ISO 13485 | Quality Management Standard for Medical Devices

1. Risk Management in ISO 13485

Risk management is an important aspect of ISO 13485:2016. The standard requires organizations to apply a risk-based approach to the processes of the quality management system, with particular emphasis on processes that affect the safety and effectiveness of medical devices.

1.1 Where Do Risks Come From?

Risks can arise at various stages, from design and input selection to manufacturing and post-market monitoring. Some sources of risk that need to be considered include:

• During design and development, risks may arise when the materials, structure, parameters, or characteristics of the device do not comply with the specified requirements.
• For raw materials, components, and suppliers, materials or components that do not meet requirements, as well as changes in suppliers and sources of supply, may affect product conformity.
• During manufacturing, deviations in processes, equipment, parameters, or operating conditions may result in products that do not meet the specified requirements.
• The working environment also needs to be controlled when environmental conditions may affect the product or manufacturing process.
• During use, storage, and operation, failure to meet the specified requirements may affect the safety and conformity of the device.
• Changes to products or processes, such as changes in design, materials, components, suppliers, or manufacturing processes, need to be evaluated to determine their potential impact.
• After the product is supplied, feedback, complaints, and post-production information provide data that helps the organization identify potential issues and take appropriate action when necessary.

1.2 What Does the System Control?

The ISO 13485 standard requires organizations to proactively identify, assess, and control risks that may affect medical devices, rather than only detecting and addressing issues after a problem has occurred with the product.

When a risk is identified, the organization needs to consider its severity, likelihood of occurrence, and appropriate control measures. These measures need to be maintained and monitored to ensure that the risk remains within an acceptable level.

At the same time, when changes occur or new information becomes available, the organization needs to review the risk to determine whether the existing control measures remain appropriate or need to be adjusted.

In other words, risk management under ISO 13485 is a continuous process: identification → assessment → control → monitoring and review when changes occur.

1.3 Benefits of Applying the Standard

Applying the standard helps organizations better control the quality and processes related to medical devices, while supporting compliance with regulatory requirements and improving operational efficiency. Specifically:

• Improve product quality: Better control of processes that affect the quality, safety, and conformity of medical devices.
• Risk control: Helps identify and control factors that may affect products throughout relevant processes.
• Meet regulatory requirements: Supports organizations in controlling and maintaining conformity with applicable regulatory requirements.
• Support market expansion: Increases the ability to demonstrate quality management capabilities when working with international customers and partners.
• Improve operational efficiency: Standardizes processes, reduces errors, and controls nonconformities.
• Maintain and improve the QMS: Provides a foundation for monitoring, evaluating, and improving the quality management system.

2. ISO 13485 Standard

2.1 What is ISO 13485?

ISO 13485:2016 is an international standard that specifies requirements for a quality management system (QMS) for the medical device sector. The standard helps organizations systematically control processes that affect the quality, safety, and conformity of medical devices, while meeting applicable regulatory requirements.

Unlike quality management systems applied to general industries, ISO 13485 is specifically developed for the medical device sector, with an emphasis on regulatory requirements, risk management, process control, traceability, and activities after products are placed on the market.

2.2 Why Do Medical Devices Need a Specific Quality Management Standard?

Medical devices are not ordinary consumer products. Many devices are used for examination, diagnosis, treatment, monitoring, or supporting healthcare. Even a small error can directly affect patients.

Therefore, applying the ISO 13485 standard is essential for the following important reasons:

• Ensure safety and effectiveness of use: All medical products, from personal measuring devices to specialized instruments, require the highest level of safety. The standard helps organizations identify and strictly control potential risks.
• Ensure accuracy in healthcare: Doctors and healthcare professionals rely on medical devices for diagnosis and treatment. Certification demonstrates that the organization’s products operate consistently, provide reliable results, and meet consistent quality standards.
• Ensure stability and accuracy: Certification demonstrates that the organization has established an appropriate quality management system, thereby supporting controls to ensure that products operate consistently, provide reliable results, and maintain consistent quality.
• Meet legal requirements (Mandatory): In Vietnam, having ISO 13485 certification is a prerequisite and mandatory condition for manufacturing facilities to be licensed to operate, declare applicable standards, and legally place products on the market.
• Risk management & brand reputation protection: A robust system for recordkeeping and traceability helps organizations quickly identify and address nonconformities, minimizing the risk of large-scale product recalls that could result in significant financial and reputational damage.

