ISO 13485 Procedures: Mandatory List and Scope Exclusions
ISO 13485 procedures are the documented procedures that ISO 13485:2016 requires wherever the standard says “shall establish a documented procedure”. I3CGLOBAL’s implementation covers 44 procedures across clauses 4 to 8, from control of documents to CAPA. This page lists every one with its clause, explains which requirements can be excluded or marked not applicable, and shows how to justify that in the quality manual.
Definition
What Are ISO 13485 Procedures?
ISO 13485 procedures are documents that describe how a quality management process is carried out: who does what, in what order, with which forms, and what record is kept. ISO 13485:2016 is the international QMS standard for organisations that design, develop, produce, install or service medical devices and IVDs, and it uses the words “shall”, “must” and “documented procedure” to make specific procedures mandatory. These are commonly called the ISO 13485 mandatory procedures.
ISO 13485 procedures sit in the middle of three levels of documentation. Procedures describe a process; work instructions describe a single task in detail; records are the evidence that the procedure was followed. Clause 4.2.4 controls documents and clause 4.2.5 controls records, and both are themselves mandatory procedures.
Organisations establish, implement and maintain these ISO 13485 procedures to cover every aspect of QMS implementation and operation. Some apply to every manufacturer; others, such as sterilisation validation or installation, apply only when the organisation performs that activity.
Mandatory procedures
Which Procedures Does ISO 13485:2016 Require?
The table lists the 44 ISO 13485 procedures I3CGLOBAL writes for a medical device manufacturer, grouped by clause, with the purpose of each and when it applies. Items marked “if applicable” are needed only when the organisation performs that activity; the rest are required for every QMS.
Clause 4: ISO 13485 procedures for the quality management system
| No. | Clause | Procedure | Purpose and applicability |
|---|---|---|---|
| 1 | 4.1 | Regulatory compliance strategy | Strategy for compliance with Regulation (EU) 2017/745, including the conformity assessment procedures. Required for CE marking. |
| 2 | 4.1.5 | Outsourced processes | If applicable: any process that affects product conformity is outsourced. |
| 3 | 4.1.6 | Validation of software used in the QMS | If applicable: software applications are used within the QMS, for example document control or CAPA software. |
| 4 | 4.2.4 | Control of documents | Ensures all documents are created, reviewed, approved, issued, changed and controlled. |
| 5 | 4.2.5 | Control of records | Creating, collecting, storing, retrieving, retaining and disposing of records. |
Clauses 5 and 6: ISO 13485 procedures for management and resources
| No. | Clause | Procedure | Purpose and applicability |
|---|---|---|---|
| 6 | 5.6.1 | Management review | How top management conducts periodic reviews of the QMS, with the inputs and outputs of clauses 5.6.2 and 5.6.3. |
| 7 | 6.2 | Training and awareness | Ensures personnel performing work affecting product quality have the necessary competence, knowledge and skills. |
| 8 | 6.3 | Infrastructure | Ensures the physical and operational environment enables consistent production of safe and effective devices. |
| 9 | 6.3 | Maintenance activities | Keeps infrastructure in a suitable state for continued suitability and effectiveness. |
| 10 | 6.4.1 | Control of work environment | Maintains a work environment that controls contamination and ensures product quality. |
| 11 | 6.4.1 a) | Health, cleanliness and clothing | Health and hygiene controls for personnel. Crucial for sterile devices. |
| 12 | 6.4.2 | Control of contamination | Arrangements for contaminated or potentially contaminated product. Crucial for sterile devices. |
Clause 7: ISO 13485 procedures for product realisation
| No. | Clause | Procedure | Purpose and applicability |
|---|---|---|---|
| 13 | 7.1 | Risk management | Development, implementation and maintenance of a risk management system to ISO 14971 for all device types. |
| 14 | 7.2 | Customer-related processes | Review of requirements related to the product before committing to supply it. |
| 15 | 7.3 | Design and development | Documented system for design planning, inputs, outputs, review, verification, validation, transfer and changes. May be excluded only where regulations permit. |
| 16 | 7.3.7 | Clinical evaluation | Identifying, collecting, appraising and analysing clinical data from investigations, literature and post-market surveillance. |
