ISO 13485:2016 Section 5.6 sets out what a management review must cover. This guide walks through each requirement, explains what auditors look for, and gives you a practical framework for running reviews that are both compliant and genuinely useful.

What ISO 13485 Section 5.6 requires

Section 5.6 requires top management to review the quality management system at planned intervals. The purpose is to ensure the QMS remains suitable, adequate, and effective. The standard specifies three sub-clauses:

• 5.6.1 General: Top management must conduct the review. Records must be maintained. The interval must be planned (meaning predefined, not ad hoc).
• 5.6.2 Review inputs: A defined list of topics must be addressed at each review.
• 5.6.3 Review outputs: The review must produce decisions and actions related to specific areas.

The standard does not prescribe how often the review must occur, only that the frequency must be planned. Most companies conduct management reviews annually or semi-annually. Some high-risk device manufacturers or companies under regulatory scrutiny hold them quarterly. Whatever frequency you choose, document it in your quality manual or a quality plan, and hold to it.

Who must attend

Section 5.6.1 is explicit: top management conducts the review. In practice, this means the most senior leadership responsible for the quality management system must be present and engaged. In a small medical device company, that might be the CEO, VP of Quality, and VP of Operations. In a larger pharma organization, it could be the site General Manager, Quality Director, and functional department heads.

The most common audit finding related to attendance is that management review records show mid-level managers present but no evidence that top management was involved. If your Quality Manager runs the meeting alone and sends a summary to the VP who signs it later, that does not satisfy the requirement. Top management must participate, not ratify.

Required inputs: what you must cover

Section 5.6.2 lists the minimum inputs that every management review must address. Many companies add additional topics, but no input from this list can be skipped. The required inputs are:

• Feedback from customers, including complaints
• Results of audits, both internal and external (regulatory, customer, certification body)
• Process performance and product conformity
• Status of preventive and corrective actions (CAPA)
• Actions from previous management reviews and their follow-up
• Planned changes that could affect the QMS
• Recommendations for improvement
• New or revised regulatory requirements

The last point, new or revised regulatory requirements, is one that many companies underaddress. FDA QMSR took effect in February 2026 and replaced the prior 21 CFR Part 820. If your management review from 2025 or early 2026 does not show that top management reviewed the regulatory landscape and assessed impact on your QMS, that is an audit gap.

How to structure the inputs in your review package

The most effective management review packages present each required input as a data summary with trend analysis, not just a status update. A complaint count by itself tells management very little. A complaint count with month-over-month trend, breakdown by complaint category, and comparison to previous year gives management something to act on.

For each input category, prepare:

• A summary of data from the review period
• Trend versus the prior review period
• Key observations: what changed, what drove the change, what the risk is
• Any open issues requiring management decision

The quality team typically prepares this package. The department owners validate the data in their area. Top management reviews it in the meeting and responds to it. That flow is documented in the meeting minutes or review record.

Required outputs: what the review must produce

Section 5.6.3 specifies that outputs must include decisions and actions related to:

• Improvement of the effectiveness of the QMS and its processes
• Improvement of product related to customer requirements
• Resource needs

The most important word in that list is “actions.” A management review that produces only observations and no assigned corrective or improvement actions is not satisfying the standard’s intent. Every identified gap or opportunity should map to an action: who owns it, what they will do, and by when.

Many companies treat management review outputs as the starting point for their CAPA pipeline. If management identifies a trend in customer feedback suggesting a product labeling issue, a CAPA or improvement action is opened, assigned, and tracked through to closure before the next management review.

Documenting the management review

Section 5.6.1 requires records of management reviews to be maintained. Those records must demonstrate:

• Who attended (and that top management was present)
• What inputs were reviewed
• What data was presented for each input
• What decisions or actions resulted
• Action ownership and target dates

Meeting minutes are the most common record format. Many companies supplement minutes with a formal management review report that includes the data packages, trend charts, and a consolidated action log. Some use a dedicated management review template built into their eQMS.

Keep the records. Under ISO 13485, quality records must be maintained for at least the lifetime of the device or five years from product release, whichever is longer. Management review records are quality records. The audit trail should show when the record was created, approved, and by whom.

Common audit findings in management review

During ISO 13485 certification and surveillance audits, management review is a standard check. The most frequent nonconformances:

• One or more required inputs were not addressed in the review
• Top management was not present or their attendance is not documented
• Outputs contain no specific actions, only general observations
• Actions from the previous review were not followed up or their status is unknown
• The review was not held at the planned interval
• New regulatory requirements were not included in the review inputs
• Records are incomplete or unsigned

A pattern auditors see often: the management review record documents a full agenda with all required inputs, but the data presented for each topic is a single sentence. “CAPA status was reviewed. No significant issues noted.” That passes the presence test but fails the adequacy test. Auditors will ask to see the actual CAPA data that was reviewed. If the underlying data does not exist or was not discussed in the meeting, the review was not adequate.

