How to Implement ISO 13485: A Ten-Step Plan

ISO 13485 implementation is different from the other management system
standards in one decisive way: it is a regulatory instrument, not just a commercial one. Since the
FDA began enforcing QMSR on 2 February 2026, the requirements of ISO 13485:2016 are the substance of
21 CFR Part 820. This is a ten-step plan written accordingly.

Before step one of ISO 13485 implementation: know your regulatory route

The QMS and the device approval are separate tracks, and confusing them wastes months. ISO 13485
certification demonstrates the system; CE marking under EU MDR needs a notified body conformity
assessment; US market entry needs 510(k), De Novo or PMA. Decide which markets you are entering
before you scope, because it determines whether design and development is in scope and how heavy
your technical documentation obligations are.

The ten steps of ISO 13485 implementation

1. Gap analysis (2–3 weeks). Against all of clauses 4–8, plus QMSR if
   you sell into the United States.
2. Scope, roles and the quality manual (2–3 weeks). ISO 13485 still requires
   a quality manual (4.2.2), which ISO 9001 dropped. Do not skip it.
3. Medical device file (3–5 weeks). Clause 4.2.3 requires a file per device
   or device family. This is the spine of the system and it is frequently left until last.
4. Risk management (4–8 weeks). Threaded across the lifecycle, assessed
   against ISO 14971. See our guide to
   ISO 13485 risk management.
5. Design and development controls (6–12 weeks, if in scope). Design inputs,
   outputs, review, verification, validation, transfer and change control, all recorded in a design
   history file that must be reconstructable years later.
6. Documented procedures and records (4–8 weeks). See
   ISO 13485 mandatory documents.
7. Supplier and purchasing controls (3–5 weeks). Evaluation criteria,
   records, and controls proportionate to the effect on the device.
8. Production, validation and traceability (4–8 weeks). Process validation
   where output cannot be fully verified, plus sterilisation and cleanliness controls where they
   apply.
9. Run the system (3–6 months). Complaints, feedback, CAPA and post-market
   surveillance need real cases before an audit can sample them.
10. Internal audit, management review, certification. Both prerequisites. See the
    internal audit checklist and
    ISO 13485 certification.

The three steps ISO 13485 implementation always underestimate

Step 5, design controls. Underestimated more than any other, and the hardest to
remediate late. Design records cannot be reconstructed convincingly after the fact, and auditors
know it. If you are developing while implementing, run design controls from day one rather than
retrofitting them to work already done.

Step 3, the medical device file. Treated as an admin task. It is the index that
proves the system covers the device, and assembling it exposes every gap in the rest of the QMS.

Step 9, running the system. ISO 13485 keeps preventive action as its own
clause (8.5.3), separate from corrective action. If every entry in your log is reactive,
that clause is not being met — and you need months of operation to have anything else.

What QMSR changed for ISO 13485 implementation

For manufacturers selling into the United States, ISO 13485 implementation is now the route to
federal compliance rather than a parallel exercise. The FDA retired the Quality System Inspection
Technique and inspects against Compliance Program 7382.850. Practically: build one QMS to ISO 13485,
and treat the remaining Part 820 additions as an overlay rather than maintaining two systems.

A realistic total for ISO 13485 implementation

Nine to eighteen months from a standing start is realistic where design and
development is in scope, and six to nine where you manufacture to someone else’s specification. If
you already hold ISO 9001, the shared clauses help, but the device-specific requirements —
device file, design history, sterilisation, traceability, post-market surveillance — are the
bulk of the work and none of them transfer.

References

• ISO 13485:2016 — the current edition on iso.org.
• FDA Quality Management System Regulation — the rule that incorporated ISO 13485 into 21 CFR Part 820.

Implementation guides for the other standards

• ISO 27001 implementation
• ISO 9001 implementation
• ISO 13485 implementation — you are here
• ISO 14001 implementation
• ISO 45001 implementation
• ISO 22301 implementation
• GDPR implementation
• ISO 42001 implementation
• ISO 20000 implementation
• HIPAA implementation