ISO 13485:2016 Audit-Readiness Rubric — Medical Devices QMS

What this is: Medical devices — Quality management systems — Requirements for regulatory purposes. Relevant to Regscribe wherever a pharma/biotech customer also manufactures or develops a medical device, combination product, or SaMD (software as a medical device) — increasingly common given device/drug convergence (drug-device combos, companion diagnostics, connected delivery systems).

Sourcing note: ISO 13485's full clause text is copyrighted and sold by ISO (CHF ~145 on iso.org; iso.org's own Online Browsing Platform preview returned HTTP 403 to automated fetch this session, so it was not used even for a preview read). No verbatim clause text is used below — this is structure and paraphrase built from secondary sources: certification-body and consultancy pages (BSI, TÜV SÜD, Advisera, SimplerQMS, ISO Cloud Consulting, MedDeviceGuide, Qualio, Smithers, DQS), cross-checked across multiple independent sources for the clause/sub-clause numbering. Where only one source confirmed a specific sub-clause number, that's noted. FDA's own fda.gov QMSR pages returned HTTP 404 to direct fetch this session (URLs may have moved); NSF's and AAMI's QMSR explainer pages returned HTTP 403. The FDA QMSR facts below are therefore sourced from search-result snippets of those pages, not a direct page fetch — weaker sourcing than the rest of this document, flagged explicitly, and worth a follow-up direct-fetch pass (e.g. via federalregister.gov for the actual final rule text) before this goes into production scoring.

Rubric legend

Each row: Requirement (plain language) → Citation → Evidence that demonstrates compliance → Common failure pattern

Failure patterns are drawn from consultancy/audit-preparation write-ups describing patterns seen across ISO 13485 certification and FDA inspections (MedDeviceGuide, ISO Cloud Consulting) — not verbatim Notified Body or FDA inspection reports the way the GMP/GDP rubric uses named MHRA data. No source this session provided a citable, named database of ISO 13485 Notified Body findings equivalent to MHRA's published deficiency-trend PDFs — flagged as a gap below.

Clause 1–3 (not auditable — reference only)

Clause 1 Scope, Clause 2 Normative References (explicitly references ISO 9000:2015 for terms and definitions), Clause 3 Terms and Definitions. Clauses 4–8 are the auditable requirements that registrars and FDA investigators sample during an audit — structurally similar to ISO 9001:2008's five-clause layout (4 QMS / 5 Management Responsibility / 6 Resource Management / 7 Product Realization / 8 Measurement, Analysis, Improvement), confirmed against multiple sources. ISO 13485:2016 does NOT use the Annex SL "harmonized structure" (the 10-clause layout ISO 9001:2015 and ISO 27001:2022 use) — this is a deliberate, confirmed divergence, not an oversight, because ISO 13485 predates Annex SL's adoption cycle and its maintainers have kept the older structure for stability of certification/regulatory cross-references.

Clause 4 — Quality Management System

Clause 5 — Management Responsibility

Clause 6 — Resource Management

Clause 7 — Product Realization

7.1 Planning of product realization (the risk-management anchor clause)

7.2 Customer-related processes

7.3 Design and development

7.4 Purchasing

7.5 Production and service provision

7.6 Control of monitoring and measuring equipment

Clause 8 — Measurement, Analysis, and Improvement

Key differences from ISO 9001 (why this can't just be scored against the existing ISO 9001-adjacent logic)