2.3 Applicable Organizations and Scope

The system applies to organizations whose activities are related to medical devices and processes that affect the quality, safety, or conformity of products.

Organizations that may apply the standard include:

• Medical device manufacturers
• Organizations involved in processing, assembly, installation, or maintenance.
• Suppliers of raw materials, components, or products that affect device quality.
• Organizations providing services related to the manufacturing process or maintaining the conformity of medical devices.

The scope of the quality management system is determined based on the actual activities, products, processes, and roles of each organization.

3. Structure of ISO 13485:2016

The standard is structured into 8 main clauses. Clauses 1 to 3 introduce the scope, normative references, and terms; Clauses 4 to 8 specify the requirements for the quality management system in the medical device sector. The clauses include:

• Clause 1 – Scope
• Clause 2 – Normative References
• Clause 3 – Terms and Definitions
• Clause 4 – Quality Management System: Requirements for the QMS, document control, records, and related processes.
• Clause 5 – Management Responsibility: Requirements for quality policy, quality objectives, responsibilities, and management review.
• Clause 6 – Resource Management: Requirements for personnel, infrastructure, work environment, and contamination control where applicable.
• Clause 7 – Product Realization: Control of processes from design, purchasing, and suppliers to the production and provision of medical devices.
• Clause 8 – Measurement, Analysis and Improvement: Monitoring product conformity, handling feedback, complaints, nonconforming products, and improving the QMS.

Download the ISO 13485:2016 document here to review the detailed clauses and requirements of the ISO 13485 standard.

4. Các phiên bản của tiêu chuẩn quản lý chất lượng thiết bị y tế

Version	Date	Key content
ISO 13485:1996	1996	The first edition, establishing quality management requirements specifically for the medical device sector, based on the principles of ISO 9001 and ISO 9002 at the time.
ISO 13485:2003	07/2003	Clarified quality management requirements specific to medical devices, with an emphasis on meeting applicable regulatory requirements.
ISO 13485:2016	01/03/2016	The current edition, strengthening requirements for risk management, regulatory requirements, supplier and outsourced process control, traceability, and post-production information.

5. How Is ISO 13485 Different from ISO 9001?

ISO 9001 and ISO 13485 are both quality management system standards, but they differ in their scope of application and focus of requirements.

Criterion	ISO 9001	ISO 13485
Applicable organizations	Applies to organizations in all industries	Organizations involved in activities related to medical devices
Focus	Product/service quality and the ability to meet customer requirements	Quality, safety, and conformity of medical devices
Risk management	Requires consideration of risks and opportunities within the QMS	Focuses on risk management in processes related to medical devices
Traceability	Applied depending on the product and the organization’s requirements	Specific traceability requirements apply where applicable
Documents and records	Requires organizations to control documented information necessary for the QMS	More detailed documentation and record requirements to meet specific medical device requirements

ISO 9001 and ISO 13485 are not two standards that can completely replace each other. ISO 9001 provides general quality management requirements, while ISO 13485 focuses on requirements specific to the medical device sector, particularly those related to safety, risk management, regulatory requirements, and product conformity.

Therefore, for organizations operating in the medical device sector, having implemented ISO 9001 does not mean that they have fully met the requirements of ISO 13485.

6. ISO 13485 and Regulatory Requirements for Medical Device Manufacturing

ISO 13485 is a quality management system standard for the medical device sector. Meanwhile, medical device manufacturers must also comply with regulatory requirements related to manufacturing facilities, products, and activities after products are placed on the market.

In Vietnam, these requirements are regulated under the legal framework for medical devices. As mentioned in the article, Decree No. 98/2021/ND-CP is an important legal document, together with amendments and supplements such as Decree No. 07/2023/ND-CP and Decree No. 04/2025/ND-CP.