ISO 13485 — Medical Device Quality Management System
If you manufacture medical devices and want to export to the EU, USA, or any regulated market — or sell in India at Class B and above — ISO 13485 is effectively mandatory. It is the international QMS standard for medical device manufacturers and is referenced by regulatory authorities worldwide as evidence of quality system compliance.
ISO 13485:2016
Current version
DHR
Device History Record — required per batch
MDR 2017
India's Medical Devices Rules — links quality requirements
Your company manufactures medical devices and ISO 13485 defines how every step of production must be documented. Medical devices affect patient safety — that is why the documentation requirements are more rigorous than ISO 9001. Every batch must have a complete Device History Record, every change must go through change control, and every complaint must be investigated.
DHR
Device History Record — complete trace for every batch
DHF
Design History File — design and development documentation
CAPA
Corrective and Preventive Action — for every nonconformance
Quick reference. ISO 13485:2016. Stricter than ISO 9001 — does not adopt Annex SL. Key additions vs ISO 9001: Design History File (DHF), Device Master Record (DMR), Device History Record (DHR), risk management (ISO 14971), UDI, sterile device requirements. In India: CDSCO under MDR 2017 is the regulatory authority. ISO 13485 CBs: NABCB-accredited with medical device scope. For EU: Notified Body certification of QMS.
2016
Current version
DHR / DMR / DHF
Three key device records
MDR 2017
India medical device regulation
ISO 13485 is the international quality management system standard specifically for medical device manufacturers. First published in 1996, the 2016 revision aligned with regulatory requirements and emphasised risk management. Unlike ISO 9001, ISO 13485 has not adopted Annex SL — it remains a standalone standard, although companies often implement it alongside ISO 9001.
1996
First published
2016
Current version
Not Annex SL
Standalone — not integrated with ISO 9001
Required for export to EU (CE mark), US (FDA), and most regulated marketsMandatory for Indian medical device manufacturers under MDR 2017 quality provisionsDevice History Record required for every manufactured batch
What’s on this page
01 —What it isUnderstanding ISO 13485
The global quality management standard for medical device manufacturers — more rigorous than ISO 9001.
ISO 13485 is the international standard for Quality Management Systems for medical device manufacturers. It builds on ISO 9001 principles but adds device-specific requirements that reflect the safety-critical nature of medical devices: risk management, design controls, Device History Records, and post-market surveillance.
Three key records every ISO 13485 manufacturer must maintain:
Device Master Record (DMR) — the complete specification for a device: drawings, materials, manufacturing procedures, quality acceptance criteria.
Design History File (DHF) — for designed devices: evidence that the design process followed documented procedures and that the design meets requirements.
Device History Record (DHR) — for every manufactured batch: evidence that the batch was manufactured in accordance with the DMR.
ISO 13485 vs ISO 9001 for medical devices: ISO 9001 is not sufficient for medical device export to regulated markets. Regulatory authorities (EU Notified Bodies, FDA) require ISO 13485 or an equivalent device-specific QMS. Holding ISO 9001 does not satisfy ISO 13485 requirements.
👥 Illustrative case — details changed for confidentiality
The business
Surgical instrument manufacturer Jalandhar · 130 employees, supplying hospitals and exporting to Middle East
The trigger
A UAE hospital group asked for ISO 13485 certification as a condition of a supply agreement. The manufacturer had ISO 9001 but not ISO 13485.
The challenge
Their gap analysis showed that device history records (DHRs) were the biggest gap. Jobs moved through production but there was no stage-wise traceable record linking each batch to its raw material certificates, process records, and inspection reports in one place.
Where Clicarity came in
They had been using Clicarity for production tracking. Each job captured the full stage record: material certificate reference at receipt, operator at every stage, critical process parameters (heat treatment temp and soak), and inspection results. When batches split into tip variants, each was tracked and inspected independently. Their ISO 13485 consultant confirmed that the Clicarity job records, with added UDI confirmation at labelling, formed the foundation for the DHR requirement.
The result
ISO 13485 certification achieved in 8 months. UAE supply agreement signed.
We already had most of the DHR data in Clicarity. The main change was adding the UDI confirmation field at the labelling stage and ensuring the material certificate reference was always captured at receipt.
02 —Who needs itIs it right for you?
Do you actually need it? Honest answer.
✓ You need it
Medical device manufacturers exporting to EU (CE mark), USA (FDA 510k/PMA), or any regulated market
Indian medical device manufacturers at Class B and above under MDR 2017
Contract manufacturers of medical devices
Suppliers of components that are part of a medical device
∼ Check with CDSCO or your customer
Class A medical device manufacturers — MDR 2017 may require QMS provisions
Distributors of medical devices in regulated markets
— Different standard applies
In vitro diagnostic manufacturers — IVD specific requirements apply (ISO 13485 base, plus IVDR in EU)
03 —What it requiresWhat is checked
What ISO 13485 requires beyond ISO 9001.
