Knowledge base

ISO 13485 Documentation: What You Need to Maintain

ISO 13485 requires medical device organisations to maintain certain documents and records to show that their quality management system, products, processes, and regulatory responsibilities are properly controlled.

Neha Dvivedi · ١٦ أغسطس ٢٠٢٦

1. Documents You Must Maintain

Your organisation should maintain:

• Quality Manual – including the scope of the QMS, reasons for any exclusions, required procedures, and how different processes are connected.

• Quality Policy and Quality Objectives – what the organisation commits to achieving for quality.

• Medical Device File – information for each type or family of medical device.

• Required Procedures – procedures specifically required by ISO 13485.

• Process Documentation – documents needed to properly plan, operate, and control processes.

• Regulatory Documentation – documents explaining the organisation's responsibilities under applicable medical device regulations.

2. Procedures Specifically Required by ISO 13485

Depending on your organisation and products, procedures are required for areas such as:

• Document and record control

• Management review

• Employee competence, training, and awareness

• Work environment and contamination control

• Risk management

• Design and development

• Purchasing and supplier control

• Process and software validation

• Sterilisation and sterile barrier systems

• Product identification and traceability

• Product preservation

• Customer feedback

• Complaint handling

• Reporting to regulatory authorities

• Internal audits

• Control of nonconforming products

• Data analysis

• Corrective action

• Preventive action

Note: Some requirements apply only where relevant to the organisation, product, or process.

3. Records You Need to Keep

ISO 13485 requires organisations to retain evidence that activities were actually carried out. Important records include:

• Management review results

• Employee competence and training records

• Design and development records, including reviews, verification, validation, transfer, and changes

• Risk management records

• Supplier evaluation and monitoring records

• Process validation results and revalidation records

• Sterilisation records for each batch

• Product traceability records, particularly for implantable devices

• Production records for each batch or lot

• Complaint records and reportability assessments

• Reports submitted to regulatory authorities

• Advisory notices and field action records

• Nonconforming product, rework, and concession records

• Internal audit results

• CAPA records, including evidence that corrective/preventive actions were effective

4. Medical Device File

The Medical Device File (MDF) is an important ISO 13485 requirement. It should be maintained for each device or device family.

It should contain or refer to information such as:

• Product description and intended use

• Labelling and instructions for use

• Product specifications

• Manufacturing and packaging requirements

• Storage, handling, and distribution requirements

• Measurement and monitoring procedures

• Installation requirements, where applicable

• Servicing procedures, where applicable

5. How Long Should Records Be Kept?

Records should generally be retained for at least the lifetime of the medical device, as defined by the organisation.

However, the retention period must not be shorter than the period required by applicable regulations.

Therefore, the organisation should clearly:

1. Define the expected lifetime of the device.

2. Document the basis for that decision.

3. Define the corresponding record-retention period.

If the device lifetime is not defined, auditors may question how the organisation decided how long records should be retained.

6. Practical Points to Remember

Keep the Risk Management File updated.

It should not remain unchanged after the product is launched. Complaint information, production problems, and post-market information should be reviewed and incorporated where relevant.

Assess every complaint for reportability.

Don't just record the complaint. Document whether it needs to be reported to a regulatory authority — including when the conclusion is that reporting is not required.

Check CAPA effectiveness.

Closing a CAPA is not enough. You should verify whether the action actually solved the problem and keep evidence of that verification.

Validate relevant software.

Software used in production, monitoring, or the quality management system may need validation based on its intended use and risk. This is an area organisations often overlook.

7. Common ISO 13485 Audit Findings

Auditors commonly identify issues such as :-

1. CAPA is closed without checking whether it was effective.

2. Complaints are recorded but their regulatory reportability is not assessed.

3. Design records show an unrealistic or inconsistent sequence of activities.

4. A process is not validated even though its output cannot be fully verified by later inspection or testing.

5. The Risk Management File has not been updated with post-market information.

6. Software used within the QMS has not been appropriately validated.

7. Record-retention periods are unclear because the device lifetime has not been defined.

8. Supplier controls do not match the supplier's potential impact on the medical device.

What this covers

ISO 13485

See how this looks as a working system

Reading about a requirement and seeing the documentation that satisfies it are different things. In a short demo we open the actual manual, procedures and records set for ISO 13485, show you how each clause is answered and where your existing way of working already fits. You will know what implementation involves before you commit to it.