Our own servers in Europe · GDPR · Support in your language

Templates and records · ISO 13485 · Clause 4.2.3

ISO 13485 medical device file template

The reference file for each device type or family: what it is, what it is for, how it is made, controlled, installed and serviced, and where each document proving it can be found.

In one sentence

The medical device file contains or references, for each device type or family, the general description and intended use, labelling and instructions for use, product specifications, specifications for manufacturing, packaging, storage and distribution, measuring and monitoring procedures and, where appropriate, installation and servicing requirements, because clause 4.2.3 of ISO 13485 requires it to be established and maintained to demonstrate conformity with the standard and with regulatory requirements.

Content reviewed on

Where the standard requires it
ISO 13485 · Clause 4.2.3 Clauses are cited using the numbering of ISO 13485:2016, the current edition and the same one the Academy uses.
Type of information
Mandatory document Document to be established and maintained (4.2.3)
Who fills it in
Regulatory affairs and quality Fed by design, production and technical service; the person responsible for regulatory compliance (Article 15 MDR) ensures it is kept up to date
When
Before placing on the market and at every change It is opened during design and updated with every change affecting the product, labelling or process
How long it is kept
Product lifetime, at least two years ISO 13485 requires records to be kept for at least the lifetime of the device as defined by the manufacturer, and never less than two years from release (4.2.5); the MDR requires technical documentation to be available for ten years after the last device was placed on the market, fifteen for implantables (Article 10(8)).

What the standard requires


What ISO 13485 demands and what it leaves to your judgement

The standard asks for a living file for each medical device type or family, containing the documents or referencing them. It is not a historical archive: every change in labelling, specification or process must be reflected in the current version.

Its minimum content is set out: description and intended use, labelling and instructions, product specifications, specifications or procedures for manufacturing, packaging, storage, handling and distribution, measuring and monitoring procedures, and installation and servicing requirements where applicable.

In the European Union it overlaps with the technical documentation in Annexes II and III to Regulation (EU) 2017/745. The practical approach is to build a single file that serves both, referencing rather than duplicating the design file and the risk management file.

Structure


Fields the template should include

  • Identification of the device or family, models and variants covered
  • General description, intended use, indications and contraindications
  • Risk class and classification rule applied
  • Basic UDI-DI and commercial references
  • Labelling and instructions for use in their current version
  • Product, material and component specifications
  • Manufacturing, packaging, storage and distribution specifications
  • Inspection, monitoring and measuring procedures
  • Installation and servicing requirements, if applicable
  • References to the design file and the risk management file
  • Version history of the file and its documents

Example


Example: file for a family of urinary catheters

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field Content
Device Uroflex family of single-use urinary catheters (fictitious) · 6 sizes
Intended use Intermittent bladder drainage in adults, in hospital and home settings
Class IIa, under rule 5 of Annex VIII to the MDR
Basic UDI-DI 84XXXXUROFLEX01 (made up)
Labelling Label ET-UF-07 and instructions IU-UF-05, March 2026 version
Specifications Drawing P-UF-12 rev. D and medical-grade PVC material specification EM-031
Manufacturing Extrusion procedure PF-04, assembly PF-05 and outsourced ethylene oxide sterilisation PF-09
Controls Inspection plan PI-UF-02: dimensional, leak-tightness and tensile test per batch
References Design file DHF-UF-2024 and risk management file RMF-UF-03
Last revision Version 9 · 18 March 2026 · change of packaging supplier

At the audit


Mistakes auditors commonly flag

  • The file reflects the original design version and not later changes of supplier, labelling or process.
  • Documents copied into several folders, with different versions in each.
  • The intended use is missing or differs from the one in the instructions for use.
  • It is not clear which models or variants each file covers.
  • Servicing requirements that exist in practice but do not appear in the file.

In Kimobox


How this record is kept in Kimobox

  1. 1The device file is managed with document control and versions, without parallel folders.
  2. 2Each document is linked to its processes and change history.
  3. 3Policy and procedures are published as controlled documents with read receipts.
  4. 4The notified body auditor can log in with a read-only user to review the current file.

Frequently asked questions


What people ask us before getting started

Is the medical device file the MDR technical documentation?

They overlap a great deal but are not the same. The technical documentation in Annexes II and III also requires, among other things, the clinical evaluation, the summary of safety and the post-market surveillance documentation. A single well-structured file can serve both purposes.

Is a file needed for every reference?

No. The standard allows one file per device type or family, provided it is clear which models it covers and how they differ.

Must every document be copied into the file?

No. ISO 13485 accepts that the file may contain the documents or reference them. What matters is that each reference leads to the current version and that there are no out-of-date copies.

Keep your ISO 13485 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo