ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
ISO 13485 templates are not an ISO 9001 set with “medical device” written on the
cover. The standard keeps the older clause structure, adds documents that exist nowhere else in the
ISO world, and expects records that a general quality pack simply does not contain.
ISO 13485:2016 is the third edition, published in March 2016, and ISO confirmed it following
systematic review in 2025 — so it is stable and not currently being revised.
The structural point matters more than the date. ISO 13485 does not use the harmonized
structure that ISO 9001, ISO 14001 and ISO 27001 share. There is no clause 4.1 “context of
the organization”, no interested-parties clause, and no clause 6.1 risk-and-opportunity section. It
runs on the older five-clause layout:
So a template set built to the harmonized structure will have documents you cannot use and gaps
where the standard expects something. That is the single most common reason a cheap pack fails its
first audit.
| Clause | What the document set has to deliver |
|---|---|
| 4 — QMS | Quality manual, medical device file, control of documents and records, outsourced process control, software validation |
| 5 — Management | Quality policy and objectives, responsibility and authority, management representative, management review |
| 6 — Resources | Competence and training, infrastructure, work environment and contamination control |
| 7 — Realization | Design and development, purchasing, production and service, sterilization where relevant, traceability, identification |
| 8 — Improvement | Feedback and post-market surveillance, complaints, vigilance reporting, internal audit, nonconformity, CAPA |
Four artefacts have no equivalent in a general quality pack, and their absence is obvious to an
auditor.
The medical device file. Clause 4.2.3 requires a file per device or device family
containing the specification, manufacturing and measurement arrangements, and the requirements for
installation and servicing where applicable. It is an index into the rest of your system rather than a
single document, which is why a procedure and index works better than a folder someone maintains by
memory.
The design and development file. Design controls carry more weight here than
anywhere else — plan, inputs, outputs, review, verification, validation, transfer and change control,
each with its own record. Usability engineering and software lifecycle documents sit alongside them
for devices that need them.
Post-market documents. Feedback and post-market surveillance, complaint handling,
regulatory reporting and vigilance, and advisory notice or recall procedures. A general QMS pack has
a complaints process; it does not have vigilance.
Sterile device documents, where applicable — sterilization process validation and
sterile barrier system validation records.
The document set, mapped to the clause it answers.
The ISO 13485 Toolkit ships 126 editable documents in folders that follow the standard’s own clause order — quality manual, medical device file procedure and index, thirteen design and development documents including the DHF index, purchasing and supplier controls, production and sterilization, feedback, complaints and vigilance, risk management aligned to ISO 14971, plus 23 QMS process maps supplied as PNG and SVG, and cross-reference matrices to FDA QMSR, EU MDR and ISO 9001.
ISO 13485 lets you exclude parts of clause 7 that do not apply to your device or your role — design
and development for a contract manufacturer working to someone else’s specification, sterilization for
a non-sterile device. Clauses 4, 5, 6 and 8 cannot be excluded.
Every exclusion must be justified and recorded. That makes a statement of applicability and
justification one of the more useful documents in a set: it is the page an auditor reads to understand
why your system looks the way it does, and it prevents the opposite failure of maintaining sterile
device procedures for a product that was never sterile.
Since 2 February 2026, the FDA’s Quality Management System Regulation has replaced
the old Quality System Regulation, and 21 CFR Part 820 incorporates ISO 13485:2016 by reference. A US
manufacturer’s ISO 13485 document set is now much closer to its FDA obligations than it used to be —
our guide to the QSR to QMSR
transition covers what moved.
The practical consequence for templates is that cross-reference matrices earn their place. A set
that maps its documents to QMSR, to EU MDR 2017/745 and to ISO 9001 lets you answer one question —
“where do you satisfy this?” — from a single sheet, rather than reconstructing the mapping under audit
conditions.
They give you structure, defensible wording and a complete list of what to produce. They cannot
perform your process validations, populate a design history file for a device they have never seen, or
generate the complaint and CAPA records that show the system operating.
They also cannot make the applicability decisions. Whether you are a manufacturer, an importer or a
distributor, and which clause 7 elements apply, is a determination only you can make — and it drives
which half of the pack you will actually use.
The standard is unusually explicit about retention: records must be kept for at least the lifetime
of the device as defined by the manufacturer, and not less than two years from release, or longer
where a regulatory requirement says so. That sentence has consequences a template pack has to
anticipate.
It means the record forms need to survive being read years later by someone who was not there.
Signatures and dates that identify a person rather than a role, device and lot identification on
every record that touches product, and a retention period stated on the form itself rather than
buried in a procedure. Sets that treat records as an afterthought produce forms that are compliant on
the day and useless at the point they are actually needed.
Order matters, because several documents depend on decisions made in others.
Doing it in this order means the ISO 13485 templates you tailor are the ones you will actually use,
rather than a complete pack edited uniformly and half wasted.
How many documents does ISO 13485 require?
The standard names some documents explicitly and implies others through its record requirements.
A working set is usually well over a hundred documents once forms and registers are counted. See
ISO 13485 mandatory documents
for what is required rather than merely useful.
Can I adapt ISO 9001 templates for ISO 13485?
Partly, and it is usually a false economy. The clause structures differ, and the medical device file,
design controls, vigilance and sterilization documents have no ISO 9001 equivalent to adapt.
Do ISO 13485 templates cover FDA requirements?
Since February 2026 the overlap is substantial, because Part 820 incorporates ISO 13485. A
cross-reference matrix is still needed for the QMSR-specific requirements that sit outside the
standard.
Is ISO 13485:2016 being revised?
No. It is the third edition and ISO confirmed it in 2025 following systematic review.
What if we do not design our own devices?
Then design and development can be excluded from your scope, with the justification recorded. That
typically removes a substantial part of the document set.
ISO 13485 certification is issued by a certification body, but for European market access the
assessment that matters is your notified body’s, and for several markets at once it may be an MDSAP
audit covering the US, Canada, Brazil, Japan and Australia in a single visit.
Those audits read the same document set from different angles, which is an argument for keeping one
system with cross-references rather than parallel document sets per market. A readiness checklist
aimed specifically at MDSAP is worth having for that reason: it surfaces the questions your ISO 13485
templates were not written to answer.
Judge ISO 13485 templates on two things: whether they follow the standard’s own clause structure
rather than the harmonized one, and whether they include the medical device file, design controls,
vigilance and sterilization documents that make this standard different from ISO 9001.
Then make the applicability decision early and record it. It determines which half of any document
set you will actually use, and it is the first thing an auditor will want to understand about your
system.
The full set is available as the ISO 13485 Toolkit, or start with the free ISO templates.
August 31, 2026
August 31, 2026
August 31, 2026
August 31, 2026
August 31, 2026