1
Device Master Record (DMR)
Complete, approved specification for every device: drawings, material specifications, manufacturing procedures, quality acceptance criteria, labelling requirements.
E.g. DMR for surgical scissors: drawing with dimensions, material specification for stainless grade, heat treatment parameters, passivation specification, dimensional acceptance criteria.Most common gap: DMR updated informally after design changes without going through change control. Any unauthorised deviation from the DMR is a nonconformance.
2
Design History File (DHF) for designed devices
For devices with design responsibility, a DHF documenting the design and development process: requirements, design inputs and outputs, design verification, design validation.
E.g. DHF for a new device: clinical requirements → engineering drawings → verification tests → clinical validation → design transfer to DMR.
3
Device History Record (DHR) for every manufactured batch
A complete, traceable record for every manufactured batch showing it was produced in accordance with the DMR. Links raw material lots, process records, inspection results, and QA release.
E.g. DHR for Batch 2026-42: material certificate reference, heat treatment record (temp and time), dimensional inspection report, QA release signature.Most common gap: DHR incomplete — records scattered across different systems with no consolidated batch record.
4
Risk management — ISO 14971
Risk management throughout the product life cycle: hazard identification, risk estimation, risk control measures, residual risk assessment.
E.g. Risk management file for each device: hazards associated with the device, probability and severity of harm, controls implemented, residual risk acceptable.
5
Unique Device Identification (UDI)
For products in markets requiring UDI (EU EUDAMED, US FDA UDI database), UDI assigned and traceable to DHR.
E.g. UDI-DI on product label and packaging. UDI-PI (batch/lot number) on individual unit label.
6
CAPA — stricter than ISO 9001
Corrective and Preventive Action process with root cause analysis for all nonconformances, complaints, and adverse events. Effectiveness verification required.
E.g. Every customer complaint investigated: root cause, corrective action, verification that the corrective action was effective.
7
Post-market surveillance and vigilance
System for monitoring device performance in the field. Adverse event reporting to regulatory authorities (CDSCO in India, EUDAMED in EU) within required timeframes.
E.g. Customer complaint tracking system. Adverse event (serious injury or death) reported to CDSCO within prescribed period.
What inspectors really check
Auditors will review a DHR for a batch selected at random and verify it is complete and traceable to the DMR. "Show me the DHR for Batch X" is the standard opening request. Any gap in the DHR — missing material certificate, no process record — is a nonconformance.
Gap analysis checklist — tick what you already have
Device Master Records complete for all devices in scope
Drawings, materials, process, acceptance criteria — all approved.
Device History Records completed for every manufactured batch
Traceable to raw material lots, process records, and inspection.
Change control procedure governing DMR changes
All design or process changes through documented change control.
Risk management file per ISO 14971 for each device
CAPA process with root cause analysis and effectiveness verification
All nonconformances, complaints, and adverse events covered.
Customer complaint system with post-market surveillance
Adverse events reported to CDSCO within required timeframes.
UDI assigned and traceable to DHR where required
EU EUDAMED, US FDA UDI database as applicable.
0 of 7 complete
04 —Official bodyWho certifies in India
Who issues this in India — and how to verify it.
In India, medical device manufacturing is regulated by CDSCO (Central Drugs Standard Control Organisation) under the Medical Devices Rules 2017 (MDR 2017). Manufacturing licences for Class B, C, and D devices require a quality management system.
For export: EU CE marking requires a QMS certificate from a Notified Body. US FDA submission may reference ISO 13485 as evidence of QMS.
NABCB-accredited CBs for ISO 13485 in India: Verify the CB holds NABCB accreditation with medical device scope specifically before engaging.
Classify your device under MDR 2017. Class determines licence and QMS requirements.
Step 2
Device Master Records
Complete DMR for every device: drawings, materials, process, acceptance criteria.
Step 3
Risk management files
ISO 14971 risk management for each device.
Step 4
Device History Records
DHR system — stage-wise production records for every batch.
Step 5
Internal audit
Full ISO 13485 audit including all device-specific clauses.
Certification
NABCB-accredited CB
Select CB with medical device scope specifically.
▶Where to begin: Use the checklist in Section 3 to assess your readiness before contacting any CB.
Timeline
Confirm with your CB
Depends on DHF readiness and device complexity.
Certificate validity
3 years (confirm with CB)
Annual surveillance audits.
EU CE mark
Notified Body certification
Separate from NABCB certification. EU-specific process.
MDR 2017 link
Class B+ requires QMS
CDSCO manufacturing licence for Class B and above.
The Device History Record is the single most important ISO 13485 document. Every other element of the QMS builds up to the DHR — the proof that a specific batch was manufactured correctly. Start designing your DHR system before implementing anything else.
