ISO 13485:2016 Medical Devices Quality Management System Certification
ISO 13485:2016 is the international standard specifying requirements for a Quality Management System (QMS) for medical devices and related services. The standard enables an organization to demonstrate its ability to consistently provide medical devices and related services that meet customer and applicable regulatory requirements, with an overarching focus on safety, intended performance and risk control.
ISO 13485 applies to organizations involved in one or more stages of the medical device life cycle, including design and development, production, storage, distribution, installation, servicing, decommissioning and disposal. It may also be applied by suppliers or external parties that provide products, components, processes or services related to the QMS. The scope of application should accurately reflect the organization's legal role, device groups, sites, actual activities and responsibilities.
ISO 13485:2016 is the current edition and was reviewed and confirmed by ISO in 2025. Developed specifically for the medical device sector, the standard places greater emphasis than ISO 9001 on regulatory requirements, risk management, documentation and traceability, controlled environments, process validation and post-production activities. ISO 13485 requires the organization to maintain the suitability, adequacy and effectiveness of its QMS and to implement necessary improvements; it does not apply the concept of continual improvement in the same general manner as ISO 9001.
Risk management under ISO 13485 is not limited to product risks but is also appropriately applied to QMS processes. For product risk management throughout the life cycle, ISO 14971:2019 provides a sector-specific framework for identifying hazards, estimating and evaluating risks, controlling risks, evaluating residual risks and monitoring the effectiveness of risk controls. Applying ISO 14971 supports implementation, while QMS certification is conducted against the requirements of ISO 13485:2016.
Key technical requirements of ISO 13485:2016 include:
- Scope, legal role and QMS documentation: Determine whether the organization acts as a legal manufacturer, designer, contract manufacturer, distributor, installation/service provider or supplier; control the quality manual, procedures, records and a medical device file for each device type or device family.
- Management responsibility and resources: Establish policies, objectives, responsibilities and management review arrangements; ensure personnel competence, infrastructure, work environment, product cleanliness and contamination control appropriate to the devices and processes.
- Risk-based approach: Apply controls proportionate to risk across QMS processes; connect device risk management with design, supplier selection, production, changes, complaints and post-production data.
- Design and development: Plan and control design inputs and outputs, reviews, verification, validation, design transfer and changes; maintain evidence of traceability among requirements, risks, control measures and evaluation results.
- Purchasing, suppliers and outsourced processes: Select, evaluate, monitor and re-evaluate suppliers according to risk; define purchasing requirements, verify incoming products and retain responsibility for outsourced processes.
- Production and service provision: Control production instructions, equipment, process parameters, identification and traceability, customer property, preservation, installation and servicing; validate processes whose results cannot be fully verified by subsequent monitoring or measurement, including sterilization processes where applicable.
- Software, measurement and sterile devices: Validate software used in the QMS, production and service provision in proportion to risk; control monitoring and measuring equipment, sterilization records, sterile barrier systems and traceability for implantable devices where relevant.
- Feedback, complaints and post-production action: Collect feedback, handle complaints, report to regulatory authorities, issue advisory notices, control nonconforming products, analyze data and implement corrective and preventive action (CAPA).
Benefits of implementing and obtaining ISO 13485:2016 certification
- Greater regulatory readiness: Establish mechanisms for identifying, updating and incorporating the regulatory requirements of target markets into design, production, distribution and post-production activities.
- Life-cycle risk management: Connect data from design, production, suppliers, complaints and post-market surveillance to maintain control of risks to patients, users and other relevant parties.
- Improved consistency and traceability: Control documents, records, batch/serial identification, production history, changes and product status to the extent appropriate for each device type.
- Stronger supply-chain control: Classify and monitor suppliers, outsourced processes, critical components, sterilization services, testing or contract manufacturing based on risk.
- Fewer errors and lower quality costs: Proactively address trend data, nonconforming products, complaints, root causes and CAPA to reduce recurrence, returns, recalls and disruptions.
- Greater confidence and market access: Provide independent evidence to customers, regulatory authorities, importers, distributors, partners and international supply chains.
- Easier system integration: Integrate with ISO 9001, ISO 14971, ISO/IEC 27001 and other sector-specific requirements according to the organization's role, products and target markets.
GIC Vietnam provides independent ISO 13485:2016 medical device quality management system certification services for organizations seeking to demonstrate the conformity of their QMS within a defined scope. The certification audit considers both the requirements of the standard and how the organization identifies and implements regulatory requirements relevant to its role and the products covered by the certification scope.
ISO 13485 certification is management system certification, not certification or approval of an individual medical device. It does not automatically replace market registration, licensing, product conformity assessment, CE marking, regulatory approval or authorization, or post-market surveillance obligations. Certification also does not provide an absolute guarantee that products will be free from defects or that incidents will not occur.
This service is suitable for:
- Legal manufacturers, design and development organizations, or manufacturing facilities for medical devices and in vitro diagnostic medical devices.