How to make management reviews useful, not just compliant

The companies that get the most from management reviews treat them as a strategic quality planning session, not a compliance checklist. A few practices that separate effective reviews from perfunctory ones:

Prepare data before the meeting, not during it. Management review meetings that turn into data-retrieval sessions waste leadership time and produce poor decisions. Distribute the review package at least 48 hours before the meeting. Attendees should come prepared to discuss, not to hear numbers for the first time.

Connect quality metrics to business outcomes. Complaint rate by itself is an abstract number for a CEO. Complaint rate tied to warranty costs, customer churn risk, or regulatory action risk is a number that drives decisions. Bridge the gap between quality language and business language.

Track actions from review to review. Open a dedicated management review action log. Every prior action carries forward to the next review with a status update. Close the loop explicitly, with evidence of completion. Auditors love seeing a clean action log. So does top management.

Adjust the agenda based on risk. Some inputs require more time in some years than others. If you had a major CAPA open all year, spend more time on CAPA effectiveness than on customer feedback trends that were stable. Flexible agenda design within the required input structure keeps the review proportionate to actual quality risk.

Management review frequency: annual vs. more frequent

Annual management reviews satisfy the standard for most companies. But consider increasing frequency if:

• You received an FDA warning letter or notified body major nonconformance in the past 12 months
• You are preparing for a 510(k) submission or CE marking application
• Your complaint rate or CAPA backlog is trending upward
• You experienced a product recall or field safety corrective action
• Your business is growing rapidly and your quality system is scaling with it

In high-risk situations, quarterly management reviews let leadership course-correct faster. The additional meetings also generate more frequent management review records, which demonstrates proactive quality oversight to regulators reviewing your quality system.

Using an eQMS for management review

Managing management review inputs across spreadsheets, email chains, and shared drives is workable for small teams but breaks down quickly as organizations grow. An eQMS with integrated management review capabilities gives quality teams several advantages:

• Automated collection of required inputs from live QMS data (CAPA status, complaint metrics, audit findings)
• Structured review templates that enforce coverage of all required Section 5.6 inputs
• Electronic signature on review records for 21 CFR Part 11 compliance
• Action tracking with owner assignment and due date reminders
• Historical record library accessible for audit retrieval

Cloudtheapp’s eQMS includes a Management Review application that pulls data directly from connected quality modules, including CAPA, complaints, audits, and supplier quality. The review record is generated within the system, signed electronically, and stored with a full audit trail. Actions assigned during the review are tracked through the same platform, giving the next review team a clean status picture. Request a demo to see it in action.

Conclusion

ISO 13485 Section 5.6 gives quality teams a mandate for something genuinely valuable: a regular, structured conversation between top management and the quality data that reflects how well the organization is performing against its own standards. Most companies use management review to satisfy an auditor. The ones that use it to actually run their quality program better get both outcomes.

Cover every required input with real data. Produce real actions with real owners and real deadlines. Involve top management who can actually commit resources to quality improvement. Then follow up. The gap between a compliant management review and a useful one is almost entirely discipline, not procedure.

This post created by and appeared first on Cloudtheapp

This separation has a real cost that does not appear in the project plan.

<h2>What happens when the QMS and ERP do not talk to each other</h2>

A medical device manufacturer using an ERP for inventory, purchasing, and production scheduling and a separate QMS for quality records has the same data living in two systems. A nonconforming material record in the QMS does not automatically trigger a hold in the ERP. A supplier qualification record in the QMS does not automatically update vendor status in purchasing. A change control that affects a bill of materials requires someone to manually update both systems and hope the timing aligns.

Manual reconciliation between systems is not just an inconvenience. In a regulated environment, it is a data integrity risk. When a supplier audit finding in the QMS does not match the approved vendor list in the ERP, there is a discrepancy that an FDA investigator can flag on a Form <a href="https://www.cloudtheapp.com/glossary-fda-form-483-inspection-observation/">FDA 483</a> observation.

The assumption that integration comes later also creates a practical problem. Once a QMS is fully implemented and validated, integrating an ERP means re-opening validation documentation, running regression testing, and updating your qualification protocols. That is a significant project burden that most teams did not budget for when they chose the platform.