06 —Find certified companiesHow to verify
How to find and verify certified organisations.
ISO 13485 certified organisations can be verified through the IAF global register. CDSCO maintains a register of licensed medical device manufacturers in India.
How to verify: To confirm whether any organisation holds a current ISO 13485 certification, use the official register. Verify the issuing CB's accreditation at nabcb.qci.org.in.
Design your Device History Record system before anything else
The DHR is the core output of ISO 13485. Design it to capture: material lot references, process records at every stage, critical process parameters, inspection results, and QA release.
3
Engage a NABCB-accredited CB with medical device scope specifically
Not all CBs that certify ISO 9001 are accredited for ISO 13485. Verify the medical device scope before engaging.
Good records are the foundation. A process tracker builds them automatically.
Clicarity — Live Job Process Tracker & Bottleneck Identifier
Clicarity doesn't build your QMS or write your DHFs. It tracks your production jobs — and that tracking creates the Device History Record that ISO 13485 requires for every manufactured batch.
ISO 13485 requires a Device History Record (DHR) for every production batch — a traceable record showing that the device was manufactured in accordance with the Device Master Record. This includes: raw material lot numbers, process records at each step, critical process parameters, inspection results, and QA release. In Clicarity, every production job is a job with stages configured for your manufacturing process. When a batch splits into device variants (different sizes, configurations), each variant is tracked independently through its own inspection. When they rejoin at QA release, the complete DHR of every variant is preserved in one traceable batch record.
Material certificate reference captured at goods-in — the raw material traceability link at the start of every DHR.
Critical process parameters (heat treatment temperature, soak time) captured at the relevant stage — process verification evidence within the DHR.
When a batch splits into device variants, each is inspected and released independently. Complete inspection record for every variant preserved at DHR level.
UDI confirmation at labelling stage — the regulatory traceability requirement captured as part of the QA release step, not as a separate documentation exercise.
📄 Job tracked in Clicarity
#WO-7712 — Medical device — surgical scissors batch 500 units
DHF / Job created
✎Device name
✎Device classification
✎Customer / market
#Batch size
▼Authorised by — QMS
→
Raw material receipt
▼Supplier
✎Material cert. no.
✎Lot / heat no.
#Qty received
▼Received by
📷CoC received
→
Machining / forming
#Qty in
#Qty out
#Rejects
▼Operator
▼Machine no.
▼First-off inspection done
→
Heat treatment
#Qty in
#Qty out
▼Furnace no.
#Temp (°C)
#Soak time (min)
▼Operator
▼ Job splits — each component tracked independently
#WO-7712-A
Standard tip — 300 units
▼Operator
#Qty
▼Drawing rev. confirmed
#WO-7712-B
Curved tip — 200 units
▼Operator
#Qty
▼Drawing rev. confirmed
▲
Components rejoin as #WO-7712 — complete record of every branch, every data point, every sign-off preserved.
Passivation / finishing
#Qty in
#Qty out
▼Process type
▼Operator
▼Inspection done
→
Dimensional & functional inspection
▼Inspector
#Sample size
▼Pass / Fail
✎Test report ref.
📷Photo
→
Sterilisation release & labelling
✎Batch no. on label
📅Expiry date
▼QA release by
▼UDI on label confirmed
#Qty released
Wastage tracked:▰ Heat treatment: critical process parameters (temp + soak) recorded per batch▰ Each tip variant tracked through inspection independently▰ UDI confirmed on label before QA release — traceability requirement
ⓘ Fields and stage names are fully customisable. This illustrates a typical medical device manufacturer — ISO 13485 QMS setup.
👥 Illustrative case — details changed for confidentiality
The business
Surgical instrument manufacturer Jalandhar · 130 employees, supplying hospitals and exporting to Middle East
The trigger
A UAE hospital group asked for ISO 13485 certification as a condition of a supply agreement. The manufacturer had ISO 9001 but not ISO 13485.
The challenge
Their gap analysis showed that device history records (DHRs) were the biggest gap. Jobs moved through production but there was no stage-wise traceable record linking each batch to its raw material certificates, process records, and inspection reports in one place.
Where Clicarity came in
They had been using Clicarity for production tracking. Each job captured the full stage record: material certificate reference at receipt, operator at every stage, critical process parameters (heat treatment temp and soak), and inspection results. When batches split into tip variants, each was tracked and inspected independently. Their ISO 13485 consultant confirmed that the Clicarity job records, with added UDI confirmation at labelling, formed the foundation for the DHR requirement.
The result
ISO 13485 certification achieved in 8 months. UAE supply agreement signed.
We already had most of the DHR data in Clicarity. The main change was adding the UDI confirmation field at the labelling stage and ensuring the material certificate reference was always captured at receipt.
Clicarity is a process tracking tool. It does not provide certification, consulting, or audit services.