ISO 13485 Requirements: Clause-by-Clause Breakdown

Last Updated on August 20, 2026 by

Introduction: Making ISO 13485 Less Overwhelming

Here’s what I’ve noticed after working with medical device companies of all sizes—ISO 13485 feels overwhelming at first glance. The clauses look dense, the requirements feel endless, and it’s easy to get lost in “what applies to me and how deep do I need to go?” I’ve seen teams freeze up just trying to map out where to start.

But here’s the good news: ISO 13485 isn’t meant to trip you up. It’s designed to give medical device manufacturers a clear, structured framework to build safe, effective, and compliant products. The problem is that the language of the standard doesn’t always make it easy to understand what’s actually expected.

That’s why I’ve put together this clause-by-clause breakdown. Instead of wading through jargon, you’ll see each requirement explained in plain language—what it means, why it matters, and what auditors really look for. Even better, if you want to dive deeper into specific clauses like design controls, supplier management, or post-market surveillance, I’ve linked to full supporting guides so you can zoom in where you need the detail.

By the end of this article, you’ll have a roadmap:

• A clear view of each ISO 13485 clause and its purpose.

• An understanding of the key records and processes auditors expect.

• Practical insights into how the clauses link together as one system.

Now let’s get into the standard itself, starting with Clause 4: Documentation Requirements—the foundation for everything else.

Clause 4 – QMS Documentation Requirements

Clause 4 lays the foundation for everything else in ISO 13485. If your documentation isn’t clear, controlled, and consistent, the rest of your quality management system will struggle to hold together.

At its core, this clause requires three main things:

1. A Quality Manual – your “big picture” document that defines the scope of your QMS, the processes it covers, and how they interact.

2. Documented Procedures – at minimum, you need formal procedures for controlling documents and records. Beyond that, procedures should exist wherever they help maintain consistency and clarity.

3. Records – proof that you’ve followed your procedures. Records demonstrate compliance in action, whether that’s training logs, calibration certificates, or CAPA evidence.

One of the most common mistakes I’ve seen is companies writing mountains of procedures that no one actually uses. ISO 13485 doesn’t reward paperwork—it rewards a documentation system that’s usable and aligned with how your team really works. Auditors will spot the difference quickly.

This clause also emphasizes document control. Every document must be reviewed, approved, updated when necessary, and protected so outdated versions don’t creep back into circulation. Whether you’re using binders or a digital system, the principle is the same: everyone should be working from the right version, at the right time.

If you want to dig deeper into the practical side of documentation, we’ve covered this in detail in our supporting guide: ISO 13485 Clause 4: QMS Documentation Essentials.

Clause 5 – Management Responsibility

Clause 5 is where ISO 13485 makes it clear: quality isn’t just the job of the QA department—it starts at the top. Leadership has to actively demonstrate commitment to the quality management system (QMS). If management treats ISO 13485 as “just compliance paperwork,” that mindset will flow down through the entire organization, and auditors will notice.

Here’s what this clause requires management to do:

• Define and communicate a quality policy that sets the direction for the company.

• Assign responsibilities and authorities clearly, so there’s no confusion about who owns which parts of the QMS.

• Conduct management reviews at planned intervals, reviewing performance data, customer feedback, audit results, and opportunities for improvement.

• Provide resources—people, tools, and infrastructure—to ensure the QMS is effective.

Auditors will often ask for evidence of management involvement. That could mean signed meeting minutes from management reviews, updated quality objectives tied to company goals, or proof that leadership actually attended reviews instead of delegating them entirely.

A frequent pitfall I’ve seen is leaders “handing off” quality to a compliance officer and never engaging themselves. That might keep things moving day to day, but it doesn’t meet Clause 5. Auditors expect to see leadership in the driver’s seat, not watching from the sidelines.

In short, Clause 5 ensures quality is a company-wide priority, not just a department-level activity.

Clause 6 – Resource Management

Clause 6 is all about making sure you have the right people, infrastructure, and environment to keep your QMS effective. Even the best-designed processes will fail if the resources behind them aren’t up to standard.

Here’s what ISO 13485 expects:

• Human Resources & Competence
  Employees must be competent based on education, training, skills, and experience. It’s not enough to say someone “knows how to do the job”—you need training records or other documented proof. Auditors will often pick a random employee and ask to see their training file.

• Infrastructure
  This covers facilities, equipment, IT systems, and any other physical or digital resources required to deliver quality products. For example, calibration of testing equipment falls under this category.

• Work Environment
  For medical devices, this can include controlled environments, cleanliness standards, or sterile conditions, depending on the product.

