Medical devices sit at the top of the compliance list in healthcare, because the rules that govern them change often and the stakes are high. Devices save lives, so every organization that makes or supplies them has to make sure they are safe and sterile. This article explains the main medical device compliance requirements, from ISO standards to single audit programs and the EU’s device regulations.
Who regulates medical devices?
Every medical device has to meet the standards of the national and international bodies that govern its use. In the U.S., a device must comply with the requirements set by the FDA. Outside the U.S., manufacturers usually work to ISO standards, which many regulators use as the basis for their own rules.
The two now overlap more than before. The FDA’s Quality Management System Regulation (QMSR), which took effect on February 2, 2026, incorporates ISO 13485:2016 by reference, so U.S. device makers work to the same quality system standard used in many other markets.
Which ISO standards apply to medical devices?
Organizations that work with medical devices regularly draw on several ISO standards:
- ISO 9001 sets out requirements for a sound quality management system (QMS). The 2015 edition made the requirements easier to apply for smaller businesses that need a more limited system.
- ISO 14000 is a family of environmental standards covering topics such as recycling, packaging and labeling. ISO 14006, part of this family, addresses environmentally conscious design.
- ISO 13485 is the standard written specifically for medical devices. It makes sure devices are of sound quality when they reach the market.
What is ISO 13485 and who needs it?
Organizations that design, produce or install medical devices are expected to comply with ISO 13485. Like other ISO management system standards, it focuses on running an effective system for maintaining quality, in this case the quality of medical devices.
ISO itself does not certify anyone. An organization conforms to the standard and then has a third-party certification body audit it. When the auditor reviews the organization, its conformity has to hold up in every respect against the regulatory requirements.
The current version, ISO 13485:2016, reflects advances in technology and regulation. It requires organizations to follow safety guidelines that fit the technologies their devices use. It also places stronger emphasis on risk management and on decisions based on careful risk assessment.
How does the Medical Device Single Audit Program (MDSAP) work?
Audit programs have changed as well. Canada replaced its Canadian Medical Devices Conformity Assessment System (CMDCAS) with the Medical Device Single Audit Program (MDSAP), and since January 1, 2019, Health Canada has accepted only MDSAP certificates for the devices that need them.
MDSAP reduces both the time spent on inspections and how often they happen. A single audit is designed to cover what several separate inspections used to cover.
Inspections by different bodies can make the process complex, and their findings in different functional areas may not agree. With MDSAP, one auditing organization looks at all the functional requirements of the QMS with a single, consistent view. This gives a clearer picture of how each requirement works within the QMS, and it reduces the need to explain how processes connect and to deal with translation issues.
What do the EU MDR and IVDR require?
The EU Medical Device Regulation (EU MDR) requires manufacturers to show the safety and performance of their devices in European countries. Together with the In Vitro Diagnostic Medical Devices Regulation (IVDR), it was adopted in April 2017 to strengthen safety rules for medical devices and in vitro diagnostics. The IVDR has applied in the EU since May 26, 2022.
Under these rules, notified bodies must work rigorously to guarantee the quality and safety of the devices they certify. They must carry out unannounced audits at the manufacturer’s site at least once every five years. These audits check whether quality and safety standards are being maintained, review the QMS, and compare product samples against the technical documentation.
Key takeaways
Organizations that work with medical devices need to understand how much the latest requirements matter. Ignoring them can lead to costly fines and penalties and can damage an organization’s market value for a long time.
- Follow the ISO standards that apply to your work, especially ISO 13485.
- Prepare for single audits under MDSAP if you sell into participating markets.
- Expect unannounced audits if you sell devices in the EU.
- Track updates from notified bodies and regulators as a routine part of quality and safety management.
Related Blogs
9 Ways to Improve Employee Engagement and Productivity at Work
Transforming Payments: Introducing FedNow - The Future of Real-Time Transactions
Related Industries
FDA Compliance
Medical Devices
Clinical Research
Audit Webinar
HR Compliance
Banking and Finance
Hospital and Healthcare
Packaging and Labeling
Accounting, Payroll and Taxation
Food and beverages
Software
Miscellaneous
Pharmaceutical