the standard and applicable regulatory requirements.
The content must include, but is not limited to, six items, covering description and labeling, product specifications, manufacturing and distribution requirements, measuring and monitoring procedures, installation where appropriate and servicing where appropriate.
Check the full text at the ISO 13485:2016 page on iso.org and use it as your outline.
You can group devices into a family when they share design, materials, manufacturing processes and intended use, differing only in size or minor configuration. Document the grouping rationale.
Over-grouping hides differences that matter, while under-grouping creates needless duplication. A change in intended use or core technology usually means a new file.
State the grouping rule in the procedure so decisions are repeatable.
The file includes a general description of the device, its intended use or purpose, and labeling, including instructions for use. Keep these aligned with regulatory submissions, as inconsistencies raise questions.
Labeling must match the version that ships. Keep controlled copies of labels, inserts and packaging text with revision history.
Include indications, contraindications and user profile where relevant, since design inputs and validation refer back to them. Keep this in mind for every ISO 13485 medical device file.
Product specifications describe what the device is: materials, dimensions, performance limits, software versions and acceptance criteria. They come largely from design outputs.
Link each specification to its approved document and revision. The file should always point to the current version and show how to find historic versions.
Specifications for components and suppliers belong here or as clear references.
The file includes specifications or procedures for manufacturing, packaging, storage, handling and distribution. These can be work instructions, process specifications, packaging drawings or distribution requirements.
Include sterilization process references where applicable and storage conditions that protect the device.
Reference validated processes so an auditor can follow from the file to process validation evidence. This is where a ISO 13485 medical device file is won or lost.
Procedures for measuring and monitoring include incoming inspection, in-process checks, final release testing and acceptance criteria. They show how you confirm each unit meets specification.
Include test methods, equipment references and sampling plans with a statistical rationale where used.
Make sure calibration and equipment control records are accessible from here.
As appropriate, the file includes requirements for installation and procedures for servicing. They apply to devices that are installed, calibrated or repaired after sale.
If your device does not need installation or service, record that decision and the rationale so an auditor sees it was considered.
Servicing records, spare parts control and service feedback feed the post-market loop described in complaint handling. Auditors judge your ISO 13485 medical device file on exactly this point.
| Required content | What it covers | Typical source |
|---|---|---|
| Description and labeling | Intended use, instructions for use | Labeling and IFU documents |
| Product specifications | Materials, performance, acceptance criteria | Design outputs |
| Manufacturing and distribution | Production, packaging, storage, handling | Work instructions, process specs |
| Measuring and monitoring | Inspection and test procedures | Test methods, sampling plans |
| Installation | Where appropriate | Installation instructions |
| Servicing | Where appropriate | Service procedures |
The design and development file under clause 7.3.10 holds the records of how the design was developed. The ISO 13485 medical device file holds the current definition of the device and how to make and monitor it.
Many companies combine them or cross-reference them. What matters is that an auditor can find the right record without a hunt.
See ISO 13485 design controls for the design file detail.
Under the EU MDR, technical documentation follows Annexes II and III and covers more content, including GSPR evidence and clinical evaluation. The medical device file can be part of it.
Structure your file so sections can be reused for the EU submission. Compare headings and avoid maintaining two versions of the same document.
Read MDR technical documentation and the GSPR checklist for the European structure. Treat it as a standing rule for your ISO 13485 medical device file.
Before the FDA Quality Management System Regulation, US manufacturers kept a device master record and design history file. The QMSR took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference.
The practical effect is that the content you keep is organized around the standard’s file concept. Compare the details in QMSR vs ISO 13485.
Check current FDA materials for how records should be presented at inspection.
Create a master index per device family with sections for description, specifications, manufacturing, monitoring, installation, servicing, risk file, labeling, regulatory and change history.
Each section lists documents with number, title and revision. Use hyperlinks in an electronic system or a controlled index in a paper one.
Review the index at every change and at least annually.
Changes follow your document control and design change procedures. The file should show the current configuration and keep earlier versions retrievable.
Assess each change for effect on device safety, regulatory status and previously delivered products, as clause 7.3.9 requires for design changes.
A change log inside the index shows the history at a glance and answers audit questions quickly.
Common mistakes are one file for dissimilar devices, outdated indexes, missing labeling, no reference to validated processes and no servicing decision. Another is leaving the file to one person who then leaves.
A third mistake is building the file just before an audit, which reveals missing documents too late.
Keep it a living index, owned by quality with contributors from engineering, production and regulatory.
Auditors often pick a device and ask to see its file, then follow links into design, production and complaints. If the file is complete, the audit moves smoothly.
Prepare by walking through your own file the way an auditor would, using the internal audit approach.
Make sure staff know where the file lives and who owns each section.
A file index template, device family justification form and change log help you start. The ISO 13485 Toolkit includes document templates that fit a file-based structure.
Start with your lead device, then replicate the structure for other families.
Use the gap analysis to see which documents are missing before you populate the index.
The file is evidence of conformity at both stage 1 and stage 2 audits. The certification timeline shows when to have it ready.
If you are still planning, the implementation guide sets a sensible order of work.
A clean, well-indexed file is a quiet signal of a mature quality system.
Reference instead of copy. If a specification lives in the document control system, point to it and do not paste it in again.
Duplicated content goes stale and creates conflicts. One authoritative source with many pointers is the safest design for any ISO 13485 medical device file.
Review the index regularly to remove broken links and obsolete references.
Assign one owner per device family, usually a quality or product manager, who confirms the index each quarter. Section owners update their own documents and flag changes.
Record the owner in the index header. When staff change, hand over the file formally and record it.
Clear ownership prevents the common failure where everyone assumes someone else maintains the index.
For a hypothetical blood pressure monitor family, section one lists the product description and the instructions for use. Section two lists the mechanical, electrical and software specifications by document number and revision.
Sections three and four reference the assembly work instruction, the packaging specification, the final test procedure and the calibration record format. Section five records that no installation is required and that servicing is by replacement only.
That is a complete outline in about a page, and it shows how little is needed when the structure is clear.
Not exactly. The device file defines the device and how to make and monitor it, while the design file records how it was developed, though many companies cross-reference them.
One per device type or family. You may group similar devices into a family if you document the rationale.
Yes. The standard does not require paper. Ensure it is controlled, retrievable and backed up.
No. It can be part of it, but MDR technical documentation has broader content requirements.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026