ISO 13485 — Medical Devices

What does ISO 13485:2016 require?

ISO 13485:2016 has the familiar shape of a quality management system, but it is written for regulators rather than for continual improvement alone. Where a general quality system asks whether customers are satisfied, ISO 13485 asks whether every device can be traced, every process that cannot be fully inspected has been validated, and every regulatory obligation has an owner.

Risk management runs through product realization, and many device makers use ISO 14971 as the method. Documentation is heavier than in a general quality system, because an auditor must be able to reconstruct how any device on the market was designed, built and released.

Who needs ISO 13485 certification in Canada?

The answer depends on what you do with the device and on its risk class. Canada's Medical Devices Regulations sort devices into four classes, with Class I the lowest risk and Class IV the highest.

Manufacturers of Class II, III and IV devices need a Medical Device Licence (MDL), which depends on a valid MDSAP certificate covering ISO 13485:2016. That certificate must come from an auditing organization recognized or authorized under MDSAP, so confirm that status before you sign with a registrar.

Importers, distributors and Class I manufacturers are licensed differently. They need a Medical Device Establishment Licence (MDEL), which authorizes importing or distributing devices in Canada. Health Canada's MDSAP guidance states that distributors and retailers do not need an MDSAP certificate.

Contract manufacturers and component suppliers form a third group: the regulations may not require certification, but device makers' purchasing controls often push it down every tier of the healthcare and medical device supply chain.

How long does ISO 13485 certification take in Canada?

A first-time ISO 13485 project typically takes six to twelve months from gap analysis to certificate, and it can run longer for a company that designs its own higher-risk devices. The calendar is driven less by writing procedures than by generating evidence: the auditor needs to see the system operating, with records of training, supplier evaluation, internal audit and management review.

Design responsibility is the largest single factor. A company that only builds to a customer's design can justify excluding design and development controls where the regulations allow it, while a company that owns its designs must show design history for each device. The number of sites, processes that need validation and outsourced work also shape the effort.

If you already hold ISO 9001 certification, much of the structure carries over: document control, internal audit, corrective action and management review. The gaps usually sit in design controls, process validation and regulatory reporting. A free readiness check shows where your system stands before you commit to an audit date.

Preparing for the MDSAP certification audit

The initial certification audit runs in two stages. Stage 1 reviews your documented system and readiness: the quality manual, procedures, medical device files and the scope you want on the certificate. Stage 2 tests whether the system works in practice by following devices and records through design, purchasing, production, complaints and corrective action.

Before Stage 1, the internal audit and management review should be complete, and the corrective actions they raised should show evidence of closure. Auditors check that corrective action reaches root cause and that effectiveness is verified.

A mock audit that traces one device from design inputs to a shipped lot and a complaint record exposes traceability gaps quickly. After certification, the auditing organization returns for annual surveillance audits and a recertification audit in the third year. ISO Certification Consultants take device makers through each step of the six-stage certification process, from gap analysis to the certificate.