Your Top 10 Questions About ISO 13485:2016—Answered!

This Q&A will help you develop and implement 
a successful 13485:2016 transition plan.
In early 2016, the International Standards Organization (ISO) published the long-awaited revised version of ISO 13485:2016, the standard which provides device makers with a framework for establishing a quality management system (QMS). Because it is the first major revision to the standard in 13 years, questions abound. In this post, we will tackle the most common questions asked by attendees during the many ISO 13485:2016-centric webinars we offered last year. We will also tap into the expertise of Quality Architech Christine Park, founder and president of Christine Park & Associates, and a frequent contributor to GxP Lifeline. 

#1: “What prompted the revision?” 

There were many factors driving the change, one of which was the fact that the standard was more than a decade old! The industry, as well as medical device products in general, has evolved rapidly—and risks have increased astronomically. As more and more companies attempt to market their products internationally, the need to create a harmonized model for quality management became evident. 

 #2: “I’ve heard ISO 13485:2016 is going to be revised again in 2019? Is this true?” 

Eamonn Hoxey, Vice-President, Medical Devices Quality & Compliance Strategic Programs, Johnson & Johnson Medical Ltd., who served on the 13485 technical committee, was asked this question in October at AdvaMed 2016. His reply: maybe. It’s no secret the decision not to follow the new high-level structure (HLS), which was introduced in ISO 9001:2015 and is expected to be incorporated into all future ISO revisions and standards, caused a significant amount of controversy and delay. To avoid further publication delays, the committee agreed to a compromise: push ahead with publication but review the standard again in 2019.(1) 

Park, who also served on the 13485 technical committee, thinks it is “highly likely” that the 2019 review will signal the need for further revision; however, she does not believe that the HLS conundrum will be the only factor driving the need for change. “The fact that there are so many other ISO revisions in the works, including 14001, 18001 and 14971, as well as the recasting of the Medical Device Directives (MDD) in Europe, means further change is inevitable.”(2) 

This article is related to the Product Data Sheet:
Webinar: ISO 13485:2016 Part 3 - Getting Ready for Changes
To get the full details, please view your free Product Data Sheet.

 #3: “Why didn’t the technical committee incorporate the new HLS into the revision?” 

“The technical committee was so far down the pipeline that making the change would have led to further delays,” said Park. 

 #4: “When is ISO 14969, the guidance document for the application of 13485, going to be revised?” 

It isn’t; however, an implementation handbook is in development which will provide users with relevant guidance and interpretation of the newly revised 13485. It is expected to be released in March of this year. Also in the works is a mapping document intended to support users who choose to adopt the new versions of both ISO 13485 and ISO 9001. Dual certification will be challenging due to the disparate requirements between the standards, so this handbook is highly anticipated. Two questions to consider: How will I reconcile the requirements of the two standards? Is some division of my QMS needed? 

 #5: “Should I certify to both ISO 9001:2015 and ISO 13485:2016?  

It depends on your company and the products you make. For example, a medical device company that also markets research products or non-medical device products would be wise to pursue dual certification, as ISO 9001 certification is relevant to general or industrial products. 

 #6: “I’m up for 13485 recertification in late 2017—should I transition to the 2016 version of the standard? 

Once again, the answer is: it depends. According to Park, the first thing you should do is conduct a gap assessment of your existing QMS to see where you stand. “Don’t be tempted to throw out the baby with the bath water,” said Park. “Chances are you’re already performing many of the processes and procedures outlined in the new requirements, many of which were implicit in ISO 13485:2003; they’re just explicit now. For example, 4.1.5 explicitly states that all automated systems or tools that touch your system must be validated. You’re probably already validating your software. The difference is that now you have to prove it.” 

If your gap assessment is relatively positive, plan to transition to the new standard. However, if you are up for recertification in early to mid-2017, you won’t make it. You will have no choice but to certify twice. 

#7: Will ISO 13485:2016 prompt changes to 21 CFR 820? 

This is not likely since the new version of the medical device standard is more in line with the existing 21 CFR 820. The revised standard supports alignment with FDA terms, such as establish, implement and maintain documented processes. It also clarifies that regulatory requirements include statutes, regulations, ordinances and directives relative to device safety and performance.(3)

 #8: “What are the major differences between ISO 13485:2003 and the latest version, ISO 13485:2016, regarding risk? 

While the 2003 version implies the need to incorporate risk management principals in design controls, the 2016 version requires a risk-based approach for the entire quality management system, including design controls. The newest version of the standard also requires you to consider a risk-based approach for outsourced processes and suppliers. Furthermore, you must ensure that the training third-parties receive is commensurate with the inherent risk of the processes they perform.

In a nutshell, risk is THE most prevailing change in the revised standard—mentioned more than 15 times! All internal processes must be integrated to minimize risk. It should also be incorporated during the processes of: 

  • Verification, validation and revalidation
  • Product planning (i.e., input manufacturing into design considerations) 
  • Documentation of risk management in product realization
  • Monitoring, testing and traceability 
  • Corrective actions and preventive actions (CAPA)

#9: What impact will the revised standard have on company leadership? 

Its impact will be significant. Executive management reviews must specifically address how risk management is incorporated into all of the areas presented in the reviews. Furthermore, ISO 13485:2016 clarifies the responsibilities of top management, emphasizing the effectiveness of the QMS and measurable quality objectives.(4)
Human resources will also be impacted. The revised standard specifies that the organization shall determine any user training needed to ensure specified performance and safe use of the medical device.(5) This is a good thing, according to Park. “Much like 9001:2015, the new 13485 revision makes it clear that quality is not just the responsibility of the quality department,” said Park. Although the verbiage is not as strong in 13485 [as it is in 9001], leadership, as well as other departments, are expected to be more engaged, certainly. The shift indicates that quality now commands a seat at the big kid's table.”  

 #10: How long do I have to certify to the latest version of the standard?


There will be a three-year implementation period before the standard must be fully implemented (by March 1, 2019). Don’t panic—but don’t wait, either. The changes are significant, so it will take time to comply. Watch the many videos (click on the link above) available on our website to learn how you can prepare for a successful transition. 

Lisa Weeks, a marketing communications specialist at MasterControl, writes extensively about technology, the life sciences, and other regulated environments. Her work has appeared in numerous industry publications, including Medical Product Manufacturing NEWS (MPMN), Medtech Pulse, Risk Insights, MD+DI, Pharmaceutical Processing, Genetic Engineering & Biotechnology News (GEN), Today’s Medical Developments and PharmaTech. 

MasterControl GxP Lifeline: Top 7 Takeaways from AdvaMed 2016, (accessed January 30, 2017). 1.
Park, Christine. Interview by author. November 23, 2016. 2.
Questions about ISO 13485:2016, Webinar, May 5, 2016. (accessed January 30, 2017).  3.
ISO 13485:2016 - What Are the Changes About? | MedTech .., (accessed January 30, 2017). 4.
Ibid.  5.

[ { "key": "fid#1", "value": ["GxP Lifeline Blog"] } ]