1---2name: iso-regulatory-requirements-for-medical-devices3description: Key ISO standards applicable to medical device development, quality management, and regulatory compliance.4---5# ISO Regulatory Requirements for Medical Devices67Key ISO standards applicable to medical device development, quality management, and regulatory compliance.89---1011## Table of Contents1213- [ISO 13485 Quality Management](#iso-13485-quality-management)14- [ISO 14971 Risk Management](#iso-14971-risk-management)15- [ISO 10993 Biocompatibility](#iso-10993-biocompatibility)16- [IEC 62304 Software Lifecycle](#iec-62304-software-lifecycle)17- [IEC 62366 Usability Engineering](#iec-62366-usability-engineering)18- [ISO 11607 Packaging Validation](#iso-11607-packaging-validation)19- [Sterilization Standards](#sterilization-standards)20- [Standards Cross-Reference](#standards-cross-reference)2122---2324## ISO 13485 Quality Management2526### ISO 13485:2016 Overview2728| Aspect | Requirement |29|--------|-------------|30| Scope | QMS for design, development, production, installation, and servicing |31| Certification | Third-party certification required for most markets |32| Regulatory Status | Harmonized under EU MDR; recognized by FDA QSIT |33| Validity | 3-year certification cycle with annual surveillance |3435### Key Clause Requirements3637| Clause | Title | Regulatory Focus |38|--------|-------|------------------|39| 4.1 | General Requirements | Process-based QMS, outsourcing control |40| 4.2 | Documentation | Quality Manual, procedures, records |41| 5.1-5.6 | Management Responsibility | Policy, planning, review |42| 6.1-6.4 | Resource Management | Competence, infrastructure, environment |43| 7.1 | Planning | Risk management integration |44| 7.2 | Customer-Related | Requirements determination and review |45| 7.3 | Design and Development | Design controls (critical for FDA) |46| 7.4 | Purchasing | Supplier controls |47| 7.5 | Production | Process validation, identification, traceability |48| 7.6 | Monitoring Equipment | Calibration |49| 8.2 | Monitoring | Feedback, complaints, audits |50| 8.3 | Nonconforming Product | Control and disposition |51| 8.5 | Improvement | CAPA |5253### Design Control Requirements (Clause 7.3)5455| Stage | Clause | Deliverables |56|-------|--------|--------------|57| Planning | 7.3.2 | Design plan, stages, responsibilities |58| Inputs | 7.3.3 | Requirements specification |59| Outputs | 7.3.4 | Design specifications, acceptance criteria |60| Review | 7.3.5 | Design review records |61| Verification | 7.3.6 | Verification testing reports |62| Validation | 7.3.7 | Validation protocols and reports |63| Transfer | 7.3.8 | Transfer verification records |64| Changes | 7.3.9 | Change control records |6566### Regulatory Mapping6768| Regulation | ISO 13485 Recognition |69|------------|----------------------|70| EU MDR 2017/745 | Harmonized standard (presumption of conformity) |71| FDA 21 CFR 820 | Substantially equivalent; QSIT alignment |72| Health Canada | MDSAP or direct recognition |73| PMDA Japan | Recognized with MHLW certification |74| TGA Australia | Accepted as conformity evidence |75| ANVISA Brazil | Required for GMP compliance |7677---7879## ISO 14971 Risk Management8081### ISO 14971:2019 Overview8283| Aspect | Requirement |84|--------|-------------|85| Scope | Risk management throughout medical device lifecycle |86| Regulatory Status | Harmonized under EU MDR; referenced by FDA |87| Key Change (2019) | Enhanced benefit-risk analysis emphasis |88| Documentation | Risk management file required |8990### Risk Management Process9192| Stage | Activities | Outputs |93|-------|------------|---------|94| Planning | Define scope, responsibilities, criteria | Risk management plan |95| Risk Analysis | Identify hazards, estimate risk | Hazard analysis, risk estimation |96| Risk Evaluation | Compare against acceptability criteria | Risk evaluation records |97| Risk Control | Select and implement controls | Risk control measures |98| Residual Risk | Evaluate remaining risk | Residual risk evaluation |99| Risk-Benefit | Assess overall benefit-risk | Benefit-risk analysis |100| Review | Periodic risk management review | Risk management report |101102### Risk Analysis Methods103104| Method | Application | Standard Reference |105|--------|-------------|-------------------|106| FMEA | Component/process failure modes | IEC 60812 |107| FTA | System-level failure analysis | IEC 61025 |108| HAZOP | Process hazard identification | IEC 61882 |109| PHA | Preliminary hazard assessment | - |110111### Risk Acceptability Matrix112113| Severity | Probability | Risk Level | Action |114|----------|-------------|------------|--------|115| Catastrophic | Frequent | Unacceptable | Design change required |116| Critical | Probable | ALARP | Risk reduction required |117| Serious | Occasional | ALARP | Risk reduction if practicable |118| Minor | Remote | Acceptable | Monitor |119| Negligible | Improbable | Acceptable | Document |120121### Post-Production Risk Management122123| Activity | Frequency | Sources |124|----------|-----------|---------|125| Complaint Analysis | Continuous | Customer complaints |126| Vigilance Review | Continuous | Adverse event reports |127| Literature Review | Annual | Scientific publications |128| Standards Review | Annual | Updated standards |129| Risk File Update | As needed | New information |130131---132133## ISO 10993 Biocompatibility134135### ISO 10993-1:2018 Biological Evaluation Framework136137| Contact Type | Duration | Required Tests |138|--------------|----------|----------------|139| Surface - Skin | Limited (<24h) | Cytotoxicity, sensitization, irritation |140| Surface - Mucosal | Prolonged (24h-30d) | + Acute systemic toxicity |141| Surface - Breached | Permanent (>30d) | + Subchronic toxicity, genotoxicity |142| External Communicating | Limited | Cytotoxicity, sensitization, irritation, hemolysis |143| External Communicating | Prolonged | + Subchronic toxicity, implantation |144| External Communicating | Permanent | + Chronic toxicity, carcinogenicity |145| Implant | Limited | Full biological evaluation |146| Implant | Prolonged/Permanent | Comprehensive testing including implantation |147148### Key Test Standards149150| Standard | Test |151|----------|------|152| ISO 10993-3 | Genotoxicity, carcinogenicity, reproductive toxicity |153| ISO 10993-4 | Hemocompatibility |154| ISO 10993-5 | Cytotoxicity (in vitro) |155| ISO 10993-6 | Local effects after implantation |156| ISO 10993-10 | Irritation and skin sensitization |157| ISO 10993-11 | Systemic toxicity |158| ISO 10993-12 | Sample preparation and reference materials |159| ISO 10993-18 | Chemical characterization |160161### Biocompatibility Evaluation Workflow1621631. Define device contact nature and duration1642. Identify materials in contact with body1653. Perform chemical characterization (ISO 10993-18)1664. Conduct gap analysis against required endpoints1675. Plan and execute required testing1686. Document biological evaluation report1697. Update for material or design changes1708. **Validation:** All endpoints addressed; testing per GLP; BE report complete171172---173174## IEC 62304 Software Lifecycle175176### IEC 62304:2006/AMD1:2015 Overview177178| Aspect | Requirement |179|--------|-------------|180| Scope | Medical device software development lifecycle |181| Regulatory Status | Harmonized under EU MDR; FDA guidance reference |182| Key Concept | Safety classification drives rigor |183| Documentation | Software development plan, architecture, testing |184185### Software Safety Classification186187| Class | Definition | Documentation Rigor |188|-------|------------|---------------------|189| A | No injury or damage possible | Basic |190| B | Non-serious injury possible | Moderate |191| C | Death or serious injury possible | High |192193### Required Processes by Class194195| Process | Class A | Class B | Class C |196|---------|---------|---------|---------|197| Software Development Planning | Required | Required | Required |198| Software Requirements Analysis | Required | Required | Required |199| Software Architecture Design | - | Required | Required |200| Software Detailed Design | - | - | Required |201| Software Unit Implementation | Required | Required | Required |202| Software Unit Verification | - | Required | Required |203| Software Integration Testing | Required | Required | Required |204| Software System Testing | Required | Required | Required |205| Software Release | Required | Required | Required |206| Software Maintenance | Required | Required | Required |207| Software Risk Management | Required | Required | Required |208| Software Configuration Management | Required | Required | Required |209| Software Problem Resolution | Required | Required | Required |210211### Documentation Requirements212213| Document | Class A | Class B | Class C |214|----------|---------|---------|---------|215| Software Development Plan | ✓ | ✓ | ✓ |216| Software Requirements Specification | ✓ | ✓ | ✓ |217| Software Architecture Document | - | ✓ | ✓ |218| Software Detailed Design | - | - | ✓ |219| Software Unit Test Records | - | ✓ | ✓ |220| Integration Test Records | ✓ | ✓ | ✓ |221| System Test Records | ✓ | ✓ | ✓ |222| Traceability Matrix | - | ✓ | ✓ |223224---225226## IEC 62366 Usability Engineering227228### IEC 62366-1:2015 Overview229230| Aspect | Requirement |231|--------|-------------|232| Scope | Usability engineering process for medical devices |233| Regulatory Status | Harmonized under EU MDR; FDA HFE guidance |234| Key Concept | Use-related risk identification and mitigation |235| Documentation | Usability engineering file |236237### Usability Engineering Process238239| Stage | Activities | Outputs |240|-------|------------|---------|241| Use Specification | Define users, use environments, user interface | Use specification document |242| User Interface Design | Design UI with task analysis input | UI specifications |243| Hazard Analysis | Identify use-related hazards | Use-related risk analysis |244| Formative Evaluation | Iterative design testing | Formative evaluation reports |245| Summative Evaluation | Final design validation | Summative evaluation report |246| Documentation | Compile usability engineering file | UEF |247248### Usability Testing Requirements249250| Test Type | Purpose | Participants |251|-----------|---------|--------------|252| Formative | Identify usability issues during design | Representative users (5-8 per iteration) |253| Summative | Validate final design | Representative users (15+ per user group) |254| Simulated Use | Test under realistic conditions | Trained users in simulated environment |255| Actual Use | Validate in clinical setting | Actual users in actual environment |256257### Usability Engineering File Contents258259| Section | Content |260|---------|---------|261| Use Specification | User profiles, use environments, user interface |262| Use-Related Risk Analysis | Hazard identification, risk evaluation |263| UI Design Specifications | Design requirements, rationale |264| Formative Evaluation | Test protocols, results, design changes |265| Summative Evaluation | Validation protocol, results, conclusions |266| Residual Risk | Remaining use-related risks |267268---269270## ISO 11607 Packaging Validation271272### ISO 11607-1:2019 and ISO 11607-2:2019273274| Part | Scope |275|------|-------|276| Part 1 | Requirements for materials, sterile barrier systems, packaging systems |277| Part 2 | Validation requirements for forming, sealing, and assembly processes |278279### Packaging Validation Stages280281| Stage | Activities | Documentation |282|-------|------------|---------------|283| IQ | Equipment installation verification | Installation records |284| OQ | Process parameter verification | OQ protocol and report |285| PQ | Performance under production conditions | PQ protocol and report |286287### Required Testing288289| Test | Standard | Purpose |290|------|----------|---------|291| Seal Strength | ASTM F88 | Peel strength measurement |292| Seal Integrity | ASTM F2095 | Bubble leak test |293| Visual Inspection | ISO 11607-1 | Defect identification |294| Package Integrity | ASTM D4169 | Distribution simulation |295| Accelerated Aging | ASTM F1980 | Shelf life validation |296| Real-Time Aging | - | Stability confirmation |297298### Shelf Life Validation299300| Method | Approach | Considerations |301|--------|----------|----------------|302| Accelerated Aging | Q10 = 2 (typically) | Per ASTM F1980 |303| Real-Time Aging | Concurrent with accelerated | Required for final claim |304| Worst-Case Testing | Post-aging integrity testing | Distribution + storage conditions |305306---307308## Sterilization Standards309310### Common Sterilization Methods311312| Method | Standard | Applications |313|--------|----------|--------------|314| EO (Ethylene Oxide) | ISO 11135:2014 | Heat/moisture sensitive |315| Steam | ISO 17665-1:2006 | Heat/moisture tolerant |316| Radiation | ISO 11137:2017 | Heat sensitive, high volume |317| Dry Heat | ISO 20857:2010 | Moisture sensitive |318| Aseptic Processing | ISO 13408 | Prefilled syringes |319320### Sterilization Validation Requirements321322| Phase | Activities | Documentation |323|-------|------------|---------------|324| IQ | Equipment installation | Installation records |325| OQ | Process parameter qualification | OQ protocol and report |326| PQ | Microbiological performance | Bioburden, SAL demonstration |327| Routine Control | Process monitoring | Batch records, BI results |328329### Sterility Assurance Level (SAL)330331| SAL | Probability of Non-Sterile | Application |332|-----|----------------------------|-------------|333| 10⁻⁶ | 1 in 1 million | Most medical devices |334| 10⁻³ | 1 in 1,000 | Aseptically processed |335336---337338## Standards Cross-Reference339340### Regulatory Alignment341342| Standard | EU MDR | FDA | Health Canada | TGA |343|----------|--------|-----|---------------|-----|344| ISO 13485 | Harmonized | Recognized | Required | Accepted |345| ISO 14971 | Harmonized | Referenced | Required | Accepted |346| ISO 10993 | Harmonized | Referenced | Required | Accepted |347| IEC 62304 | Harmonized | Referenced | Required | Accepted |348| IEC 62366 | Harmonized | Referenced | Required | Accepted |349350### Version Requirements351352| Standard | Current Version | Transition Deadline |353|----------|-----------------|---------------------|354| ISO 13485 | 2016 | Active |355| ISO 14971 | 2019 | Active |356| ISO 10993-1 | 2018 | Active |357| IEC 62304 | 2006/Amd1:2015 | Active |358| IEC 62366-1 | 2015/Amd1:2020 | Active |359360### Certification Bodies361362| Region | Certification Body Type |363|--------|------------------------|364| EU | Notified Bodies (per MDR) |365| USA | FDA-recognized accreditation bodies |366| MDSAP | Authorized auditing organizations |367| Global | ISO certification bodies (IATF, DNV, BSI, TÜV) |