`
`
`
`
`
`
`
`
`INTERNATIONAL
`STANDARD
`
`ISO
`13485
`
`Second edition
`2003-07-15
`
`Medical devices — Quality management
`systems — Requirements for regulatory
`purposes
`
`Dispositifs médicaux — Systèmes de management de la qualité —
`Exigences à des fins réglementaires
`
`
`
`
`
`
`
`
`
`
`
`
`Reference number
`ISO 13485:2003(E)
`
`© ISO 2003
`
`JUBILANT EXHIBIT 1023
`Jubilant v. Bracco, IPR2018-01449
`
`

`

`ISO 13485:2003(E)
`
`PDF disclaimer
`This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may be printed or viewed but
`shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In
`downloading this file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Secretariat
`accepts no liability in this area.
`Adobe is a trademark of Adobe Systems Incorporated.
`Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation
`parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In
`the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below.
`
`
`
`
`
`© ISO 2003
`All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means,
`electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or
`ISO's member body in the country of the requester.
`ISO copyright office
`Case postale 56 • CH-1211 Geneva 20
`Tel. + 41 22 749 01 11
`Fax + 41 22 749 09 47
`E-mail copyright@iso.org
`Web www.iso.org
`Published in Switzerland
`
`
`ii
`
`
`© ISO 2003 — All rights reserved
`
`

`

`ISO 13485:2003(E)
`
`Contents
`
`Page
`
`Foreword............................................................................................................................................................ iv
`0
`Introduction ........................................................................................................................................... v
`0.1
`General................................................................................................................................................... v
`0.2
`Process approach ................................................................................................................................. v
`0.3
`Relationship with other standards ..................................................................................................... vi
`0.4
`Compatibility with other management systems ............................................................................... vi
`1
`Scope...................................................................................................................................................... 1
`1.1
`General................................................................................................................................................... 1
`1.2
`Application............................................................................................................................................. 1
`2
`Normative references ........................................................................................................................... 2
`3
`Terms and definitions........................................................................................................................... 2
`4
`Quality management system ............................................................................................................... 4
`4.1
`General requirements ........................................................................................................................... 4
`4.2
`Documentation requirements .............................................................................................................. 4
`5
`Management responsibility.................................................................................................................. 6
`5.1
`Management commitment.................................................................................................................... 6
`5.2
`Customer focus..................................................................................................................................... 6
`5.3
`Quality policy......................................................................................................................................... 6
`5.4
`Planning ................................................................................................................................................. 7
`5.5
`Responsibility, authority and communication................................................................................... 7
`5.6
`Management review .............................................................................................................................. 8
`6
`Resource management......................................................................................................................... 8
`6.1
`Provision of resources ......................................................................................................................... 8
`6.2
`Human resources.................................................................................................................................. 9
`6.3
`Infrastructure......................................................................................................................................... 9
`6.4
`Work environment................................................................................................................................. 9
`7
`Product realization..............................................................................................................................10
`7.1
`Planning of product realization ......................................................................................................... 10
`7.2
`Customer-related processes.............................................................................................................. 10
`7.3
`Design and development....................................................................................................................11
`7.4
`Purchasing........................................................................................................................................... 13
`7.5
`Production and service provision..................................................................................................... 14
`7.6
`Control of monitoring and measuring devices ................................................................................ 17
`8
`Measurement, analysis and improvement........................................................................................17
`8.1
`General................................................................................................................................................. 17
`8.2
`Monitoring and measurement............................................................................................................ 18
`8.3
`Control of nonconforming product ................................................................................................... 19
`8.4
`Analysis of data................................................................................................................................... 19
`8.5
`Improvement........................................................................................................................................ 20
`Annex A (informative) Correspondence between ISO 13485:2003 and ISO 13485:1996........................... 21
`Annex B (informative) Explanation of differences between ISO 13485:2003 and ISO 9001:2000 ............ 25
`Bibliography ..................................................................................................................................................... 57
`
`
`© ISO 2003 — All rights reserved
`
`iii
`
`
`
`

`

`ISO 13485:2003(E)
`
`Foreword
`
`ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies
`(ISO member bodies). The work of preparing International Standards is normally carried out through ISO
`technical committees. Each member body interested in a subject for which a technical committee has been
`established has the right to be represented on that committee. International organizations, governmental and
`non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the
`International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
`
`International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
`
`The main task of technical committees is to prepare International Standards. Draft International Standards
`adopted by the technical committees are circulated to the member bodies for voting. Publication as an
`International Standard requires approval by at least 75 % of the member bodies casting a vote.
`
`Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
`rights. ISO shall not be held responsible for identifying any or all such patent rights.
`
`ISO 13485 was prepared by Technical Committee ISO/TC 210, Quality management and corresponding
`general aspects for medical devices.
`
`This second edition cancels and replaces the first edition (ISO 13485:1996), which has been technically
`revised. It also cancels and replaces ISO 13488:1996. Those organizations which have used ISO 13488 in the
`past may use this International Standard by excluding certain requirements in accordance with 1.2.
`
`This edition of ISO 13485 has a revised title and addresses quality assurance of product, customer
`requirements, and other elements of quality system management.
`
`iv
`
`
`© ISO 2003 — All rights reserved
`
`

`

`ISO 13485:2003(E)
`
`0
`
`Introduction
`
`0.1 General
`
`This International Standard specifies requirements for a quality management system that can be used by an
`organization for the design and development, production, installation and servicing of medical devices, and
`the design, development, and provision of related services.
`
`It can also be used by internal and external parties, including certification bodies, to assess the organization’s
`ability to meet customer and regulatory requirements.
`
`Information marked “NOTE” is for guidance in understanding or clarifying the associated requirement.
`
`It is emphasized that the quality management system requirements specified in this International Standard
`are complementary to technical requirements for products.
`
`The adoption of a quality management system should be a strategic decision of an organization. The design
`and implementation of an organization's quality management system is influenced by varying needs,
`particular objectives, the products provided, the processes employed and the size and structure of the
`organization. It is not the intent of this International Standard to imply uniformity in the structure of quality
`management systems or uniformity of documentation.
`
`There is a wide variety of medical devices and some of the particular requirements of this International
`Standard only apply to named groups of medical devices. These groups are defined in Clause 3.
`
`0.2 Process approach
`
`This International Standard is based on a process approach to quality management.
`
`Any activity that receives inputs and converts them to outputs can be considered as a process.
`
`For an organization to function effectively, it has to identify and manage numerous linked processes.
`
`Often the output from one process directly forms the input to the next.
`
`The application of a system of processes within an organization, together with the identification and
`interactions of these processes, and their management, can be referred to as the “process approach”.
`
`0.3 Relationship with other standards
`
`0.3.1 Relationship with ISO 9001
`
`While this is a stand-alone standard, it is based on ISO 9001.
`
`Those clauses or subclauses that are quoted directly and unchanged from ISO 9001 are in normal font. The
`fact that these subclauses are presented unchanged is noted in Annex B.
`
`Where the text of this International Standard is not identical to the text of ISO 9001, the sentence or indent
`containing that text as a whole is shown in italics (in blue italics for electronic versions). The nature and
`reasons for the text changes are noted in Annex B.
`
`© ISO 2003 — All rights reserved
`
`v
`
`
`
`

`

`ISO 13485:2003(E)
`
`0.3.2 Relationship with ISO/TR 14969
`
`ISO/TR 14969 is a Technical Report intended to provide guidance for the application of ISO 13485.
`
`0.4 Compatibility with other management systems
`
`This International Standard follows the format of ISO 9001 for the convenience of users in the medical device
`community.
`
`This International Standard does not include requirements specific to other management systems, such as
`those particular to environmental management, occupational health and safety management, or financial
`management.
`
`However, this International Standard enables an organization to align or integrate its own quality management
`system with related management system requirements. It is possible for an organization to adapt its existing
`management system(s) in order to establish a quality management system that complies with the
`requirements of this International Standard.
`
`
`
`vi
`
`
`© ISO 2003 — All rights reserved
`
`

