Our own servers in Europe · GDPR · Support in your language

Templates and records · ISO 13485

ISO 13485 templates and records

Eleven records a medical device manufacturer must be able to show the notified body, each with the ISO 13485 clause that calls for it, its link to the European Regulation and a completed example.

In one sentence

ISO 13485 is far more explicit than ISO 9001 about records: it requires a file for each medical device type or family, a design file with its verification, validation and change control, process validation records, a record per batch allowing traceability, documented handling of complaints and of reports to the authorities, and corrective and preventive action, all kept for at least the lifetime of the device.

Content reviewed on

Current edition
ISO 13485:2016 Records are required with the wording "records shall be maintained" and refer back to control of records in 4.2.5
Minimum retention
Device lifetime and never less than two years Clause 4.2.5
Technical documentation (EU)
10 years, 15 for implantables From the last device placed on the market: Article 10(8) of Regulation (EU) 2017/745
Risk management
ISO 14971:2019 Reference standard for the risk management file

Contents


ISO 13485 templates and records

Clauses are cited using the numbering of ISO 13485:2016, the current edition and the same one the Academy uses.

Clause 4.2.3 · Mandatory document

Medical device file

What the ISO 13485 medical device file includes: intended use, labelling, specifications, manufacturing…

Clause 7.1 · Mandatory record

Risk management file

How to build the risk management file ISO 13485 (7.1) and ISO 14971 require: hazards, estimation, controls…

Clause 7.3.10 · Mandatory record

Design and development file

What a medical device design file must contain under ISO 13485: planning, inputs, outputs, reviews, transfer…

Clause 7.3.6 y 7.3.7 · Mandatory record

Design verification and validation

How to record design verification and validation of a medical device (ISO 13485): plan, sample, criteria and…

Clause 7.3.9 · Mandatory record

Design change control

How to record a medical device design change: significance, impact on risk and regulations, verification…

Clause 7.5.6 · Mandatory record

Process validation

How to validate a special process under ISO 13485: equipment qualification, IQ, OQ and PQ, acceptance…

Clause 7.5.1 · Mandatory record

Batch history record

What the record for each medical device batch must capture under ISO 13485: quantities manufactured and…

Clause 8.2.2 · Mandatory record

Complaints log

What ISO 13485 complaint handling records: receipt, evaluation, investigation, reporting decision, product…

Clause 8.2.1 · Mandatory document

Post-market surveillance plan

What the post-market surveillance plan includes: data sources, indicators, thresholds, trend analysis and…

Clause 8.2.3 · Mandatory record

Serious incident report

How to record a serious incident report to the authority: the MDR 2, 10 and 15-day deadlines, data…

Clause 8.5.2 y 8.5.3 · Mandatory record

CAPA

What a CAPA must record under ISO 13485 (8.5.2 and 8.5.3): investigation, cause, action, regulatory and…

Frequently asked questions


What people ask us before getting started

Which records are mandatory under ISO 13485?

Many more than under ISO 9001. Among others: the medical device file (4.2.3), risk management records (7.1), the design file with its reviews, verifications, validations and changes (7.3), process validation (7.5.6), the record of each batch (7.5.1), traceability (7.5.9), complaints (8.2.2), reports to the authority (8.2.3) and corrective and preventive actions (8.5.2 and 8.5.3).

Is ISO 13485 enough to comply with the MDR?

No. ISO 13485 covers much of the quality management system Article 10 of the Regulation requires, but the MDR adds obligations of its own — post-market surveillance plan and documentation, periodic safety update report, deadlines for reporting serious incidents, UDI identification, person responsible for regulatory compliance — that must be covered separately.

Why does ISO 13485 speak of "documented procedures" rather than documented information?

Because it did not adopt the common structure of management system standards. It keeps the terminology of the previous edition: it requires written procedures for many processes and specific records of their execution, which makes it more demanding on documentation than ISO 9001.

Keep your ISO 13485 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo