This article walks through every major clause of ISO 13485:2016, explains what each section requires in practice, and identifies the most common audit findings per clause.

How ISO 13485 is structured

ISO 13485:2016 follows the clause structure common to ISO management system standards:

• Clauses 1–3: Scope, normative references, and terms and definitions
• Clause 4: Quality management system general requirements
• Clause 5: Management responsibility
• Clause 6: Resource management
• Clause 7: Product realization
• Clause 8: Measurement, analysis, and improvement

Clauses 1 through 3 contain no auditable requirements. Clauses 4 through 8 contain the substantive QMS requirements that certification bodies assess.

Clause 4: Quality management system

4.1 General requirements

The organization must establish, document, implement, and maintain a QMS and continually improve its effectiveness. This clause requires the organization to identify QMS processes, determine their sequence and interaction, and ensure controls are in place wherever processes are outsourced.

Common audit finding: outsourced processes, particularly contract testing or contract manufacturing, not included in the QMS scope.

4.2 Documentation requirements

Section 4.2 requires a quality manual, a documented statement of quality policy and objectives, documented procedures required by the standard, and records required by the standard. The quality manual must describe the scope of the QMS and the interaction between QMS processes.

Section 4.2.4 covers control of records, requiring that records remain legible, readily identifiable, and retrievable. Retention periods must be defined and must comply with applicable regulatory requirements.

Common audit finding: record retention periods not defined, or records stored in locations that make retrieval difficult during an audit.

Clause 5: Management responsibility

5.1 Management commitment

Top management must demonstrate commitment to the QMS by communicating the importance of meeting regulatory and customer requirements, establishing quality policy and objectives, conducting management reviews, and ensuring resource availability.

5.3 Quality policy

The quality policy must be appropriate to the organization, include a commitment to compliance and continual improvement, and be communicated and understood throughout the organization.

5.4 Planning

Quality objectives must be measurable and consistent with the quality policy. Quality planning must ensure the QMS is maintained when changes are planned and implemented.

5.5 Responsibility, authority, and communication

Responsibilities and authorities must be defined and communicated. A management representative must be appointed with specific responsibilities for the QMS.

5.6 Management review

Top management must review the QMS at planned intervals to confirm its continuing suitability, adequacy, and effectiveness. Review inputs must include audit results, customer feedback, process performance, corrective and preventive action status, regulatory changes, and follow-up from previous reviews. Outputs must include decisions and actions related to improvement.

Common audit finding: management reviews conducted as a formality with no documented follow-up actions, or inputs missing customer feedback and CAPA status data. See also: How to conduct a management review under ISO 13485 Section 5.6

Clause 6: Resource management

6.2 Human resources

Personnel performing work affecting product quality must be competent based on education, training, skills, and experience. Competence must be evaluated, training provided where gaps exist, and records maintained.

Common audit finding: training records that document attendance but do not include evidence of competency evaluation.

6.3 Infrastructure

The organization must determine, provide, and maintain the infrastructure needed to achieve product conformity, including buildings, workspace, equipment, and supporting services.

6.4 Work environment

The organization must determine and manage the work environment needed to achieve product conformity. For sterile medical devices, this includes specific documented requirements for the controlled environment.

Clause 7: Product realization

Clause 7 is the most detailed section of ISO 13485 and typically generates the most audit findings. It covers the entire product lifecycle from planning through delivery.

7.2 Customer-related processes

Requirements related to the product must be determined, including regulatory requirements, and reviewed before the organization commits to supply. Customer communication processes must be defined and documented.

7.3 Design and development

This section maps closely to 21 CFR Part 820 design controls. It requires documented design and development planning, inputs, outputs, reviews, verification, validation, transfer, changes, and a design and development file (equivalent to the FDA's design history file).

Common audit finding: design verification records that test against internal specifications without demonstrating those specifications originated from documented design inputs.

7.4 Purchasing

Purchasing procedures must ensure that purchased product meets specified requirements. Suppliers must be evaluated and selected based on their ability to supply conforming product. Records of evaluations, selection, monitoring, and re-evaluation must be maintained.

The Supplier Quality Management system must define the criteria for supplier evaluation and the controls applied based on the potential impact of the purchased product on finished device quality.

Common audit finding: approved supplier list not maintained, or supplier evaluation criteria not defined in a documented procedure.

7.5 Production and service provision

Production must be carried out under controlled conditions, including documented work instructions, use of suitable equipment, availability of monitoring equipment, and implementation of release and delivery activities.

Section 7.5.3 covers traceability, requiring that the organization maintain records of the identity of the product throughout production and delivery, and for implantable devices, the identity of all components, materials, and work environments used.

7.6 Control of monitoring and measuring equipment

Equipment used to monitor and measure product must be calibrated or verified at specified intervals, protected from damage, and its calibration status maintained. Records of calibration results must be kept.

Common audit finding: equipment in use with expired calibration certificates, or calibration records that do not link the instrument to its calibration standard.

Clause 8: Measurement, analysis, and improvement

8.2 Monitoring and measurement

Customer satisfaction must be monitored. Internal audits must be conducted at planned intervals to determine whether the QMS conforms to planned arrangements and is effectively implemented and maintained.

Audits must be conducted by personnel who do not audit their own work. Audit findings and corrective actions must be recorded and tracked to closure.

8.3 Control of nonconforming product

Nonconforming product must be identified and controlled to prevent unintended use or delivery. Procedures must define the controls for identification, documentation, evaluation, segregation, and disposition of nonconforming product.

Common audit finding: nonconformance records that document the defect but lack a root cause investigation or documented disposition decision.

8.4 Analysis of data

The organization must determine, collect, and analyze data to demonstrate the suitability and effectiveness of the QMS and evaluate where continual improvement can be made. Data must include customer feedback, product conformity, process and product characteristics, and supplier performance.