| 17 | 7.4 | Purchasing | Purchasing products and services that affect device quality, including supplier evaluation and re-evaluation. |
| 18 | 7.5.1 | Control of production | Methods to plan, carry out, monitor and control production and service provision. |
| 19 | 7.5.2 | Cleanliness of product | Requirements for product cleanliness. Crucial for sterile devices. |
| 20 | 7.5.3 | Installation | If applicable: installation involves configuration, calibration or adjustment beyond placing the device. |
| 21 | 7.5.4 | Servicing | If applicable: servicing activities are performed and must not compromise safety or quality. |
| 22 | 7.5.6 | Validation of production and service processes | Validation of processes whose output cannot be verified by later monitoring, or where verification is destructive. |
| 23 | 7.5.6 | Validation of software used in production | If applicable: software is used in product realisation. |
| 24 | 7.5.7 | Validation of sterilisation and sterile barrier systems | If applicable: sterile devices. Covers sterilisation validation and sterile barrier validation. |
| 25 | 7.5.8 | Product identification | Identification of product and process results throughout the device lifecycle. |
| 26 | 7.5.8 | Medical device labelling | Symbols and information supplied to the customer through labelling for normal use. |
| 27 | 7.5.8 | Identification of returned devices | Separation of product returned from the market from normal production. |
| 28 | 7.5.9 | Traceability | Tracking and recording the history, location and application of devices, parts and materials. |
| 29 | 7.5.9 | Verification of UDI | Implementing and maintaining the Unique Device Identification system and Basic UDI-DI for devices placed on the EU market. |
| 30 | 7.5.11 | Preservation of product | Maintaining quality and safety during storage, handling, distribution, installation and service. |
| 31 | 7.6 | Control of monitoring and measuring equipment | Accuracy and reliability of tools and instruments, including calibration. |
| 32 | 7.6 | Validation of software used for monitoring and measurement | If applicable: software is used to monitor or measure product. |
Clause 8: ISO 13485 procedures for measurement, analysis and improvement
| No. | Clause | Procedure | Purpose and applicability |
|---|---|---|---|
| 33 | 8.2.1 | Feedback | Gathering data from production and post-production activities as input to risk management and improvement. |
| 34 | 8.2.1 | Post-market surveillance | PMS of devices after release. Required for devices placed on the EU market. |
| 35 | 8.2.1 | Post-market clinical follow-up | Proactive collection and evaluation of clinical data from use of the device. Required for devices placed on the EU market. |
| 36 | 8.2.2 | Complaint handling | Receiving, evaluating, investigating and responding to complaints. |
| 37 | 8.2.3 | Vigilance control | Reporting adverse events and field safety corrective actions to regulatory authorities as required by the regulations. |
| 38 | 8.2.3 | Communication with regulatory authorities | Handling communication with competent authorities, Notified Bodies, other economic operators, customers and other stakeholders. |
| 39 | 8.2.4 | Internal audit | Planned and documented arrangements for internal audits. |
| 40 | 8.3 | Control of nonconforming product | Handling product that does not meet specifications to prevent unintended use or distribution. |
| 41 | 8.3.3 | Advisory notices | Defining and taking action on product that does not conform after delivery, including field safety notices. |
| 42 | 8.3.4 | Rework | Controlling rework, including the types of rework permitted and the conditions under which it is allowed. |
| 43 | 8.4 | Analysis of data | Data analysis to demonstrate suitability and effectiveness of the QMS and drive improvement. |
| 44 | 8.5.2 and 8.5.3 | Corrective and preventive action (CAPA) | Initiating and implementing effective corrective and preventive actions when nonconformities or potential nonconformities are detected. |
Need the ISO 13485 procedures themselves? I3CGLOBAL’s ISO 13485 SOP templates contain each of these procedures with the matching record formats in editable Word files, or our ISO 13485 consultants can write them for your process.
Exclusions
Which ISO 13485 Clauses Can Be Excluded or Marked Not Applicable?
Not every one of the ISO 13485 procedures above applies to every company. ISO 13485:2016 allows two different ways to leave out requirements, and auditors expect you to use the right term for each.