1. Purpose is regulatory compliance, not customer satisfaction. ISO 13485's own title says "Requirements for regulatory purposes." Where ISO 9001 is built around a customer-satisfaction feedback loop, ISO 13485 explicitly subordinates customer requirements to regulatory requirements where the two conflict (§5.2), and the "continual improvement" language of ISO 9001 is deliberately narrowed — ISO 13485 requires QMS effectiveness to be maintained, not open-ended continual improvement, reflecting that unconstrained change in a regulated device QMS is itself a risk.
2. Risk management is required throughout the product lifecycle, explicitly linked to ISO 14971, and threaded through design (§7.3.9), production/service (§7.5.6), and post-market feedback (§8.2.1) — not a bolt-on risk register the way a generic ISO 9001 risk-based-thinking approach might be implemented.
3. Medical Device File (§4.2.3) and Design and Development File (§7.3.10) are unique, prescriptive, per-device/per-device-family documentation requirements with no ISO 9001 equivalent.
4. Design controls (§7.3) are materially more prescriptive — ISO 9001:2015 treats design and development as one general clause; ISO 13485:2016 breaks it into 10 granular sub-clauses (planning, inputs, outputs, review, verification, validation, transfer, changes, file) that closely mirror FDA's own historical Design Controls framework (21 CFR 820.30 pre-QMSR).
5. Traceability (§7.5.9) and sterile-product requirements (§7.5.5, §7.5.7) have no ISO 9001 counterpart at all — these exist because device failure traceability and sterility assurance are patient-safety-critical in a way generic manufacturing quality isn't.
6. Post-market surveillance/vigilance (§8.2.1, §8.2.3) — mandatory regulatory-authority adverse-event/field-safety reporting has no ISO 9001 equivalent; ISO 9001's customer-feedback clause is voluntary/business-driven by comparison.
7. The Quality Manual remains mandatory (§4.2.2) — ISO 9001:2015 dropped this requirement in its 2015 revision; ISO 13485:2016 kept it, a frequently-cited "gotcha" for anyone assuming ISO 13485 tracks the current ISO 9001 documentation-lightening trend.

Sources: Smithers, Qualio, Dot Compliance, DQS Global comparison write-ups (converged independently on points 1–3 and 6–7; cross-checked against the clause table above for points 4–5).

FDA QSR → QMSR harmonization (21 CFR 820)

Confirmed, multi-source: FDA published the Quality Management System Regulation (QMSR) final rule on February 2, 2024, amending 21 CFR Part 820 to incorporate ISO 13485:2016 by reference as the core quality-system requirement for most device manufacturers, replacing the standalone Quality System Regulation (QSR) text that had existed largely independently of ISO 13485 since 1996. The rule is effective February 2, 2026 — i.e., live under the "today's date" of this document (29 July 2026, per the environment context this rubric was produced in) — meaning FDA has already transitioned its device-manufacturer inspection framework away from the old Quality System Inspection Technique (QSIT) toward an inspection process aligned to ISO 13485 structure (FDA's updated compliance program guidance, referenced in source snippets as "7382.850").

What's retained/added on top of ISO 13485 (this is the part device manufacturers can't skip even if fully ISO 13485-certified):

• §820.10 — links in additional FDA-specific applicable requirements: Medical Device Reporting (21 CFR Part 803), Corrections and Removals (21 CFR Part 806), Unique Device Identification (21 CFR Part 830), and Device Tracking — none of which ISO 13485 itself mandates, since ISO 13485 is a generic international standard without US-statute-specific reporting mechanics.
• §820.35 — US-specific control-of-records provisions layered on top of ISO 13485's §4.2.5.
• §820.45 — US-specific device labeling and packaging control provisions.
• ISO 13485's own Clause 3 definitions (plus ISO 9000:2015 definitions) now generally apply under QMSR, except where 21 CFR 820.3(b) or the FD&C Act §201(h) statutory definitions differ and take precedence.

Practical implication for Regscribe's positioning: a US device manufacturer can no longer treat "FDA QSR compliance" as a separate deliverable from "ISO 13485 compliance" — as of the effective date, ISO 13485 conformance is the substantive core of US QSR compliance, with a defined, bounded set of FDA-specific add-ons (the four items above) rather than a fully parallel regulatory text. This is a meaningful product argument for Regscribe: a single ISO 13485-anchored gap analysis, with an FDA-specific overlay module for the four retained/added areas, should be able to serve both EU/international-market and US-market device-QMS customers from largely the same evidence base — directly analogous to the "Evidence Type" layer recommended in the GMP/GDP rubric's Part C for FDA Part 11 / EU Annex 11 overlap.