8.5 Improvement

Section 8.5.2 requires a documented procedure for corrective action. Corrective actions must address the root cause of nonconformities, not just the immediate symptom. Effectiveness of corrective actions must be verified.

Section 8.5.3 requires a documented procedure for preventive action to eliminate the causes of potential nonconformities before they occur.

Common audit finding: corrective action records that describe the containment action taken but do not document a root cause investigation or an effectiveness check. See also: FDA enforcement trends: CAPA as the top cited observation

Aligning ISO 13485 with FDA QMSR

The FDA's QMSR, effective February 2026, incorporated ISO 13485:2016 by reference. Companies that are already certified to ISO 13485:2016 will find substantial overlap with QMSR requirements. The primary differences concern FDA-specific regulatory requirements, such as the design history file terminology, specific labeling and unique device identification requirements, and adverse event reporting obligations that appear in FDA regulations but not in ISO 13485.

A combined QMS that satisfies both ISO 13485 and the FDA QMSR is achievable with a single integrated quality system rather than two parallel systems.

Managing ISO 13485 compliance in a QMS platform

Cloudtheapp's platform includes 60+ pre-configured applications mapped to ISO 13485 clause requirements, covering document control, CAPA, supplier management, design controls, calibration, nonconformance management, internal audits, and management review.

Each application is pre-validated and includes role-based workflows, audit trails, and record retention controls that satisfy ISO 13485 Section 4.2.4 documentation requirements.

Schedule a demo to see how Cloudtheapp supports ISO 13485 certification and maintenance: https://www.cloudtheapp.com/demo/

Key takeaways

ISO 13485:2016 requires a fully documented QMS covering management responsibility, resource management, product realization, and measurement and improvement. The most frequent audit findings across all clauses reflect the same pattern: documented procedures that are not consistently followed, records that lack required information, and CAPA processes that address symptoms rather than root causes.

The standard's alignment with FDA QMSR means that companies building a QMS to satisfy ISO 13485 are simultaneously building the foundation needed for FDA compliance. The investment in a conforming QMS pays dividends across both certification and regulatory inspection readiness.

This post created by and appeared first on Cloudtheapp

For a medical device company with no prior quality management infrastructure, expect 12 to 18 months from project kickoff to a successful certification audit. For a company with an existing quality system that needs to be updated and formalized, the timeline can compress to 6 to 9 months. Companies with a mature, documented QMS that are simply transferring to a different certification body sometimes complete the process in 4 to 6 months.

This article breaks down each phase of the certification timeline, identifies the variables that compress or extend it, and explains what you can do to avoid the delays that push most first-time certifications past their original deadline.

What ISO 13485 certification actually involves

ISO 13485 is a quality management standard published by the International Organization for Standardization (ISO). It specifies requirements for organizations involved in the design, development, production, installation, or servicing of medical devices and related services. Certification means a notified body or accredited certification body has audited your quality management system and confirmed it meets the standard’s requirements.

Certification is not a product approval. It is a certification of your quality system. A company can hold ISO 13485 certification and still have individual product submissions or regulatory approvals pending. Under FDA’s Quality Management System Regulation (QMSR), which aligns with ISO 13485, FDA accepts a certificate of conformance to ISO 13485 as evidence of QMS compliance, making ISO 13485 certification directly relevant to FDA market access as well (FDA, 2026).

Phase 1: Gap analysis (4 to 8 weeks)

The first phase is a structured comparison of your current quality practices against every clause of ISO 13485:2016. The goal is to identify which requirements you already satisfy, which you partially satisfy, and which you do not address at all.

A gap analysis covers all seven sections of the standard: the quality management system itself (Section 4), management responsibility (Section 5), resource management (Section 6), product realization (Section 7), and measurement, analysis, and improvement (Section 8). Each subsection maps to specific documented procedures, records, and activities that the auditor will expect to find during certification.

The output of a gap analysis is a prioritized remediation plan. Every gap becomes a project task with an owner and a target completion date. Without this step, organizations often discover late in the process that a foundational element, such as a management review procedure or a design controls framework, is missing or too informal to satisfy an auditor.

Phase 2: QMS documentation development (8 to 16 weeks)

Documentation is the most time-consuming phase, and it is where most timelines slip. ISO 13485 requires a quality manual, a documented quality policy, quality objectives, and documented procedures for a defined set of core processes including document control, record control, internal audit, CAPA, nonconformance management, and management review.

Beyond those mandatory documents, most regulated medical device companies need documented procedures for design controls, risk management (ISO 14971), validation, supplier qualification, and complaint handling. Each procedure needs to be written, reviewed by subject matter experts, approved through a formal document control process, and trained to the affected employees before the certification audit.

The time required for this phase depends almost entirely on how much documentation already exists. A company that has been operating informally can adapt existing practices into documented procedures in eight to ten weeks. A company building from a completely blank page may need four months.

One variable that compresses this phase significantly is the quality management platform you use. A pre-validated eQMS like Cloudtheapp includes ready-to-deploy document templates, workflow-based approval routing, and built-in electronic signature capabilities that eliminate the manual coordination normally required to write, review, approve, and distribute controlled documents. The 60+ applications in the Cloudtheapp Store include dedicated modules for document control, CAPA, and risk management that are already configured to the ISO 13485 process structure, which shortens development time considerably.

Phase 3: Implementation and records generation (8 to 12 weeks)

Once documentation exists, the organization needs to actually run its quality system long enough to generate the records an auditor will review. This is a critical timeline driver that many companies underestimate. An auditor conducting a Stage 2 certification audit expects to see evidence that the QMS has been operating, not just documented.

At minimum, the auditor will look for completed internal audits covering the full scope of the QMS, at least one management review with documented inputs and outputs, active CAPA records showing how the organization identifies and responds to quality problems, and training records showing that employees have been trained to the procedures they are expected to follow.

