Industry:Medical Devices Added By:Admin Posted On:June 20, 2019
Medical devices sit at the top of the compliance list in healthcare, because the rules that govern them change often and the stakes are high. Devices save lives, so every organization that makes or supplies them has to make sure they are safe and sterile. This article explains the main medical device compliance requirements, from ISO standards to single audit programs and the EU’s device regulations.
Every medical device has to meet the standards of the national and international bodies that govern its use. In the U.S., a device must comply with the requirements set by the FDA. Outside the U.S., manufacturers usually work to ISO standards, which many regulators use as the basis for their own rules.
The two now overlap more than before. The FDA’s Quality Management System Regulation (QMSR), which took effect on February 2, 2026, incorporates ISO 13485:2016 by reference, so U.S. device makers work to the same quality system standard used in many other markets.
Organizations that work with medical devices regularly draw on several ISO standards:
Organizations that design, produce or install medical devices are expected to comply with ISO 13485. Like other ISO management system standards, it focuses on running an effective system for maintaining quality, in this case the quality of medical devices.
ISO itself does not certify anyone. An organization conforms to the standard and then has a third-party certification body audit it. When the auditor reviews the organization, its conformity has to hold up in every respect against the regulatory requirements.
The current version, ISO 13485:2016, reflects advances in technology and regulation. It requires organizations to follow safety guidelines that fit the technologies their devices use. It also places stronger emphasis on risk management and on decisions based on careful risk assessment.
Audit programs have changed as well. Canada replaced its Canadian Medical Devices Conformity Assessment System (CMDCAS) with the Medical Device Single Audit Program (MDSAP), and since January 1, 2019, Health Canada has accepted only MDSAP certificates for the devices that need them.
MDSAP reduces both the time spent on inspections and how often they happen. A single audit is designed to cover what several separate inspections used to cover.
Inspections by different bodies can make the process complex, and their findings in different functional areas may not agree. With MDSAP, one auditing organization looks at all the functional requirements of the QMS with a single, consistent view. This gives a clearer picture of how each requirement works within the QMS, and it reduces the need to explain how processes connect and to deal with translation issues.
The EU Medical Device Regulation (EU MDR) requires manufacturers to show the safety and performance of their devices in European countries. Together with the In Vitro Diagnostic Medical Devices Regulation (IVDR), it was adopted in April 2017 to strengthen safety rules for medical devices and in vitro diagnostics. The IVDR has applied in the EU since May 26, 2022.
Under these rules, notified bodies must work rigorously to guarantee the quality and safety of the devices they certify. They must carry out unannounced audits at the manufacturer’s site at least once every five years. These audits check whether quality and safety standards are being maintained, review the QMS, and compare product samples against the technical documentation.
Organizations that work with medical devices need to understand how much the latest requirements matter. Ignoring them can lead to costly fines and penalties and can damage an organization’s market value for a long time.