Is ISO 13485 certification legally required to sell medical devices?

It depends on the market. ISO 13485 certification is effectively mandatory to sell medical devices in the European Union (required under the EU Medical Device Regulation) and is required or strongly expected by many other national regulators worldwide. In the United States, FDA does not require ISO 13485 certification itself, but instead enforces its own Quality System Regulation (21 CFR Part 820) — however, FDA has been harmonizing 21 CFR 820 with ISO 13485 (a rule finalized to align the two frameworks), and in practice most device manufacturers selling internationally maintain a single ISO 13485-based QMS that also satisfies FDA requirements, rather than running two separate systems.

What is the difference between design verification and design validation?

Design verification confirms that the design outputs meet the design inputs — essentially, "did we build the device correctly according to its own specifications?" — and is typically demonstrated through engineering testing like dimensional inspection, electrical safety testing, or mechanical fatigue testing against a written requirement. Design validation confirms that the finished device meets user needs and intended uses in the actual (or simulated) use environment — essentially, "did we build the correct device?" — and typically involves simulated or actual clinical use, human factors/usability testing, and confirmation that the device performs its intended function for its intended users. A device can pass verification (it meets every internal specification) and still fail validation if those specifications didn't actually capture what users or patients truly needed.

What is a Design History File and why does it matter so much during an FDA inspection?

A Design History File (DHF) is the compiled record of everything that happened during a device's design and development process — design inputs, design outputs, verification and validation records, design reviews, risk management documentation, and design changes — organized to demonstrate the design was developed in accordance with the approved design plan and applicable regulations. During an FDA inspection or ISO 13485 audit, the DHF is often the single most heavily scrutinized document set, because it is the auditable proof that a company's design controls process was actually followed in practice, not just documented on paper as a policy. A missing or incomplete DHF is one of the most common and most serious findings in FDA Form 483 observations and warning letters.

Engineering·9 min read·August 7, 2026

📐 ISO 13485 Quality Management Systems for Medical Devices

An engineering-focused guide to ISO 13485, the international quality management system standard for medical device manufacturers — design controls, document control, CAPA, and how ISO 13485 relates to FDA's Quality System Regulation.

By EngineersUniverse Editorial Team

Engineering Editorial & Technical Review Team

Published August 7, 2026

Why Medical Devices Need a Dedicated Quality System Standard

ISO 13485 is the international standard specifying requirements for a quality management system (QMS) specific to organizations involved in the design, production, and servicing of medical devices. It is derived from the more general ISO 9001 quality management framework but diverges from it in important ways — ISO 13485 places much heavier emphasis on regulatory compliance, risk management, and documented traceability throughout the product lifecycle, and (unlike ISO 9001) does not require continual improvement as an organizational objective, on the reasoning that a medical device QMS's overriding priority is maintaining a validated, controlled state of consistent product safety rather than open-ended process optimization. For a biomedical engineer, ISO 13485 is not simply a corporate compliance program running alongside the "real" engineering work — it is the structural framework the engineering work itself is required to operate inside, from the very first design input document through post-market surveillance of a device already on the market.

Design Controls: The Engineering Core of ISO 13485

The section of ISO 13485 (and its FDA counterpart, 21 CFR 820.30) most directly relevant to day-to-day engineering work is design controls — a structured, documented process governing how a device moves from user need to finished, verified, and validated design. Design controls are not simply good engineering practice formalized on paper; they are a legally enforceable requirement whose absence or inadequacy is one of the most common findings in FDA inspections and warning letters.

Design Inputs

Design inputs are the documented physical, functional, performance, and regulatory requirements a device must meet — essentially, a translation of user needs and intended use into specific, testable engineering requirements. A vague input like "the device should be safe for patients with limited hand dexterity" is not sufficient; a proper design input specifies something testable, such as "the device shall be operable by a user applying no more than X newtons of grip force, verified per test method Y."

Design Outputs

Design outputs are the actual results of the design effort — drawings, specifications, source code, manufacturing procedures — that must be traceable back to specific design inputs. This traceability (often maintained in a formal requirements traceability matrix) is what lets a reviewer confirm that every input requirement has a corresponding output that satisfies it, and conversely, that no output exists without a documented reason for its inclusion.

Design Verification and Design Validation

As covered in this article's FAQ, verification confirms the design outputs meet the design inputs ("built it correctly"), while validation confirms the finished device meets user needs in actual or simulated use ("built the correct thing"). Both are required, and they are not interchangeable — a device can be internally self-consistent and specification-compliant (verified) while still failing to serve the clinical need it was meant to address (not validated).

Design Reviews and Design Changes

Formal design reviews at defined milestones — with documented attendees, discussion, and action items — provide a structured checkpoint where design adequacy is assessed against requirements before the project proceeds to the next phase. Any subsequent design change, however small, must go through a controlled change process with its own risk assessment and re-verification/re-validation as appropriate, precisely because an uncontrolled change to a validated design can silently invalidate the safety and effectiveness evidence the original validation established.

Document Control and Records

ISO 13485 requires rigorous control over both documents (procedures, work instructions, specifications — the things that tell people what to do) and records (test results, inspection reports, training records — the evidence that it was actually done). Document control ensures only the current, approved revision of any procedure is in use at any point in the organization, with a clear approval and revision history; record control ensures the objective evidence of quality activities is retained, retrievable, and protected from unauthorized alteration for the retention periods regulation requires.

CAPA: Corrective and Preventive Action

The CAPA system is the QMS's structured process for investigating and resolving quality problems — whether identified internally (in-process defects, internal audit findings) or externally (customer complaints, field failures, regulatory findings) — and for identifying and addressing potential problems before they occur. A well-functioning CAPA system distinguishes between a correction (fixing the immediate nonconforming instance), a corrective action (addressing the root cause so the same nonconformance doesn't recur), and a preventive action (addressing a potential nonconformance that hasn't happened yet but has been identified as a risk). CAPA effectiveness — genuinely closing the loop on root cause rather than just documenting a fix — is one of the areas FDA inspectors and ISO 13485 auditors scrutinize most closely, because a weak CAPA system is a leading indicator of a QMS that reacts to problems without actually preventing their recurrence.

ISO 13485 and FDA's Quality System Regulation

FDA's own quality system requirement, the Quality System Regulation (21 CFR Part 820), has historically been a separate — though conceptually very similar — framework from ISO 13485. FDA has moved to harmonize the two, amending 21 CFR 820 to incorporate ISO 13485 by reference, which is steadily reducing the historical burden of maintaining two parallel quality systems for companies selling in both the US and international markets. For an engineer, the practical takeaway is that the underlying discipline — documented design inputs and outputs, verification distinct from validation, controlled design changes, and a functioning CAPA system — is now close to a single, globally consistent expectation rather than two competing sets of paperwork.

Topics covered

ISO 13485medical device quality management systemQMS medical devicedesign controls medical devicedesign history fileCAPA corrective preventive actionFDA QSR 21 CFR 820design verification vs validation

📚 Continue in the Biomedical Engineering

🎓

Applied Biomedical Engineering Professional Program

✨ Premium Content

A structured, paid professional training program for this discipline.

$4.99

🔬

Also explore the Materials Science & Metallurgy Studio

A related engineering discipline with its own tools, calculators, and articles.

📬 Get new engineering guides in your inbox

New calculators, interactive readers, and reference guides — no spam, unsubscribe anytime.

Put this knowledge to work on your iPhone

Browse our full catalog of professional iOS apps — from electrical code tools to AI builders.

Browse All 95+ Apps