Most certification bodies recommend running the QMS for a minimum of three months before the Stage 2 audit. This does not mean three months of perfect compliance. It means three months of documented activity, including records of issues found and addressed. Auditors are more comfortable with a company that identified nonconformances and corrected them than with a company whose records show no quality problems whatsoever.

Phase 4: Stage 1 audit (1 to 2 weeks)

The Stage 1 audit is a document review and readiness assessment conducted by the certification body before the full audit. The auditor reviews your quality manual, key procedures, and the overall structure of your QMS to determine whether you are ready for the Stage 2 audit.

Stage 1 findings typically take the form of observations or minor nonconformances rather than major findings that stop the certification process. Companies that complete a thorough gap analysis and follow through on all remediation tasks before Stage 1 rarely receive findings that require more than two to four weeks of correction. The Stage 1 report also gives you specific guidance on what the Stage 2 auditor will focus on, which is useful for preparation.

The gap between Stage 1 and Stage 2 is typically four to eight weeks, depending on the certification body’s scheduling and the number of Stage 1 findings that need to be addressed.

Phase 5: Stage 2 audit (2 to 5 days on-site)

The Stage 2 audit is the certification audit. The auditor visits your facility (or conducts a remote audit for specific scope elements), reviews your records, interviews employees, and assesses whether your quality system is both documented and effective in practice.

Minor nonconformances found during Stage 2 typically require a corrective action plan submitted within 30 to 60 days of the audit. Major nonconformances can delay certification until the root cause is resolved and the correction verified. Most organizations that complete Phase 1 through Phase 3 thoroughly receive only minor findings at Stage 2.

After the Stage 2 audit, the certification body’s technical review committee assesses the auditor’s report. Certificate issuance typically follows within two to four weeks of the audit.

What extends the timeline

Several factors reliably push ISO 13485 certifications past their original target dates.

Design controls complexity is the most common. Companies with active product development pipelines face the challenge of documenting design control procedures that satisfy ISO 13485 Clause 7.3 while managing ongoing design activities. Design history files, design input and output documentation, and design verification and validation records all need to be in order before a Stage 2 audit.

Supplier qualification depth is the second most common delay factor. ISO 13485 Clause 7.4 requires a defined process for evaluating and re-evaluating suppliers based on their ability to meet specified requirements. Companies with large or complex supply chains sometimes discover during gap analysis that their supplier files are incomplete and need significant work before an audit.

Management availability for approvals and the management review is a recurring bottleneck in smaller companies where senior leaders wear multiple hats. The management review procedure, the quality policy approval, and key procedure sign-offs all require executive involvement, and those activities tend to get scheduled around other priorities until they create a timeline problem.

What compresses the timeline

Using a pre-validated, ISO 13485-aligned eQMS from the start of the project removes the validation work from the certification project itself. Cloudtheapp provides a complete validation package with each platform release, which means the system is ready for use in your quality system from Day 1 without a separate computer system validation project running in parallel.

Working with a certification body early also compresses the timeline. Certification body schedules are often booked three to four months in advance. Selecting your certification body and booking the Stage 1 audit date during Phase 2 of documentation development ensures the audit schedule aligns with your readiness rather than creating a delay at the end of the project.

Prior ISO 9001 certification, while not equivalent to ISO 13485, provides a quality management foundation that reduces the documentation development effort. Companies with ISO 9001 typically find that Sections 4, 5, 6, 7.1, and 8 of ISO 13485 require modest adaptation rather than complete development.

Maintenance after certification

ISO 13485 certification requires ongoing surveillance audits. Certification bodies conduct annual surveillance audits in years one and two after initial certification, with a full re-certification audit in year three. Surveillance audits typically take one to two days and focus on a rotating set of QMS elements rather than a comprehensive review of everything.

The quality system needs to stay active between audits. Management reviews, internal audit findings, CAPA records, and training records all need to continue accumulating at planned intervals. A quality system that operates well enough to achieve certification but then goes quiet until the next audit will fail its first surveillance audit.

Starting your ISO 13485 certification project

Cloudtheapp supports medical device companies at every stage of the ISO 13485 certification process, from initial gap analysis through ongoing surveillance audit maintenance. The platform’s document control, CAPA, internal audit, training management, and supplier qualification modules are aligned to ISO 13485 requirements, and the pre-validated compliance package means your eQMS does not add to your certification project scope.

To see how Cloudtheapp accelerates ISO 13485 certification for medical device companies at your stage of development, request a demo with a quality systems specialist.

This post created by and appeared first on Cloudtheapp

This article covers what FDA expects from the quality management system in connection with a PMA application, how design controls connect to PMA technical content, and what quality teams need to build and maintain to support both the approval process and the post-approval obligations that follow.

What PMA approval requires

A PMA application must contain valid scientific evidence, typically including clinical trial data, that demonstrates the device is safe and effective for its intended use. FDA’s Center for Devices and Radiological Health (CDRH) reviews PMA applications through a comprehensive scientific review process that covers clinical data, nonclinical laboratory studies, manufacturing information, device design, proposed labeling, and quality system compliance.

Unlike a 510(k), a PMA approval is not based on comparison to a predicate. The applicant must affirmatively establish that the device’s benefits outweigh its risks for the target patient population, supported by statistically adequate clinical evidence. This evidence must come from studies conducted in accordance with Good Clinical Practice (GCP) under an Investigational Device Exemption (IDE) if the study is conducted in the United States.

FDA’s review timeline for original PMA applications is 180 days from acceptance, though most PMAs take substantially longer due to additional information (AI) requests, modular review processes, and pre-approval inspection scheduling. The entire pre-market timeline from IDE application through PMA approval commonly spans three to seven years for novel, high-risk devices.

How FDA evaluates the quality system in a PMA

FDA does not accept a PMA application and then wait until post-approval to evaluate the quality system. The manufacturing information section of the PMA must describe the manufacturing process, quality controls, and facilities used to produce the device. FDA reviewers assess whether the described quality system is capable of consistently producing a device that meets the specifications on which safety and effectiveness data were generated.