- Organizations developing software as a medical device, embedded software or digital health solutions subject to applicable regulatory requirements.
- Contract manufacturers and organizations providing processing, assembly, packaging, labeling, sterilization, critical components or critical processes.
- Importers, distributors, logistics providers, installers, maintenance providers, calibration providers or technical service providers for medical devices.
- Suppliers of raw materials, components, packaging, software, testing services or QMS-related services that may affect device conformity.
- Organizations requiring certification to meet regulatory, customer, tender or export requirements, supplier assessment criteria, or medical device supply-chain requirements.
1. Certification application & application review
The organization contacts GIC Vietnam for guidance and provides information on the QMS scope, legal role, medical device groups and risk classifications, design activities, sites, personnel, shifts, target markets, manufacturing technologies, and sterile, implantable or active devices, IVDs or software where applicable. Information is also provided on special processes, sterilization, critical suppliers and outsourced activities. GIC Vietnam reviews the application to determine the scope, technical group, auditor competence, audit duration, sites and audit conditions, and then agrees on the certification fees and contract.
2. Audit planning & preparation
GIC Vietnam establishes the certification programme, appoints an audit team with competence appropriate to the medical device groups, technologies and processes within the scope, and prepares a detailed audit plan. The plan defines the objectives, scope, criteria, sites, timing, shifts, design/production/service processes and activities to be sampled. It is communicated to enable the organization to prepare documents, device records, personnel, controlled areas and necessary safety arrangements.
3. Audit process
The audit is conducted in two stages:
- Stage 1: Review the scope, legal role, applicability or exclusions, QMS documentation, medical device files, regulatory requirements, risk management processes, internal audits, management review and readiness for the Stage 2 audit.
- Stage 2: Evaluate the implementation, conformity and effectiveness of the QMS at the sites, processes and shifts covered by the certification scope. Sampling focuses on regulatory controls; design and risk management; purchasing, suppliers and outsourcing; production, cleanliness and sterility; process and software validation; identification, traceability and preservation; installation and servicing; feedback, complaints, regulatory reporting, nonconforming products and CAPA. The main activities include: Opening meeting → On-site observation → Interviews and record review → Consolidation of findings → Closing meeting.
4. Audit report & nonconformity handling
The audit team prepares a report setting out its conclusions and any nonconformities identified. Where necessary, the organization must immediately control affected products, processes or records; take immediate correction, evaluate risks and the extent of impact, analyze root causes, and propose and implement corrective actions within the specified timeframe. Responsibility for determining the need for regulatory reporting, advisory notices, field action or recalls remains with the organization. GIC Vietnam reviews the evidence and may conduct a follow-up audit before certification review.
5. Review & certification
A person independent of the audit team reviews the complete file, audit report, corrective-action evidence and conclusions concerning the effectiveness of the QMS, and makes the certification decision. When the file meets all requirements, GIC Vietnam makes the decision and issues an ISO 13485:2016 certificate clearly identifying the certified activities, medical device groups and sites. The certificate remains valid throughout a three-year certification cycle, provided that the organization maintains conformity and completes the required surveillance audits.
6. Periodic surveillance and recertification
During the certification cycle, GIC Vietnam conducts periodic surveillance audits to confirm that the QMS continues to be maintained and remains effective. The first surveillance audit is conducted no later than 12 months from the date of the initial certification decision. The organization must notify GIC Vietnam of significant changes to its legal role, scope, medical devices, risk classifications, design, sites, manufacturing processes, sterilization, critical suppliers, ownership, or incidents, recalls and regulatory actions that may affect certification. Before the certificate expires, the organization undergoes a recertification audit for renewal into the next certification cycle.
International reputation and broad recognition
GIC is a reputable certification body whose services are widely recognized through accreditation marks from leading accreditation bodies such as UKAS (United Kingdom), JASANZ (Australia–New Zealand), CPSC (United States), SAC (Singapore), CNAS (China) and VICAS (Vietnam). Certificates issued by GIC are recognized globally through the mutual recognition arrangements (MRAs) of Global ACI and APAC. This helps organizations reduce technical barriers and gain easier access to international markets.
Professional service & cost effectiveness
GIC Vietnam provides services in accordance with the stringent standards of Europe and North America, ensuring independence, impartiality and professionalism throughout the certification audit process. Alongside high-quality service, GIC offers reasonable and competitive fees, enabling organizations to use their resources efficiently while obtaining certification recognized in accordance with international practices.
GIC VIETNAM
🏢 Hanoi: 12F, 14 Lang Ha Building, Giang Vo Ward
☎ Tel: 024 6275 2268 | Hotline: 0984 609 469
✉ Email: tuandm@gicvn.vn
🏢 Ho Chi Minh City: R502, 160 Nam Ky Khoi Nghia
☎ Tel: 028 3930 7936
