The definition
A medical device quality management system is the documented set of processes, procedures and records governing how a device is designed, produced, delivered and supported so that it is consistently safe and performs as intended.
The international standard specifying one is ISO 13485. In the United States it is also the FDA's requirement, now harmonized with ISO 13485 under the QMSR — see ISO 13485 and the FDA QMSR.
Why it is not just ISO 9001
Both are quality management systems. The difference is what they optimise for: ISO 9001 targets customer satisfaction and continual improvement, while a medical device QMS targets safety, effectiveness and regulatory compliance. That changes what the system contains.
| Requirement | ISO 9001 | Medical device QMS |
|---|---|---|
| Design controls | General | Prescriptive, with a design history file |
| Risk management | General risk-based thinking | ISO 14971, per device |
| Traceability | Where appropriate | Required, often to unit level |
| Process validation | Where appropriate | Required where output cannot be verified |
| Sterile product | Not addressed | Specific requirements |
| Complaint handling | General | Prescriptive, feeding CAPA |
| Post-market surveillance | Not required | Required |
| Regulatory reporting | Not addressed | Required |
That extra content is why an ISO 13485 engagement costs more than ISO 9001 — see the cost comparison.
What it contains
Quality manual and policy. Scope, processes, and any justified exclusions.
Document and record control. Versioned, approved, retrievable — for the retention periods the regulation requires.
Design controls where you carry design responsibility, including the design history file.
Risk management to ISO 14971, per device, running alongside design rather than after it.
Production and process controls, including validation where output cannot be fully verified by inspection.
Supplier controls. Evaluation, agreements, monitoring.
Complaint handling, CAPA and post-market surveillance. Continuous obligations rather than annual activities.
Internal audit and management review. Both mandatory.
Who needs one
Manufacturers of medical devices, and in most cases their suppliers of critical components and services. It is effectively a prerequisite for market access: the EU, Canada and MDSAP participants all expect it, and the FDA requires an equivalent system for the US.
Contract manufacturers need one too, though typically without design controls if they produce to a customer's specification — which is the single largest variable in scope and cost.
Where to start
Settle design responsibility. It determines the size of everything else.
Define scope. Which devices, which sites, which processes.
Gap-assess. What exists informally that can be formalised, versus what has to be built.
Build for both ISO 13485 and FDA QMSR at once if you sell in the US. Building once is far cheaper than retrofitting.
See ISO 13485 consulting for how an engagement runs.
FAQs
What is a medical device quality management system?
The documented set of processes, procedures and records governing how a medical device is designed, produced, delivered and supported so that it is consistently safe and performs as intended. ISO 13485 is the international standard specifying one, and the FDA's QMSR now incorporates it for the US.
What is the difference between ISO 9001 and a medical device QMS?
ISO 9001 optimises for customer satisfaction and continual improvement. A medical device QMS optimises for safety, effectiveness and regulatory compliance, which adds prescriptive design controls and a design history file, ISO 14971 risk management per device, traceability, process validation, complaint handling, post-market surveillance and regulatory reporting.
Do contract manufacturers need a medical device QMS?
Generally yes, though typically without design controls if they produce to a customer's specification. Clause 7.3 can be excluded with a documented justification in that case, which materially reduces the size and cost of the system.
Is ISO 13485 required to sell medical devices?
It is effectively a prerequisite for most market access. The EU, Canada and MDSAP participants expect it, and the FDA requires an equivalent quality system for the US under the QMSR, which now incorporates ISO 13485 by reference.
What should a medical device manufacturer do first?
Settle design responsibility, because it determines the size of everything else. Then define QMS scope across devices, sites and processes, run a gap assessment to separate what can be formalised from what must be built, and if you sell in the US build for ISO 13485 and FDA QMSR together rather than sequentially.
Where to go next
See ISO 13485 certification, consulting services, or what it costs.