More significantly, FDA conducts a pre-approval inspection (PAI), a quality systems inspection of the manufacturing facility, before approving most original PMAs and many PMA supplements. The PAI evaluates whether the actual quality system at the manufacturing site matches the quality system described in the PMA application, and whether the facility is operating in compliance with the QMSR (formerly 21 CFR Part 820).

A failed PAI stops the PMA review. FDA will not approve a PMA application if the manufacturing facility is not in compliance with quality system requirements. Quality deficiencies discovered during a PAI are documented in a Form 483, and the applicant must resolve those observations to FDA’s satisfaction before approval will proceed. Significant systemic deficiencies can result in a Complete Response Letter (CRL) that effectively delays the approval by a year or more.

Quality system requirements for PMA applicants

The quality system requirements for PMA applicants are the same QMSR requirements that apply to all Class II and Class III device manufacturers, but the PMA process places them under intense scrutiny before, during, and after approval.

Design controls under ISO 13485 and the QMSR. The design history file (DHF) is the core quality artifact supporting a PMA application. Every performance claim made in the PMA, device specifications, safety data, efficacy data, must trace to design inputs and validated design outputs documented in the DHF. A DHF that is incomplete, poorly organized, or lacks traceability between inputs, outputs, verification testing, and validation data creates credibility problems with FDA reviewers before the PAI even begins.

Design controls for PMA devices must demonstrate that the design process systematically identified hazards, translated user needs into device specifications, verified that the device meets those specifications, and validated that the device performs safely and effectively in clinical use. The clinical trial data in the PMA is the primary design validation evidence for the intended use claim.

Risk management per ISO 14971. Risk management documentation is a mandatory component of both the PMA application content and the PAI evaluation. FDA expects risk management to be integrated throughout the design process, not completed as a submission deliverable. The risk register, risk management plan, risk management file, and risk management report must collectively demonstrate that all identified risks were evaluated, that risk control measures were implemented and verified, and that the residual risk profile is acceptable given the device’s clinical benefits.

For Class III devices, risk management is particularly demanding because the devices carry higher baseline risk by definition. FDA reviewers scrutinize the completeness of hazard identification, the adequacy of risk controls (particularly for novel failure modes), and the process by which post-market clinical data will be used to update the risk management file.

Clinical quality system. For devices approved through a PMA based on clinical trial data, the quality systems that governed the clinical trial itself, the IDE study, are also evaluated. Clinical data integrity depends on the quality of case report forms, device accountability records, adverse event reporting, and investigator oversight. FDA inspects clinical trial sites as part of the PMA review process, and clinical data integrity problems can result in rejection of the clinical evidence and failure of the PMA.

Software documentation. Class III devices increasingly incorporate software, and FDA’s software documentation expectations for PMA devices are at the top of the regulatory requirement scale. Software safety class C under IEC 62304 applies to software where failure could result in serious injury or death, which describes most Class III devices with software components. The software development lifecycle documentation, including requirements specifications, architecture descriptions, detailed design, unit testing, integration testing, and system-level V&V, must be complete and must demonstrate that the software was developed under a systematic, controlled process.

Cybersecurity requirements for PMA devices are extensive. FDA’s premarket cybersecurity guidance requires a Software Bill of Materials (SBOM), cybersecurity risk assessment, penetration testing results, and a post-market cybersecurity monitoring and update plan as part of the PMA submission.

Design controls documentation: what the DHF must contain for PMA devices

PMA design history files must be more comprehensive than those supporting typical 510(k) submissions, because the PMA’s clinical and performance data is directly anchored in the design documentation. The following elements are essential for PMA DHFs.

Device description and design rationale. The PMA must include a complete device description, including components, materials, specifications, and operating principles. The design rationale, why design decisions were made, must be documented in the DHF to support the safety and effectiveness arguments in the application.

Nonclinical laboratory testing. Biocompatibility testing per ISO 10993, electrical safety testing, mechanical testing, sterilization validation, and packaging validation all generate test reports that are submitted with or referenced in the PMA. Each test must be traceable to a design input requirement, and the test protocols must have been approved before testing began, not reconstructed after results were generated.

Performance testing traceability matrix. FDA reviewers increasingly expect a traceability matrix that maps each device specification to the verification test that confirmed it was met and the validation evidence that confirmed the overall device meets user needs. A traceability matrix built into the DHF makes the connection between design inputs and submission evidence explicit and reduces the likelihood of AI requests for clarification.

Clinical study device accountability. The clinical devices used in the IDE study must be manufactured under controlled conditions, with device history records that trace each device’s configuration to the approved manufacturing procedures. Discrepancies between clinical devices and the commercial device described in the PMA application must be assessed and documented, including an evaluation of whether the differences affect the validity of the clinical data.

Design change history. PMA devices typically undergo numerous design iterations during development. Each change must be managed through formal change control, with documented evaluation of whether the change requires re-verification, re-validation, or submission of an IDE supplement. A design change history that shows controlled, traceable evolution from early concepts to the final design supports the credibility of the submission.

Post-approval obligations: what happens after PMA approval

PMA approval is the beginning of an intense post-market regulatory relationship, not its conclusion. PMA holders carry post-approval obligations that are more demanding than those for 510(k)-cleared devices, reflecting the higher risk profile of Class III devices.

PMA supplements for changes. Not all changes to a PMA-approved device can be implemented without prior FDA approval. The type of supplement required depends on the nature and significance of the change. Panel-track supplements, requiring new clinical data, apply to changes with new risks or intended uses. 180-day supplements apply to changes that affect safety or effectiveness but do not require new clinical data. 30-day notices apply to manufacturing changes that do not affect safety or effectiveness. Real-Time supplements apply to changes that can be reviewed and approved quickly.