Update, 2026-07-30 — this overlay is now its own scoreable rubric, not just an informational note. The four bullet points above were originally sourced from search-result snippets only (see the original sourcing caveat below) and existed purely as narrative context — not as requirement rows Regscribe's pipeline could actually score against. Re-verification found the informal "effectively subsumed" framing this section originally implied was an overstatement: these four areas are real, checkable gaps an ISO-13485-only review would miss entirely. They've now been primary-source-verified (direct eCFR fetch, not snippets) and built out into a proper requirement-by-requirement rubric: cfr820-qmsr-delta-rubric.md (registry id cfr820-qmsr). For any US-market device-QMS document, run both rubrics together — this one for the ISO 13485 substantive core, the delta rubric for the four FDA-specific add-ons. The delta rubric supersedes this section as the source of truth for §820.10/§820.35/§820.45 detail; what remains below is kept for narrative context and is no longer the primary reference for those clauses.

Original sourcing caveat (superseded by the delta rubric's primary-source fetch, kept for history): the above was built from search-result snippets of NSF, AAMI, and FDA's own QMSR pages (all three returned HTTP 403/404 to direct fetch that session) plus a BSI blog post (also 403'd on direct fetch). All three independent snippet sources agreed on the February 2, 2024 publication / February 2, 2026 effective date and the four retained-provision areas, which gave reasonable confidence at the time — this has since been confirmed against a direct eCFR fetch and the actual Federal Register final-rule text (89 FR 7496) in the delta rubric.

Common audit findings / failure patterns (cross-clause summary)

No source located this session provides a named, quantified deficiency database for ISO 13485 equivalent to MHRA's published GMP/GDP deficiency-trend PDFs used in the GMP/GDP rubric — flagged as a real sourcing gap, not filled with fabricated statistics. The pattern summary below is qualitative, drawn from convergence across ISO Cloud Consulting's "top 10" write-up and MedDeviceGuide's per-clause breakdown (both consultancy sources, not primary regulator data):

1. CAPA (§8.5.2) — the single most consistently cited weak area. Root cause recorded as "human error" without deeper investigation; corrective actions treat symptoms; effectiveness not verified before closure; repeat nonconformities from the same underlying cause.
2. Design controls / Design History File (§7.3, esp. §7.3.10) — incomplete files lacking verification protocols or design review records; vague, unmeasurable design inputs; broken input→output→verification→validation traceability.
3. Risk management file (§7.1, cross-referenced to ISO 14971) — risk files created once at initial certification and never updated after subsequent design or production changes; risk files misaligned with what was actually built, tested, and released.
4. Document control (§4.2.4) — obsolete documents still in active use; incomplete/unclear revision histories; inconsistent control across multiple manufacturing sites.
5. Internal audits (§8.2.4) — checklist-only audits with poor sampling and insufficient auditor independence/objectivity; audit programs not risk-adjusted for organizational change, leaving some processes unexamined across multiple cycles.
6. Supplier/purchasing controls (§7.4) — approved supplier lists outdated or incomplete; missing periodic re-evaluation; absent quality agreements for critical suppliers.
7. Training/competence (§6.2) — training tracked as "completed" without documented competency evaluation against the current procedure revision.
8. Traceability (§7.5.9) — traceability chains that don't reach the actual distribution consignee, which is precisely the gap that would compromise an actual field recall.

Documents/evidence needed for an ISO 13485 audit

Compiled from Advisera's mandatory-documents enumeration (cross-checked against the clause table above; this is the fullest single-source list found, so flagged as single-sourced where not independently corroborated):

Clause 4: regulatory-role determination; QMS software validation procedure/records; Quality Manual; Medical Device File (per device/device family); document control procedure; record control procedure.

Clause 5: quality policy; quality objectives; defined responsibilities/authorities; management review procedure and records.

Clause 6: training procedure and competency records; infrastructure/maintenance records; work-environment and contamination-control records.

Clause 7: risk management process documentation (risk management plan + risk management file, ISO 14971-anchored); product-realization planning outputs; customer requirement review records; Design and Development File / Design History File (plan, inputs, outputs, review, verification, validation, transfer, change-control records); purchasing procedure and supplier evaluation/re-evaluation records; purchased-product verification records; production/batch records; traceability records (lot genealogy through distribution consignee; component-level for implantables); sterilization batch-parameter records and sterile-barrier validation records where applicable; process validation records; calibration records; software validation records for production/measurement software.