Design and development (clause 7.3) only. Clause 1 of the standard says that where applicable regulatory requirements permit the exclusion of design and development controls, this can be used as a justification for excluding them from the QMS. A contract manufacturer that builds to a customer’s design, or a distributor, typically excludes 7.3. The responsibility for design controls then rests with the legal manufacturer.
Any requirement in clauses 6, 7 or 8 that does not apply because of the activities the organisation undertakes or the nature of its device. Examples: sterilisation validation (7.5.7) for a non-sterile device, installation (7.5.3) for a disposable, servicing (7.5.4) where no servicing is offered, implantable device records (7.5.9.2) for non-implants. Clauses 4 and 5 can never be marked not applicable.
In both cases the standard requires the organisation to document the rationale, confirm that the omission does not affect its ability to provide safe and effective devices, and record the decision in the quality manual. Exclusions and non-applications are checked at Stage 1 of the certification audit and challenged at Stage 2 if the auditor sees the activity being performed.
| Situation | Clause | Exclusion or non-applicability | Typical justification |
|---|---|---|---|
| Contract manufacturer building to the legal manufacturer’s design | 7.3 | Exclusion | Design responsibility rests with the customer; permitted by the applicable regulation |
| Non-sterile device | 7.5.5, 7.5.7 | Non-applicable | No sterile devices are manufactured; cleanliness controlled under 7.5.2 |
| Single-use device with no installation | 7.5.3 | Non-applicable | Device is used as supplied; no installation activity |
| No servicing offered | 7.5.4 | Non-applicable | Servicing is not part of the organisation’s activities |
| No implantable devices | 7.5.9.2 | Non-applicable | Specific traceability records for implants are not needed |
| No software in production or QMS | 4.1.6, 7.5.6, 7.6 | Non-applicable (software validation parts) | No software applications are used in the QMS, production or measurement |
Quality manual
How Do You Document Exclusions and Non-Applicability in the Quality Manual?
Clause 4.2.2 requires the quality manual to state the scope of the QMS, including details of and justification for any exclusion or non-application, to include or reference the documented procedures, and to describe the interaction between the processes. A clear exclusion statement has four parts.
- Identify the clauseQuote the clause number and title exactly as in ISO 13485:2016, for example “7.5.7 Particular requirements for validation of processes for sterilisation and sterile barrier systems”.
- State the typeSay whether it is an exclusion (7.3 only) or a non-application (clauses 6, 7 or 8), using the standard’s own terms.
- Give the justificationDescribe the activity or device characteristic that makes the requirement irrelevant, and for 7.3 cite the regulatory provision that permits exclusion.
- Confirm no impactState that the omission does not affect the organisation’s ability or responsibility to provide medical devices that meet customer and regulatory requirements, and that applicable regulatory requirements are still met.
Keep the scope statement on the certificate consistent with these exclusions. If a contract manufacturer later starts designing its own devices, clause 7.3 must be brought into the QMS and the certification body informed before the next audit.
Writing procedures
How Should an ISO 13485 Procedure Be Structured?
Auditors look for ISO 13485 procedures that describe what the company actually does, in language the process owner uses. I3CGLOBAL’s procedures follow one structure so that staff can find the same information in the same place every time.
1. Purpose and scope
Why the procedure exists and which products, sites and departments it covers. Reference the ISO 13485 clause and any regulation it serves.
2. Responsibilities
Who approves, who performs and who records each step, by role rather than by name, matching the organisation chart.
3. Definitions and references
Terms, abbreviations and the related procedures, standards and regulations, for example ISO 14971 for risk management.
4. Procedure steps
Numbered steps or a flowchart describing the process in sequence, including decision points, acceptance criteria and escalation.
5. Records
The forms and records generated, their retention period and where they are stored, so the procedure links to clause 4.2.5.
6. Revision history
Document number, revision, approval signatures and a change summary, controlled under the document control procedure.
ISO 13485 procedures should be as short as the process allows. Detailed task steps belong in work instructions, and the evidence belongs in records. ISO 13485 procedures written this way are easier to train, easier to audit and easier to keep current when the standard or regulations change.
Audit findings
What Are Common Mistakes with ISO 13485 Procedures?
- Copying generic templates without adaptation. ISO 13485 procedures that describe processes the company does not perform, or miss ones it does, are the most frequent Stage 1 finding.
- Calling a non-application an exclusion. Only clause 7.3 can be excluded; everything else is non-applicable. Using the wrong term signals that the standard has not been read.
- No justification in the quality manual. Listing excluded clauses without the rationale required by clause 4.2.2.
- Procedures without records. A procedure that does not name the record it produces cannot be shown to be followed.
- Missing regulatory procedures. For CE-marked devices, PMS, PMCF, vigilance and UDI procedures are required alongside the classic ISO 13485 procedures.
- Uncontrolled changes. Procedures edited without revision control, re-approval and retraining, which creates a document control nonconformity.
- Ignoring software validation. QMS software, production software and measurement software each need validation under 4.1.6, 7.5.6 and 7.6 when they are used.
I3CGLOBAL support. Our ISO 13485 consultants write and implement these ISO 13485 procedures as part of a 90 to 120 day certification project, onsite or online. Typical fees are on the ISO 13485 certification cost page, and the full certification route is explained on our ISO 13485 certification page.
Work with I3CGLOBAL
Get Your ISO 13485 Procedures Written and Implemented
I3CGLOBAL has written and implemented ISO 13485 quality management systems for medical device, IVD and software manufacturers since 2000, with onsite and online delivery from India, Europe, the UK and the USA.
- All 44 procedures and record templates in editable Word format
- Quality manual with correctly justified exclusions and non-applications
- ISO 13485 procedures written for your process, with training for process owners
- Internal audit, management review and certification audit support
Request your proposal
Tell us your device type and whether you need templates only or full implementation support.
FAQs
ISO 13485 Procedures: Frequently Asked Questions
How many mandatory procedures does ISO 13485 require?
ISO 13485:2016 explicitly requires documented procedures in more than 25 places, and when regulatory procedures such as PMS, vigilance and UDI are included, a complete medical device QMS typically has about 40. I3CGLOBAL's implementation uses 44 ISO 13485 procedures across clauses 4 to 8; the number applicable to a specific company depends on its activities.
What is the difference between a procedure, a work instruction and a record?
A procedure describes how a process is performed and who is responsible. A work instruction gives step-by-step detail for a single task, such as operating a machine. A record is the completed form or data that proves the procedure was followed. ISO 13485 controls documents under clause 4.2.4 and records under clause 4.2.5.
Which ISO 13485 clauses can be excluded?
Only design and development (clause 7.3) can be formally excluded, and only where applicable regulatory requirements permit it, for example for a contract manufacturer that builds to its customer's design. Requirements in clauses 6, 7 and 8 that do not apply because of the organisation's activities or device type are marked not applicable instead. Clauses 4 and 5 always apply.
What is the difference between scope exclusion and non-applicability?
Exclusion is the formal removal of design and development controls permitted by clause 1 of ISO 13485:2016. Non-applicability is the statement that a requirement in clauses 6, 7 or 8 does not apply to the organisation, for example sterilisation validation for a non-sterile device. Both must be justified in the quality manual under clause 4.2.2.
Do ISO 13485 procedures have to follow a specific format?
No. ISO 13485 does not prescribe a format, but each procedure must be controlled, approved and traceable to the clause it satisfies. I3CGLOBAL uses a six-part structure: purpose and scope, responsibilities, definitions and references, procedure steps, records, and revision history.
Are ISO 13485 procedures the same as FDA QMSR procedures?
Largely yes. The FDA Quality Management System Regulation, applicable from 2 February 2026, incorporates ISO 13485:2016, so the same procedures satisfy both. A few additional US-specific requirements on labelling and packaging controls, complaint files and records must be added for devices sold in the USA.
Can I buy ready-made ISO 13485 procedures?
Yes. I3CGLOBAL's ISO 13485 SOP templates include every procedure in this list with the matching record formats as editable Word files, mapped clause by clause. They must be adapted to your actual processes; our consultants can do that as part of an implementation project.