<h2>Why ISO 13485 and ERP integration belong in the same project</h2>

The ISO 13485 standard requires documented processes for purchasing, including procedures for evaluating suppliers and controlling purchased product. When supplier qualification data lives in the QMS and purchasing data lives in the ERP, fulfilling these requirements means maintaining records in two places and ensuring they stay synchronized manually.

A QMS platform with built-in integration capability changes this. Supplier qualification status, approved vendor lists, and <a href="https://www.cloudtheapp.com/glossary-supplier-quality-management-sqm/">supplier quality management</a> records can feed directly into purchasing workflows. A change to supplier qualification status in the QMS triggers an automatic update to the vendor record in the ERP. The records are consistent because they share a single source.

This also simplifies the ISO 13485 certification process itself. Auditors reviewing your purchasing controls want to see that your approved vendor data is accurate and that purchasing decisions reflect it. When the QMS and ERP share data through a validated integration, demonstrating this is straightforward. When they are separate, it requires manual evidence of synchronization.

<h2>What built-in integration actually means</h2>

Most ERP integrations offered by QMS vendors are bespoke development projects. The vendor provides an API, your IT team or a consultant builds the connection, and you pay for the development work, the testing, and the ongoing maintenance as either system updates.

A platform with a built-in integration engine is different. The integration is configured, not developed. You define the data flows between Cloudtheapp and your ERP using a no-code logic builder, and the connection is maintained as part of the platform rather than as a custom build that breaks with every version update.

For a medical device company using NetSuite as their ERP, this means the QMS and operational data stay aligned through a configured, validated connection. Quality metrics are visible in the operational reporting environment. Production data is accessible in the quality review workflow. The two systems work as one rather than as parallel information stores that require manual bridging.

<h2>How one company did this</h2>

A medical device company in Ohio, developing and manufacturing targeted pain relief devices, came to Cloudtheapp with two parallel requirements: they needed ISO 13485 certification and they needed their QMS to connect to NetSuite. In most vendor conversations, those were treated as sequential projects.

In their Cloudtheapp implementation, both happened simultaneously. The core quality modules, CAPA, document control, change management, supplier qualification, nonconforming material, were configured and validated for ISO 13485. The NetSuite integration was configured in parallel using Cloudtheapp's embedded REST API and no-code integration tools. By go-live, the QMS was ISO 13485-aligned and ERP-connected.

The quality manager's assessment: the platform's ISO 13485 compliance gave them confidence in audit readiness from day one, and the level of support throughout implementation made Cloudtheapp a quality partner rather than a software license.

<h2>What to verify before signing with any eQMS vendor</h2>

If ISO 13485 certification and ERP integration are both on your roadmap, the questions you need answered before selecting a platform:

Does the platform arrive pre-validated for ISO 13485? Or does validation require a separate engagement? Does the platform include a built-in integration engine, or does ERP integration require custom development? Who maintains the integration when either system updates? Can the same no-code toolset that configures quality workflows also configure integration logic, or does integration require IT involvement?

The answers determine whether your two requirements converge into one manageable project or remain two separate ones with compounding complexity. <a href="https://www.cloudtheapp.com/demo/">Book a 45-minute session to see how Cloudtheapp handles both.</a>

This post created by and appeared first on Cloudtheapp

This guide is for the startup quality lead or founder who needs to build ISO 13485 compliance from scratch, understand where to start, and move efficiently without over-engineering a system that does not fit a company with ten people and one device in development.

ISO 13485 medical device startup implementation does not need to be a multi-year project. With the right scope and sequencing, a startup can have a defensible, audit-ready quality management system operational within weeks.

What Is ISO 13485 and Why Does It Matter for Medical Device Startups?

ISO 13485:2016 is the international standard for quality management systems specific to medical devices. It defines what a QMS must include to consistently meet regulatory and customer requirements throughout the full device lifecycle, from design through post-market surveillance.

For startups, ISO 13485 matters for three concrete reasons.

First, it is now a U.S. regulatory requirement. The FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, incorporates ISO 13485:2016 by reference. Building your QMS to ISO 13485 from day one means your system satisfies both FDA QMSR and international certification requirements simultaneously.

Second, distribution and commercial partnerships in most regulated markets require ISO 13485 certification. Hospital systems, purchasing organizations, and international distributors will ask for your certificate. Some will not engage without it.

Third, ISO 13485 provides the structure that makes a 510(k) Submission defensible. The design controls, risk management, and document control requirements within the standard directly support 510(k) submission quality.

For a complete breakdown of how ISO 13485 maps to FDA requirements, see ISO 13485:2016 Compliance: A Step-by-Step Implementation Guide.

When Should a Startup Begin Building ISO 13485 Compliance?