One of the most common audit findings here is incomplete training records. Companies often assume informal training or on-the-job shadowing is enough, but unless it’s documented, it doesn’t meet Clause 6. Another pitfall is outdated calibration certificates for monitoring and measuring equipment.

In practice, Clause 6 ensures your people are capable, your tools are reliable, and your environment supports consistent quality. Without these basics, the rest of the QMS can’t function properly.

Clause 7.1 – Planning of Product Realization

Clause 7 is the heart of ISO 13485, and it starts with planning. Clause 7.1 requires you to plan and develop the processes needed for product realization—basically, all the steps required to take a device from idea to market, while ensuring safety, quality, and regulatory compliance.

What the Standard Requires

You need to establish a structured plan that covers:

1. Quality Objectives for the Product

   • Define what the device needs to achieve, and how that aligns with your quality policy.

   • Example: performance criteria, safety thresholds, or regulatory requirements.

2. Processes and Documentation

   • Map out the processes needed (design, purchasing, production, testing, servicing).

   • Identify documents and records required to control these processes.

3. Resources

   • Ensure adequate personnel, infrastructure, and work environment (this links back to Clause 6).

   • Example: assigning qualified engineers to design, or ensuring sterile facilities for production.

4. Verification, Validation, and Monitoring Activities

   • Plan how you will verify and validate each stage of the process.

   • Include criteria for acceptance and methods for monitoring.

5. Risk Management

   • Integrate ISO 14971 requirements: risk must be considered during planning.

   • Every step should show evidence that risks have been identified, assessed, and controlled.

6. Regulatory and Customer Requirements

   • Planning must include regulatory compliance (FDA, EU MDR, etc.) and customer-specific needs.

   • This ensures your device isn’t just functional but also market-ready.

Why This Matters

Clause 7.1 ensures you don’t just jump into design or production without a roadmap. I’ve seen companies try to skip formal planning because they’re small or “moving fast”—but auditors always pick this up. A clear plan shows that your QMS is proactive, not reactive.

Key Deliverable

Auditors often ask to see a Product Realization Plan (sometimes integrated into the Design and Development Plan). This document ties everything together: objectives, resources, processes, verification, and risk management. Without it, Clause 7.1 is usually marked as a gap.

Clause 7.2 – Customer-Related Processes

Clause 7.2 makes it clear: you can’t build medical devices in a vacuum. You must actively identify, understand, and meet customer requirements—both stated (what they ask for) and implied (what regulators, safety standards, and industry norms demand).

What the Standard Requires

1. Determining Customer Requirements

   • This goes beyond just what’s written on a purchase order.

   • You must capture:

     • Product requirements (performance, regulatory, safety).

     • Delivery and post-delivery requirements (service, maintenance, training).

     • Any requirements not explicitly stated but necessary for intended use.

2. Review of Requirements

   • Before accepting an order or contract, you must review requirements to ensure you can actually meet them.

   • This review should be documented, with records showing:

     • Feasibility check.

     • Any differences between the order and your offer.

     • How customer communication was handled.

3. Customer Communication

   • ISO 13485 expects structured channels for customer interaction.

   • This includes:

     • Providing product information.

     • Handling inquiries, contracts, and orders.

     • Managing complaints and feedback.

Why This Matters

A common pitfall here is treating requirements review casually—for example, a sales rep saying “yes” to a customer request without looping in regulatory or engineering. That can result in promises you can’t keep, or worse, noncompliant products. Documented reviews prevent this.

Another trap I’ve seen: companies focus only on the customer’s explicit request and forget implied requirements like regulatory standards. For example, a client orders a device with certain dimensions—but if you don’t also confirm biocompatibility standards, you’re not meeting Clause 7.2.

Deliverables Auditors Expect

• Records of order/contract reviews.

• Evidence of how you communicate requirements internally.

• Complaint handling logs tied back to communication processes.

In short, Clause 7.2 ensures that customer needs are fully understood, reviewed, and agreed upon before work begins—and that there’s a clear system to manage ongoing communication.

Clause 7.3 – Design & Development Controls

Clause 7.3 is one of the most detailed parts of ISO 13485, and for good reason: it governs how you take an idea for a medical device and turn it into a safe, effective product. Auditors pay very close attention here because weak design controls are one of the fastest paths to compliance issues—or worse, product recalls.

What the Standard Requires

1. Design and Development Planning

   • Define responsibilities, resources, timelines, and review stages.

   • Planning should be documented and updated as the project evolves.

2. Design Inputs

   • Gather requirements: regulatory standards, functional performance, safety, usability, risk management.

   • Inputs must be clear and measurable (not vague like “easy to use”).

3. Design Outputs

   • Specifications, drawings, or manufacturing instructions that can be verified against inputs.

   • Outputs must be suitable for production and include acceptance criteria.