The change control system must be designed to evaluate whether each proposed change triggers a PMA supplement requirement, and must prevent implementation of changes requiring supplement approval before that approval is received. This is a substantive compliance obligation that requires trained quality staff who understand PMA supplement thresholds, not just a general change control process.

Post-approval studies. FDA frequently conditions PMA approval on post-approval study (PAS) commitments, clinical studies that collect additional data on device performance in the commercial population over defined follow-up periods. PAS commitments must be tracked, executed per the approved study protocol, and reported to FDA on defined schedules. Failure to conduct or report required PAS studies can result in withdrawal of PMA approval.

Medical Device Reporting (MDR). Adverse events involving PMA-approved devices must be reported to FDA under 21 CFR Part 803. Deaths and serious injuries must be reported within 30 calendar days; certain malfunctions within 30 days or five days for devices that could cause or contribute to a death or serious injury if it were to recur. MDR data also feeds into the device’s post-market safety profile and may trigger post-market studies, labeling changes, or device recall actions.

Annual reports. PMA holders must submit annual reports to FDA updating the status of ongoing post-approval studies, describing any changes made to the device under the 30-day notice process, and summarizing complaint trends, MDR data, and manufacturing quality system updates. Annual reports are substantive compliance documents reviewed by FDA staff.

Quality system inspections. PMA-approved manufacturers are inspected by FDA on a routine basis determined by the facility’s inspection classification and risk profile. Inspections of PMA manufacturers typically focus on design controls, CAPA effectiveness, complaint handling, MDR compliance, and the change control system’s handling of PMA supplement thresholds. Significant inspection findings can result in warning letters, consent decrees, or import alerts that halt distribution.

Building a QMS that can withstand PMA scrutiny

The quality management system that can support a PMA application through pre-approval inspection and sustain compliance through years of post-approval obligations must be built for systematic rigor from the beginning of the device development program. Retrofitting a quality system to meet PMA requirements after clinical trials have started, or after a PAI inspection finding has been issued, is significantly more expensive and slower than building it correctly at the outset.

Key characteristics of QMS infrastructure that supports PMA success:

Design controls that generate traceable documentation from the first design review, not from the first FDA interaction

Risk management that is genuinely integrated into design decisions, with a risk register that reflects actual design evolution

CAPA systems capable of processing manufacturing deviations, clinical adverse events, and post-market complaint data with documented effectiveness verification

Change control processes calibrated to PMA supplement thresholds, with documented evaluation criteria for each change type

Audit trail and electronic record systems compliant with 21 CFR Part 11 for all electronic records and signatures used in regulated activities

Internal audit programs that cover design controls, software development, clinical quality systems, and post-market obligations, not just manufacturing GMP

Cloudtheapp’s platform includes 60+ configurable applications covering design controls, risk management, document management, CAPA, audit management, complaint handling, and supplier qualification. The platform’s electronic quality management infrastructure supports 21 CFR Part 11-compliant electronic records and provides the audit trail documentation that FDA inspectors and PMA reviewers expect to see in a Class III device quality system.

If your organization is preparing a PMA application or building the quality infrastructure to support Class III device development, request a demo to see how Cloudtheapp supports medical device companies through the full PMA lifecycle.

Conclusion

The PMA pathway demands that quality managers think about regulatory compliance not as a submission requirement but as an operational discipline that runs from the first design input through the final post-approval study report. FDA’s pre-approval inspection evaluates the actual quality system, not the quality system described in the application. Post-approval obligations sustain that scrutiny for the commercial life of the device.

Class III device quality teams that build their QMS for PMA scrutiny from the beginning of development build it once and maintain it continuously. Those that treat quality documentation as a submission task discover the cost of that approach during PAI inspections, when fixing the problem is no longer optional and the timeline consequences are measured in years.

]]>

This post created by and appeared first on Cloudtheapp

This article covers what FDA expects from a quality management system during and after the 510(k) process, how design controls connect to submission content, and the specific documentation quality teams need to prepare before they file.

What a 510(k) actually is, and what it is not

A 510(k) submission is a premarket notification submitted to FDA’s Center for Devices and Radiological Health (CDRH) under section 510(k) of the Federal Food, Drug, and Cosmetic Act. The submitter asserts that its device is substantially equivalent to one or more predicate devices that were legally marketed before May 28, 1976, or that received 510(k) clearance after that date.

The 510(k) pathway does not require clinical trial data in most cases, but it is not a rubber stamp. FDA reviewers evaluate the technical performance data, intended use comparison, technological characteristics comparison, and increasingly, the software documentation and cybersecurity posture of the device. For combination products, biocompatibility data is reviewed against ISO 10993 standards.

Critically, 510(k) clearance does not substitute for quality system compliance. Cleared devices must be manufactured under a quality system meeting 21 CFR Part 820 (the Quality System Regulation, now updated as the QMSR) before commercial distribution begins. FDA can and does issue warning letters to 510(k)-cleared manufacturers who lack a compliant QMS, clearance and QMS compliance are separate obligations that must both be met.

The QMSR and its connection to 510(k) submissions

On February 2, 2024, FDA’s Quality System Regulation (21 CFR Part 820) was replaced by the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference. The QMSR became effective February 2, 2026. Device manufacturers submitting 510(k)s must operate under, or be actively transitioning to, a QMSR-compliant quality system.

The practical effect for 510(k) preparation: design controls under the QMSR closely track ISO 13485 section 7.3, which requires design and development planning, input management, output verification, review processes, validation, and change control documentation. Manufacturers who built design history files (DHFs) under the old 21 CFR Part 820 framework will find the transition largely documentation-structural rather than substantively different, but specific terminology and record organization requirements differ.

FDA does not require you to submit your full quality manual with a 510(k). But reviewers may request quality system records during review, particularly for novel devices, combination products, and software as a medical device (SaMD). The question during preparation is not “will FDA ask for our QMS records?” but “if they do, will those records support clearance?”