The correct answer is before design and development begins, not after it finishes.

ISO 13485 requires design controls to be active during the design process. Design inputs, design reviews, verification protocols, and validation records must be generated in real time. You cannot retroactively document a design history that satisfies ISO 13485 requirements after the device is built.

For early-stage startups in ideation or pre-development, now is the right time to establish the minimum QMS infrastructure: document control, a quality manual, and your design control procedure. These three elements take days to create and protect months of development work from becoming undocumented and undefendable.

Step 1: Conduct a Gap Assessment

A gap assessment is the first practical step for any ISO 13485 medical device startup implementation. It compares what you currently have against what ISO 13485:2016 requires, clause by clause.

For a startup with no existing QMS, the gap assessment is straightforward: every clause is a gap. The value of the exercise is prioritization. ISO 13485 has over 150 individual requirements. Not all of them apply equally at the pre-production stage. A gap assessment against your specific scope, which for most startups is design and development, helps you sequence implementation work correctly rather than building everything at once.

Key ISO 13485 clauses to assess for a startup:

• Clause 4: Quality management system requirements, including documentation control
• Clause 5: Management responsibility, quality objectives, and management review
• Clause 6: Resource management and infrastructure
• Clause 7.3: Design and development controls
• Clause 7.4: Purchasing and supplier controls
• Clause 8.5: CAPA

Complete your gap assessment in a documented format so you have a baseline record and a prioritized action plan. This document also demonstrates to certification bodies that you approached implementation systematically.

Step 2: Build Your Quality Manual and Define Your QMS Scope

The quality manual is the top-level document of your QMS. It defines the scope of your quality management system, references your key quality procedures, and outlines how your organization meets each applicable ISO 13485 clause.

For a medical device startup, the QMS scope is typically: the design, development, and planned manufacture of [device name] for [intended use and markets]. Define the scope precisely. A scope that is too broad creates obligations you cannot satisfy. A scope that is too narrow may not cover what regulators expect.

The quality manual does not need to be lengthy. Ten to fifteen pages is sufficient for a startup. What it must be is accurate, current, and version-controlled.

Step 3: Establish Document Control

Document control is the operational backbone of ISO 13485 compliance. Every procedure, specification, form, and record in your QMS must be version-controlled, approved before use, and accessible only in its current approved form.

For an ISO 13485 medical device startup, document control means:

• Every document has a unique identifier, revision level, and approval signature
• Obsolete versions are immediately removed from use when a new revision is approved
• All records are legible, retrievable, and protected from unauthorized changes
• An audit trail exists for every document review and approval

A cloud-based eQMS with built-in document control eliminates the shared folder and email approval workflows that create instant ISO 13485 nonconformances. Paper-based or spreadsheet-driven document systems are the most consistently cited gap in startup quality audits.

Step 4: Implement Design Controls

Design controls under ISO 13485 Clause 7.3 are the most critical requirement for a startup in development. They require you to plan, execute, and document your design process through defined stages with documented inputs, outputs, reviews, verification, and validation.

The design history file (DHF) is the output of your design controls process. It is a structured collection of every design record, from your first design input requirements through your final validation evidence.

Build your DHF as you develop your device. Every design review meeting generates a record. Every verification test generates a protocol and results document. Every input revision generates a change record. These records are the technical substrate of your ISO 13485 certification and any future regulatory submission.

Step 5: Set Up Risk Management

ISO 13485 requires risk management to be integrated throughout the product lifecycle, with a documented risk management process that references ISO 14971:2019.

Your risk management file must include a risk management plan, hazard identification and analysis, risk evaluation, risk controls, and a residual risk assessment. Risk management is not a one-time activity. It must be updated when design changes occur, when post-market data surfaces new hazards, and when CAPA investigations identify systemic risks.

A Risk Register linked to your design controls records ensures risk management stays connected to the design process rather than becoming a disconnected documentation exercise.

Step 6: Establish Your CAPA Process

Corrective and Preventive Action (CAPA) is required under ISO 13485 Clause 8.5. For a startup, CAPA governs how you respond to nonconformances during development: failed tests, design inputs that change because of validation findings, supplier deviations, and internal process failures.

A functioning CAPA process requires a defined procedure, a mechanism to capture and investigate nonconformances, documented Root Cause Investigation, defined corrective actions with owners and due dates, and an effectiveness check after closure.

Startups frequently treat CAPA as a post-market activity. ISO 13485 makes it a development-phase requirement. An auditor reviewing your QMS will expect to see CAPA records from development activities, not just post-commercialization events.