4. Design Reviews

   • Structured checkpoints where cross-functional teams evaluate progress.

   • Records of each review are mandatory.

5. Design Verification and Validation

   • Verification: Did we build it right? (Outputs match inputs).

   • Validation: Did we build the right thing? (Device meets user needs and intended use).

6. Design Transfer

   • Ensure all information needed for consistent production is provided to manufacturing.

7. Design Changes

   • Every change must be documented, reviewed, and approved. Informal changes without records are a frequent source of audit findings.

Real-World Lesson

I worked with a start-up that failed its first ISO 13485 audit because they couldn’t show documented design reviews. They had done the work—discussing design in meetings and whiteboard sessions—but without formal records, auditors saw it as noncompliance. After building a simple review template and holding structured checkpoints, they passed their follow-up audit with no issues. The difference wasn’t more bureaucracy, just better evidence.

Why This Clause Matters

Clause 7.3 ensures that your design process is traceable from start to finish: inputs → outputs → verification/validation → production. Without this traceability, you can’t prove your product was designed systematically, and regulators won’t trust it’s safe.

For a deep dive, see our supporting guide: ISO 13485 Clause 7.3: Design & Development Controls.

Clause 7.4 – Purchasing Controls

Clause 7.4 makes it clear that suppliers are not just “vendors”—they are part of your quality system. If a supplier fails, it’s your device and your certification that take the hit. That’s why ISO 13485 requires strong, risk-based purchasing controls.

What the Standard Requires

1. Evaluation and Selection of Suppliers

   • You must have documented criteria for choosing suppliers.

   • This could include certifications (e.g., ISO 13485), audit results, capability assessments, or risk levels.

2. Supplier Qualification and Approval

   • Evidence that you verified a supplier can meet your requirements before using them.

   • Qualification should scale with risk—critical suppliers require deeper checks.

3. Ongoing Monitoring and Re-Evaluation

   • Track supplier performance over time: delivery reliability, quality of goods, and complaint history.

   • Periodically re-evaluate suppliers, especially if their risk profile changes.

4. Purchasing Data

   • Purchase orders and contracts must clearly define requirements (materials, specifications, quality agreements).

   • This ensures suppliers know exactly what’s expected.

Why This Matters

One of the most common audit findings is over-reliance on supplier certificates. While certifications are useful, they’re not enough on their own. You need documented proof that you evaluated, approved, and continue to monitor the supplier.

Another common pitfall is treating all suppliers the same. Buying sterile components should not have the same approval process as ordering office supplies. Auditors expect a risk-based approach, where oversight increases with supplier criticality.

For a detailed look at building a compliant system, see our supporting guide: ISO 13485 Purchasing Controls: Supplier Management.

Clause 7.5 – Production and Service Provision

Clause 7.5 shifts focus from planning and suppliers to the actual production and servicing of devices. This is where your QMS meets the real world—ensuring that what you design and plan actually gets built and delivered consistently.

What the Standard Requires

1. Controlled Production Processes

   • Define and document production processes, including work instructions, batch records, and inspection criteria.

   • Ensure staff are trained and records show they followed the correct procedures.

2. Validation of Processes

   • For processes where results can’t be fully verified by inspection (e.g., sterilization, welding), you must validate them.

   • Validation requires documented evidence that the process consistently produces results meeting specifications.

3. Cleanliness and Contamination Control

   • Where product safety depends on cleanliness (e.g., sterile devices), you must have documented cleaning, handling, and environmental controls.

4. Traceability

   • Particularly important for implantable or high-risk devices. You need to track product identity through production and distribution, often down to individual components or batches.

5. Servicing Requirements

   • If your product requires servicing, you must define how it will be performed, documented, and monitored.

6. Installation Activities (if applicable)

   • When installation affects device performance, procedures and records are required to show it was done correctly.

Why This Matters

Production is where many audit findings occur because it’s where theory meets practice. Auditors will often walk the production floor and ask operators to show them the latest procedures, training records, or batch records. If staff can’t demonstrate they’re working to the current process, that’s a red flag.

Clause 7.5 ensures that products aren’t just designed well—they’re consistently manufactured and serviced in a controlled, documented way.

Clause 7.6 – Control of Monitoring and Measuring Equipment

Clause 7.6 is all about ensuring that the equipment you use to test, measure, and monitor your products is accurate and reliable. If your measuring tools are off, every test and inspection result becomes questionable—and that undermines your entire QMS.

What the Standard Requires

1. Calibration and Verification

   • All monitoring and measuring equipment must be calibrated or verified at specified intervals.

   • Calibration must be traceable to international or national standards (e.g., NIST).

2. Identification and Records

   • Each piece of equipment should be uniquely identified.