Design controls: the QMS foundation of every 510(k)

Design controls are the structured, documented process by which a device design is developed, verified, validated, and transferred to production. Under ISO 13485 section 7.3 and the QMSR, design controls apply to Class II and Class III devices, the device types that typically require 510(k) clearance or PMA approval.

The design history file (DHF) is the organized collection of records that describes the design history of a finished device. It is the primary artifact FDA reviewers and auditors examine to confirm that design controls were followed. A 510(k) submission directly draws on the DHF for performance testing data, specifications, verification and validation (V&V) test results, risk management documentation, and labeling development records.

Design controls require these documented outputs:

Design and development plan, defines design stages, responsibilities, review schedules, and interfaces between different groups involved in design

Design inputs, the physical, performance, safety, and regulatory requirements the device must meet, derived from intended use and user needs

Design outputs, the specifications, drawings, software code, and manufacturing instructions that translate design inputs into a producible device

Design reviews, formal, documented reviews at defined development stages with participation from people not directly responsible for the design work being reviewed

Design verification, objective evidence that design outputs meet design inputs (bench testing, analysis, inspection)

Design validation, objective evidence that a device consistently fulfills user needs and intended uses in the actual or simulated use environment

Design transfer, documented confirmation that the design can be reproduced using routine production methods

Design changes, formal change control applied to all modifications made after design freeze, including re-verification and re-validation as required

What 510(k) reviewers look for in QMS-related documentation

FDA’s 510(k) reviewers do not audit the quality system during submission review, that happens during inspections, which may follow clearance. But the technical documentation submitted in a 510(k) must be consistent with a functional quality system. Specific areas where QMS gaps surface in submissions include the following.

Performance testing traceability. Test reports submitted with a 510(k) must trace to design inputs and specifications that are themselves documented in the design controls record. A performance test that cannot be linked to a specific design input creates questions about whether the device was tested against its actual requirements.

Risk management documentation. FDA expects risk management documentation per ISO 14971 for most Class II devices. The risk register and risk management report submitted with or referenced in the 510(k) must reflect risks identified during design, not a risk analysis created after the fact for the submission.

Software documentation. For devices with software, FDA’s guidance on software in medical devices (aligned with IEC 62304) requires a software development lifecycle document, software requirements specifications, verification and validation testing, and anomaly resolution documentation. These documents are generated through design controls. A 510(k) for a software-driven device submitted without this documentation will receive an additional information (AI) request from the reviewer.

Labeling. Device labeling, including instructions for use, indications for use, and contraindications, must be reviewed through design controls. Reviewers compare labeling content to the intended use statement in the 510(k) and to the predicate’s labeling. Inconsistencies between labeling and the intended use statement are a common source of deficiency letters.

QMS readiness checklist for 510(k) preparation

The following checklist addresses the QMS and design control elements that must be in place before a 510(k) submission is filed, and that must be maintained through the clearance review process, which currently averages 177 days for traditional 510(k)s per FDA’s published performance data.

Design and development planning

Design plan exists and is approved per the organization’s document control procedure

Design stages, review gates, and responsible parties are defined

Interfaces between design, engineering, clinical, and regulatory functions are documented

Design inputs

User needs are documented and approved

Design inputs are derived from user needs and intended use, not from engineering assumptions alone

Incomplete, ambiguous, and conflicting inputs were resolved through a documented review

Applicable standards, regulatory requirements, and customer requirements are captured in inputs

Design outputs

Specifications, drawings, and manufacturing instructions are version-controlled under document control

Acceptance criteria exist for each design output

Outputs essential to safe and proper device function are identified

Design verification and validation

Verification testing covers each design input requirement with objective pass/fail evidence

Validation testing uses production-equivalent or production units in actual or simulated use conditions

Biocompatibility testing references ISO 10993 series, with test reports from qualified labs

Software V&V is documented per IEC 62304 requirements for the device’s software safety class

Usability testing is conducted per IEC 62366-1 where required

Electrical safety and electromagnetic compatibility testing is complete per applicable standards

Risk management

Risk management file is complete per ISO 14971, includes hazard identification, risk estimation, risk evaluation, risk controls, and residual risk assessment

Risk management report is approved and references the risk management plan and file

Software risks are addressed in the risk management file with linkage to the software risk analysis

Design history file

DHF index is maintained and current

All design records are version-controlled, signed, and dated per document control requirements

DHF is accessible and retrievable without reconstruction

Document control

All documents submitted with or referenced by the 510(k) are controlled under an approved document control system

Version history and approval signatures are visible in document headers or metadata

Any documents that changed during the submission review period have change records

Audit trail and record management

Electronic records comply with 21 CFR Part 11 if applicable

Records are retained per applicable regulatory retention requirements

Common QMS gaps found during 510(k) review and post-clearance inspections

FDA’s inspection data and published warning letters point to recurring quality system deficiencies in cleared medical device companies. Understanding the most common gaps helps quality teams prioritize their preparation.

Design inputs that are too vague. Inputs stated as “the device shall be easy to use” or “the device shall perform reliably” cannot be verified or validated. Each input must be specific, measurable, and testable. FDA inspectors cite design control deficiencies most frequently under the design input requirement, it is the most commonly observed design control violation in device inspection reports.

Verification testing done on prototype units. Verification must be performed on representative samples that reflect production processes. Testing done on hand-built prototypes with non-production materials or processes does not constitute valid verification of the production design.

Risk management completed as a paper exercise. Risk analyses that list every imaginable hazard but show no evidence of risk control implementation or post-control risk re-estimation are consistently flagged. FDA expects the risk management process to demonstrably influence the design, risk controls must be traceable to design decisions.

Software documentation missing or incomplete. For software-driven devices, missing IEC 62304 documentation, particularly the software requirements specification, software architecture document, and anomaly list, generates AI requests from CDRH reviewers. This is increasingly common as more devices incorporate software components.