Clause 8: post-market feedback/surveillance procedure and records; complaint-handling log; regulatory-authority reporting records (vigilance/adverse-event); internal audit program and reports; nonconforming-product disposition records; rework verification records; data-analysis reports; CAPA log with root-cause and effectiveness-verification fields; preventive-action log.

Certification process (flagged as generic industry pattern, not independently re-confirmed against a 13485-specific CB source this session)

ISO 13485 certification is expected to follow the same general two-stage model used for ISO 9001/27001 (Stage 1 documentation/readiness review, Stage 2 on-site audit verifying operation in practice; 3-year certificate validity with annual surveillance audits) — this is standard UKAS/IAF-accredited-body practice generally, but no BSI- or TÜV-SÜD-specific page was successfully fetched this session confirming the 13485-specific timing/nonconformity-classification scheme the way the ISO 27001 checklist confirmed it directly from BSI. Treat as reasonable inference, not verified fact, until a direct CB source is fetched. Note also that in many jurisdictions ISO 13485 certification is bundled with MDSAP (Medical Device Single Audit Program — a single audit accepted by US FDA, Health Canada, Australia's TGA, Brazil's ANVISA, and Japan's MHLW/PMDA) — not researched this session, flagged as a follow-up given its direct relevance to any Regscribe customer selling into multiple MDSAP-participating markets.

Gaps / follow-ups

1. iso.org OBP returned HTTP 403 to automated fetch — the clause/sub-clause numbering above is cross-checked across 4+ independent secondary sources but was never verified against ISO's own (even preview-level) page directly.
2. fda.gov QMSR pages returned HTTP 404 (URLs likely stale/moved); NSF and AAMI QMSR explainer pages returned HTTP 403. The FDA QMSR section above relies on search-result snippets of these pages rather than direct fetches — recommend a follow-up pass via federalregister.gov's hosting of the actual final rule (89 FR 7496, Feb 2, 2024) for primary-source confirmation before this is used in customer-facing scoring logic.
3. No named, quantified ISO 13485 deficiency database (Notified Body or FDA) was located this session, unlike the MHRA GMP/GDP data used in the sibling rubric — the "common audit findings" section above is qualitative/consultancy-sourced, not primary-regulator statistical data. Worth checking FDA's public Form 483 / Warning Letter database (as the Part 11 rubric did) filtered to device-establishment inspections, and/or EU Notified Body annual surveillance reports, in a follow-up pass.
4. MDSAP (multi-jurisdiction combined audit program) not researched this session — flagged above, directly relevant to Regscribe's device-manufacturer customers selling into >1 MDSAP market.
5. ISO 14971:2019 (the risk-management standard ISO 13485 cross-references throughout) was not separately researched as its own rubric — this document treats it as an referenced input to §7.1/§7.3.9/§8.2.1, not as a standalone scored framework. If Regscribe customers need risk-management-file scoring independent of the QMS wrapper, ISO 14971 likely warrants its own rubric document in this same format.
6. IEC 62304 (software lifecycle for medical device software) not researched — relevant given Regscribe's own SaMD/software-adjacent customer base; several sources noted certification bodies commonly expect IEC 62304 evidence alongside ISO 13485 for software-containing devices even though it's a technically separate standard.

Suggested integration note (not implemented — flagging for a decision, not doing it unasked)

This rubric is not yet wired into lib/rubrics.ts (the RUBRICS registry currently only lists part11 and gmp-gdp; the existing iso27001-checklist.md reference doc isn't wired in either, so this follows that same precedent). If ISO 13485 is meant to become a selectable rubric in the product (not just a reference doc like the ISO 27001 checklist), that's a small follow-up: add an iso13485 entry to RUBRICS in /Users/khando/Khando/Dev/Projects/regscribe/lib/rubrics.ts pointing at iso13485-rubric.md, plus whatever test coverage lib/__tests__/rubrics.test.ts expects for a new rubric ID. Flagging rather than doing it, since it wasn't asked for and touches app code/tests.