Step 7: Implement Supplier Controls

ISO 13485 Clause 7.4 requires documented supplier controls for any purchased product or service that affects device quality. For a startup sourcing components, materials, or contract services, this means an approved supplier list, a supplier qualification procedure, receiving inspection records, and a mechanism for issuing Supplier Corrective Action Requests when a supplier delivers nonconforming material.

Your Supplier Quality Management process at the startup stage should be proportionate to your supply chain complexity. A startup with two component suppliers and one contract manufacturer needs a straightforward supplier qualification record and a clear process for handling nonconforming deliveries.

Step 8: Prepare for Internal Audit and Certification

ISO 13485 requires internal audits at planned intervals to verify that your QMS conforms to the standard and is effectively implemented. For a startup approaching initial certification, conduct a complete internal audit against ISO 13485:2016 requirements before scheduling your certification audit.

Internal audit findings generate CAPA records. Close all major nonconformances from your internal audit before your certification body arrives. Certification auditors assess both conformance and effective implementation. A QMS that exists only on paper does not satisfy either criterion.

Timeline for initial ISO 13485 certification from scratch: most startups with focused effort and an eQMS platform can complete implementation and achieve initial certification in three to six months.

How QMSR 2026 Changes ISO 13485 for Medical Device Startups

Since February 2, 2026, FDA’s QMSR has incorporated ISO 13485:2016 by reference. This means a startup building a QMS to ISO 13485 is simultaneously building a QMS that satisfies U.S. FDA requirements without needing a separate compliance exercise.

The practical impact for startups: build your QMS to ISO 13485 from day one, and you have covered both your FDA obligations and your international certification pathway in a single system. Companies that built QMS infrastructure to the legacy QSR (21 CFR Part 820) framework before February 2026 need to assess where their systems diverge from ISO 13485 requirements and close those gaps.

For a complete breakdown of the QMSR transition and its implications, see FDA QMSR 2026: The Complete Guide to the Quality Management System Regulation.

Common ISO 13485 Startup Mistakes

Startups attempting ISO 13485 implementation without expert guidance consistently encounter the same avoidable failures.

Scope too broad. Defining a QMS scope that covers manufacturing before you have a manufacturing process creates obligations you cannot satisfy and creates nonconformances during your certification audit.

Design controls started too late. Beginning to document design controls after the device prototype is already built means your design history file cannot accurately reflect how decisions were made during development. Auditors recognize reconstructed documentation.

Risk management as a one-time exercise. Creating a risk management file at the start of development and never updating it as the design evolves means your risk records do not reflect your actual device. This is a common major nonconformance in certification audits.

No management commitment. ISO 13485 Clause 5 requires demonstrable management commitment to the QMS, including defined quality objectives, management review meetings, and resource allocation. Startups that treat QMS as a quality team project rather than a leadership commitment fail Clause 5 consistently.

Paper and spreadsheet-based systems. A QMS built on paper binders and Excel cannot satisfy ISO 13485’s audit trail, version control, and record control requirements at certification audit. The effort required to convert a paper QMS to a validated eQMS after implementation is significantly greater than building on a compliant platform from day one.

How Cloudtheapp Supports ISO 13485 Medical Device Startup Implementation

Cloudtheapp’s eQMS platform gives medical device startups a validated, ISO 13485:2016 and FDA QMSR-compliant quality management system that can be operational in weeks, not months.

The platform includes purpose-built applications for document control, design controls and DHF management, risk management, CAPA, supplier qualification, and internal audits. All applications are connected in a single platform, so design records link to risk files, CAPA records link to nonconforming material, and supplier records link to incoming inspection findings.

Cloudtheapp uses AI-powered configuration, which means startups can build and customize quality workflows by describing requirements in plain language, without coding or consulting engagements. Teams that traditionally spend three to six months standing up a QMS with consultants are deploying and using their Cloudtheapp QMS in the first two weeks.

For a look at how other medical device startups have structured their QMS infrastructure, see QMS for Medical Device Startups: Building Compliance Infrastructure from Day One.

Conclusion

ISO 13485 medical device startup compliance is not optional, and it does not become easier the longer you wait to start. Design controls, document management, risk management, and CAPA must be active before development milestones happen, not after they are complete.

Startups that sequence implementation correctly, begin with gap assessment, establish document control and design controls first, then build out the remaining clauses, reach certification faster and produce cleaner regulatory submissions than those that attempt to build everything at once or retrofit compliance after development.

If you are ready to build a validated, ISO 13485-compliant QMS for your medical device startup, book a free demo of Cloudtheapp and see how quality teams deploy a full eQMS in weeks without consultants or coding.

This post created by and appeared first on Cloudtheapp