Design changes made after design freeze without formal change control. Post-freeze changes are common and expected. But each change must go through documented change control, including an evaluation of whether the change requires re-verification, re-validation, or regulatory submission of a new or supplemental 510(k). Undocumented changes discovered during post-clearance inspections frequently result in Form 483 audit findings.

Post-clearance QMS obligations

510(k) clearance activates additional QMS obligations that companies must be ready to execute on the day commercial distribution begins.

The complaint handling system must be operational before the first device ships. Every customer complaint must be evaluated to determine whether it constitutes a Medical Device Report (MDR) under 21 CFR Part 803, and MDRs must be submitted to FDA within required timeframes, 30 days for deaths and serious injuries, five days for device malfunctions that caused or could cause serious injury.

Post-market surveillance must be active. For Class II devices, this typically means tracking complaints, service records, and returned products against defined quality metrics. Post-market data feeds into the corrective and preventive action ( CAPA) process and, for EU-marketed devices, into the periodic safety update report (PSUR) and post-market clinical follow-up plan under EU MDR.

Device registration and listing must be completed with FDA before commercial distribution. Each establishment involved in the design or manufacture of the device must be registered, and the device must be listed under the applicable 510(k) clearance number.

How an electronic QMS supports 510(k) preparation and post-clearance compliance

Managing a 510(k) submission alongside an active development program is a document-intensive process. Design inputs, outputs, V&V reports, risk management records, and labeling iterations generate hundreds of controlled documents that must remain version-synchronized throughout the review period, which can extend beyond six months.

Cloudtheapp’s platform includes 60+ configurable quality and compliance applications, covering design controls, document management, risk register management, CAPA, complaint handling, and post-market surveillance. The platform’s no-code configurability means quality teams can build a DHF structure that matches their product development workflow, track design input-to-output traceability electronically, and maintain complete audit trails that satisfy both QMSR and ISO 13485 requirements without parallel paper systems.

If your team is preparing a 510(k) submission or building the QMS infrastructure to support post-clearance compliance, request a demo to see how Cloudtheapp supports medical device companies from design controls through commercial distribution.

Conclusion

A 510(k) submission is the front end of a longer regulatory obligation. The predicate comparison gets the device to market; the quality management system keeps it there. Quality managers who treat design controls as a documentation formality, rather than as the operational foundation of the development program, produce submissions that generate deficiency letters and post-clearance inspection findings that require expensive corrective actions.

Building a QMS that genuinely controls the design process, maintains traceable records, and executes post-market obligations from day one of commercial distribution is not a compliance overhead. It is the infrastructure that makes sustained commercial device development possible without regulatory interruption.

]]>

This post created by and appeared first on Cloudtheapp

ISO 10993 is the international standard series that governs biocompatibility evaluation for medical devices. FDA’s 2016 guidance, Use of International Standard ISO 10993-1: Biological Evaluation of Medical Devices — Part 1: Evaluation and Testing Within a Risk Management Process, established that FDA expects manufacturers to follow ISO 10993-1 for all biocompatibility evaluations. Deviations from this standard require explicit justification.

This guide covers what ISO 10993 requires, how to select the right tests, how FDA’s risk-based approach works in practice, and how to manage biocompatibility data in a quality management system.

Why biocompatibility testing matters for device clearance

A 510(k) submission for a device with patient contact must include a biocompatibility evaluation. FDA reviewers assess whether the submitted biocompatibility data adequately addresses the risks for the device’s contact type and duration. Inadequate biocompatibility data is one of the most common reasons for 510(k) additional information (AI) requests — it delays clearance and adds cost to the development program.

For PMA submissions, biocompatibility data forms part of the safety and effectiveness dossier. FDA may request additional testing or a re-evaluation if the submitted data does not cover all relevant endpoints for the device’s intended use.

ISO 10993-1: the risk-based framework

ISO 10993-1 is the foundational part of the series. It requires that biocompatibility evaluation follow a risk management process that considers:

• The nature of the materials in the device
• The type of body contact (surface, external communicating, or implant)
• The duration of contact (limited: less than 24 hours; prolonged: 24 hours to 30 days; permanent: greater than 30 days)
• The area of body contacted (skin, mucous membrane, breached or compromised surface, blood path, tissue/bone/dentin, circulating blood)
• The existing toxicological data on the materials from literature, supplier data sheets, or prior clinical use

The risk-based approach means that biocompatibility evaluation does not automatically require laboratory testing. If sufficient existing data — material composition data, supplier biocompatibility testing, literature toxicology, or clinical history — demonstrates that the device materials are safe for their intended contact, that data may be sufficient. Testing is required only to fill gaps where existing data is inadequate.

ISO 10993 parts and their applications

ISO 10993 is a multi-part standard. The most commonly applied parts are:

• ISO 10993-1: Evaluation and testing within a risk management process (the framework standard)
• ISO 10993-4: Selection of tests for interactions with blood (hemocompatibility)
• ISO 10993-5: Tests for in vitro cytotoxicity
• ISO 10993-6: Tests for local effects after implantation
• ISO 10993-10: Tests for skin sensitization and irritation
• ISO 10993-11: Tests for systemic toxicity
• ISO 10993-12: Sample preparation and reference materials (applies to all testing)
• ISO 10993-13 and 10993-14: Identification and quantification of degradation products from polymers and ceramics
• ISO 10993-17: Toxicological risk assessment of leachable substances
• ISO 10993-18: Chemical characterization of medical device materials (extractables and leachables)

Contact classification: the starting point for every evaluation

The contact classification determines which biocompatibility endpoints must be addressed. ISO 10993-1 Annex A provides a matrix of required endpoints based on contact type and duration.

For a device with permanent blood contact (a cardiovascular implant, for example), the matrix requires evaluation of cytotoxicity, sensitization, hemocompatibility, pyrogenicity, implantation effects, subchronic toxicity, genotoxicity, chronic toxicity, and carcinogenicity. For a device with limited skin contact (an adhesive electrode used for less than 24 hours), the required endpoints are cytotoxicity and sensitization only.

