ISO 13485 from zero, episode one: your role, your scope and your regulatory requirements.

Where does an ISO 13485 project start?

This is the first episode of ISO 13485 from zero, a ten-part series on building a medical device quality management system from nothing. We start where every ISO 13485 project should start: with your role, your scope and your regulatory requirements.

What role does your company play?

ISO 13485 is used by organisations at every point in the medical device supply chain: legal manufacturers who design devices and place them on the market under their own name, contract manufacturers who make devices or components for someone else, distributors and importers, sterilisation and service providers, and suppliers of critical components. The standard is the same for all of them, but which requirements apply, and how heavily, depends on your role. Write it down in one sentence before anything else.

How do you write the scope statement?

State which devices or services the system covers, at which sites, and in which roles. Then list any requirements of the standard that you exclude or that do not apply, with a reason for each. ISO 13485 is stricter than ISO 9001 about this. You can only exclude design and development where regulations allow it, and you can only treat other requirements as not applicable when the activity genuinely does not happen in your company. A distributor who relabels product, for example, has brought some production requirements back into scope.

What goes in a regulatory requirements register?

This is the step that most separates ISO 13485 from ISO 9001. The standard expects your quality system to meet the regulatory requirements of every market where your devices are sold. For each market, list which regulations apply, what they require of a company in your role, and which of your processes meets each requirement: registration, labelling, reporting of adverse events, recalls, record retention periods, unique device identification where required. You do not need to be a regulatory expert to start the register, but you do need someone with regulatory knowledge to check it.

Why does device classification matter?

In most markets, devices are classified by risk, and the class decides how much scrutiny your system and your device files will receive. Record the classification of each device or family and the reasoning. It affects everything from your design documentation to how often you will be audited.

What comes next?

With your role, scope, regulatory register and classifications written down, you can run a gap assessment against the standard properly, because you know what the standard requires of you specifically.

The free ISO 13485 Gap Assessment Lite checks twenty-five high-risk requirements and scores them automatically, for a quick first look at where you stand. See the ISO 13485 templates collection for the full range. Next episode: the quality manual and document control.