   • Records must show calibration status, due dates, and results.

3. Safeguards Against Inaccurate Results

   • If equipment is found out of calibration, you must assess whether past results were affected and take corrective action.

4. Protection of Equipment

   • Equipment must be handled, stored, and maintained in a way that preserves its accuracy and function.

5. Software Validation (if applicable)

   • Any software used for monitoring or measurement must be validated before use and revalidated as needed.

Why This Matters

One of the most common audit findings in Clause 7.6 is expired calibration. Auditors will pick up a random caliper, scale, or gauge and ask to see its calibration record. If the certificate is missing or expired, that’s an immediate nonconformity.

Another pitfall is failing to evaluate the impact of an out-of-tolerance instrument. If a piece of equipment is found inaccurate, you can’t just recalibrate it—you must investigate whether previous product lots were affected and take action if necessary.

In short, Clause 7.6 ensures that when you say a device “passed inspection,” the measurement behind that statement can be trusted.

Clause 8 – Measurement, Analysis, and Improvement

Clause 8 is where ISO 13485 brings everything full circle. It requires you to monitor how your QMS performs, analyze the data you gather, and take action to continuously improve. In other words: don’t just make devices—learn from how they perform in the field and use that knowledge to get better.

What the Standard Requires

1. Feedback Systems

   • You must have processes to collect and review feedback from customers, users, distributors, and internal teams.

   • Feedback is an input into both risk management and CAPA.

2. Complaint Handling

   • Every complaint must be logged, investigated, and resolved with documented records.

   • Auditors will often select random complaints and ask to trace them through your system.

3. Internal Audits

   • Regular audits of your QMS are mandatory.

   • These audits check compliance with both ISO 13485 and your own internal procedures.

4. Monitoring and Measurement of Processes & Product

   • Evidence that you monitor key QMS processes and product conformity.

   • Includes product inspections, process monitoring, and supplier performance reviews.

5. Nonconformity Control & CAPA

   • Clear processes for identifying, documenting, and addressing nonconforming product.

   • Corrective and Preventive Actions (CAPA) must address root causes, not just symptoms.

6. Data Analysis & Improvement

   • Complaint trends, audit findings, and production data must be analyzed.

   • Results feed into management review and drive continuous improvement.

Why This Matters

Clause 8 ensures your QMS doesn’t just sit still—it evolves. Auditors expect to see a closed-loop system where data from the market and internal processes is continuously feeding back into risk assessments, CAPAs, and design improvements.

For a detailed breakdown, see our supporting guide: ISO 13485 Clause 8: Post-Market Surveillance Guide.

FAQs: ISO 13485 Requirements

Q1. Do I need to comply with every clause of ISO 13485?

Yes—unless you can justify an exclusion. The most common example is design and development (Clause 7.3). If you’re a contract manufacturer that doesn’t design devices, you can exclude that clause—but you must document the reason. Everything else applies.

Q2. What documents do auditors usually ask for first?

In practice, auditors often start with:

• Quality Manual (Clause 4).

• CAPA records (Clause 8).

• Design History Files (Clause 7.3).

• Supplier evaluations and the Approved Supplier List (Clause 7.4).

• Complaint logs (Clause 8).
  Having these organized and ready sets the tone for the audit.

Q3. Can small companies keep ISO 13485 compliance simple?

Absolutely. ISO 13485 doesn’t require heavy bureaucracy—it requires effectiveness. Smaller companies often pass audits with lean systems: simple training records, lightweight supplier evaluations, and straightforward complaint handling logs. The key is consistency and traceability, not volume.

Conclusion: Turning ISO 13485 Into a Roadmap, Not a Roadblock

ISO 13485 can look intimidating when you first open the standard, but broken down clause by clause, it becomes far more manageable. Each requirement—whether it’s documentation, leadership involvement, supplier management, or post-market surveillance—fits into a bigger system designed to keep medical devices safe, effective, and compliant.

What I’ve seen over the years is that companies who treat ISO 13485 as a “paper exercise” usually end up fighting audits. But those who embed the clauses into how they actually run their business—keeping documentation lean, making design controls traceable, monitoring suppliers realistically, and closing the loop with post-market feedback—get better results with less stress.

Your takeaway? Don’t think of ISO 13485 as 100+ requirements to check off. Think of it as a roadmap: starting with documentation (Clause 4), supported by leadership and resources (Clauses 5 & 6), flowing into operations (Clauses 7.1–7.6), and closing the loop with monitoring and improvement (Clause 8).

If you want to dive deeper into any specific clause—whether it’s design controls, supplier management, or surveillance—we’ve built dedicated guides that expand on each one. Use this breakdown as your big-picture map, and the supporting articles as your step-by-step toolkit.