Getting the contact classification wrong — underclassifying the contact duration, for example, or not recognizing that a secondary component contacts blood — means the biocompatibility evaluation covers the wrong set of endpoints. FDA reviewers identify classification errors, and they result in additional information requests that restart the review clock.

Chemical characterization under ISO 10993-18

FDA’s 2016 guidance placed significant emphasis on chemical characterization as the starting point for biocompatibility evaluation. ISO 10993-18 requires that the chemical composition of device materials be characterized through analytical chemistry methods, and that the potential leachables — chemicals that may migrate from the device into the patient or patient’s tissues — be identified and quantified.

Chemical characterization involves:

• Identification of all materials in the device through the supply chain
• Extraction studies that simulate the conditions of clinical use (the extraction solvent, temperature, and duration are chosen to reflect worst-case patient exposure)
• Analytical chemistry (HPLC-MS, GC-MS, ICP-MS for metals) to identify and quantify extractables
• Comparison of identified leachables to toxicological threshold values

When chemical characterization shows that the leachable concentrations are below toxicological thresholds for all endpoints, a biocompatibility judgment may be possible without biological testing for those endpoints. When concentrations exceed thresholds or data is insufficient, targeted biological testing is required to fill the gaps.

Key biological tests and what they measure

Cytotoxicity (ISO 10993-5)

Cytotoxicity testing evaluates whether device materials or their extracts cause cell death or inhibit cell growth in cell culture. It is the most basic biological screening test and is required for virtually all devices with patient contact. An extract of the device is applied to a cell monolayer, and cell viability is assessed at defined time points. Cytotoxicity failure is a hard stop — it indicates the presence of leachables at levels that are directly toxic to cells.

Sensitization (ISO 10993-10)

Sensitization testing evaluates whether device materials can cause an allergic hypersensitivity reaction. The standard model is the guinea pig maximization test (GPMT) or the Buehler test, though the murine local lymph node assay (LLNA) is increasingly used as a more refined and animal-welfare-considerate alternative. Sensitization is an endpoint required for virtually all devices with patient contact.

Hemocompatibility (ISO 10993-4)

Hemocompatibility is required for devices that contact blood. It evaluates effects on red blood cells (hemolysis), platelets (thrombogenicity), the coagulation cascade, complement activation, and white blood cells. In vitro hemolysis testing and thrombogenicity testing are the most common hemocompatibility tests for initial evaluation.

Systemic toxicity (ISO 10993-11)

Systemic toxicity tests assess the effect of device materials on the whole organism following single or repeated exposure. For permanent implants with large material mass or high extractable potential, subchronic and chronic toxicity studies in animal models may be required to address the systemic exposure endpoints.

Genotoxicity (ISO 10993-3)

Genotoxicity testing evaluates whether device materials or their leachables can cause genetic damage — mutations, chromosomal aberrations, or DNA strand breaks. A standard genotoxicity test battery covers three endpoints: bacterial reverse mutation (Ames test), chromosomal aberration or micronucleus, and in vitro mammalian gene mutation. Genotoxicity is required for devices with prolonged or permanent contact.

Implantation (ISO 10993-6)

Local effects after implantation are evaluated by implanting test material at a site in an animal model and assessing the local tissue response at defined time points. The results are compared to a control material implanted at the same site. This test addresses the local biocompatibility of implantable device materials where systemic or in vitro testing cannot fully characterize the implant-tissue interaction.

FDA’s 2016 guidance: what changed

FDA’s 2016 guidance on ISO 10993-1 made several important clarifications for submitters:

• Chemical characterization under ISO 10993-18 is now expected as the starting point — biological testing without prior chemical characterization is generally insufficient
• Toxicological risk assessment (ISO 10993-17) must be performed to determine whether identified leachables pose a risk, using tolerable intake (TI) values and patient exposure estimates
• Final packaging and processing conditions (sterilization, for example) must be reflected in the test samples — testing unsterilized samples for a device that will be EO-sterilized is not acceptable
• Test reports must clearly describe sample preparation per ISO 10993-12

Managing biocompatibility in the QMS

Biocompatibility evaluation is part of the device design record and must be maintained under design control. The biocompatibility evaluation report — including the risk management rationale, chemical characterization data, test reports, and biocompatibility conclusions — is a controlled document that must be version-managed and linked to the specific device design.

When device materials change, a biocompatibility impact assessment is required under the change control process. The assessment determines whether the existing biocompatibility evaluation remains valid or whether additional testing or re-evaluation is needed. This evaluation must be documented and approved before the material change is implemented in production.

Adverse events and adverse event investigations that involve tissue reactions, sensitization events, or cytotoxic responses in the field may require feedback into the biocompatibility risk assessment. The post-market surveillance system must be connected to the design controls and risk management process so that post-market biocompatibility signals trigger appropriate re-evaluation.

Cloudtheapp’s QMS platform connects Design Controls, Risk Management, Document Control, and Post-Market Surveillance in a single system — so biocompatibility data, material change control, and audit trail requirements are managed together rather than in disconnected spreadsheets or standalone files. The platform covers 60+ quality, safety, and compliance applications and is validated for FDA 21 CFR Part 11 compliance.

To see how Cloudtheapp manages design controls and biocompatibility documentation for medical device teams, request a demo.

Summary

Biocompatibility testing under ISO 10993 follows a risk-based approach that starts with contact classification and chemical characterization, and uses targeted biological testing only to fill the gaps where existing data is insufficient. The 2016 FDA guidance reinforced that chemical characterization comes before biological testing — not after. Biocompatibility evaluation lives in the device design record, must be maintained under change control, and must be re-evaluated whenever materials change. Post-market adverse events are a feedback loop back into the risk assessment. A QMS that connects all of these elements makes biocompatibility management systematic rather than reactive.

This post created by and appeared first on Cloudtheapp