`

`INTERNATIONAL STANDARD
`
`
`ISO 13485:2003(E)
`
`Medical devices — Quality management systems —
`Requirements for regulatory purposes
`
`1 Scope
`
`1.1 General
`
`This International Standard specifies requirements for a quality management system where an organization
`needs to demonstrate its ability to provide medical devices and related services that consistently meet
`customer requirements and regulatory requirements applicable to medical devices and related services.
`
`The primary objective of this International Standard is to facilitate harmonized medical device regulatory
`requirements for quality management systems. As a result, it includes some particular requirements for
`medical devices and excludes some of the requirements of ISO 9001 that are not appropriate as regulatory
`requirements. Because of these exclusions, organizations whose quality management systems conform to
`this International Standard cannot claim conformity to ISO 9001 unless their quality management systems
`conform to all the requirements of ISO 9001 (see Annex B).
`
`1.2 Application
`
`All requirements of this International Standard are specific to organizations providing medical devices,
`regardless of the type or size of the organization.
`
`If regulatory requirements permit exclusions of design and development controls (see 7.3), this can be used
`as a justification for their exclusion from the quality management system. These regulations can provide
`alternative arrangements that are to be addressed in the quality management system. It is the responsibility
`of the organization to ensure that claims of conformity with this International Standard reflect exclusion of
`design and development controls [see 4.2.2 a) and 7.3].
`
`If any requirement(s) in Clause 7 of this International Standard is(are) not applicable due to the nature of the
`medical device(s) for which the quality management system is applied, the organization does not need to
`include such a requirement(s) in its quality management system [see 4.2.2 a)].
`
`The processes required by this International Standard, which are applicable to the medical device(s), but
`which are not performed by the organization, are the responsibility of the organization and are accounted for
`in the organization’s quality management system [see 4.1 a)].
`
`In this International Standard the terms “if appropriate” and “where appropriate” are used several times. When
`a requirement is qualified by either of these phrases, it is deemed to be “appropriate” unless the organization
`can document a justification otherwise. A requirement is considered “appropriate” if it is necessary in order for
`
`
`
`the product to meet specified requirements, and/or
`
`
`
`the organization to carry out corrective action.
`
`© ISO 2003 — All rights reserved
`
`1
`
`
`
`

`

`ISO 13485:2003(E)
`
`2 Normative references
`
`The following referenced documents are indispensable for the application of this document. For dated
`references, only the edition cited applies. For undated references, the latest edition of the referenced
`document (including any amendments) applies.
`
`ISO 9000:2000, Quality management systems — Fundamentals and vocabulary
`
`3 Terms and definitions
`
`For the purposes of this document, the terms and definitions given in ISO 9000 apply, together with the
`following.
`
`The following terms, used in this edition of ISO 13485 to describe the supply chain, have been changed to
`reflect the vocabulary currently used:
`
`supplier -------------> organization ----------> customer
`
`The term “organization” replaces the term “supplier” used in ISO 13485:1996, and refers to the unit to which
`this International Standard applies. Also, the term “supplier” now replaces the term “subcontractor”.
`
`Throughout the text of this International Standard, wherever the term “product” occurs, it can also mean
`“service”.
`
`Wherever requirements are specified as applying to “medical devices”, the requirements apply equally to
`related services as supplied by the organization.
`
`The following definitions should be regarded as generic, as definitions provided in national regulations can
`differ slightly and take precedence.
`
`3.1
`active implantable medical device
`active medical device which is intended to be totally or partially introduced, surgically or medically, into the
`human body or by medical intervention into a natural orifice, and which is intended to remain after the
`procedure
`
`3.2
`active medical device
`medical device relying for its functioning on a source of electrical energy or any source of power other than
`that directly generated by the human body or gravity
`
`3.3
`advisory notice
`notice issued by the organization, subsequent to delivery of the medical device, to provide supplementary
`information and/or to advise what action should be taken in
`
`
`
`the use of a medical device,
`
`
`
`the modification of a medical device,
`
`
`
`the return of the medical device to the organization that supplied it, or
`
`
`
`the destruction of a medical device
`
`NOTE
`
`Issue of an advisory notice might be required to comply with national or regional regulations.
`
`2
`
`
`© ISO 2003 — All rights reserved
`
`

`

`ISO 13485:2003(E)
`
`3.4
`customer complaint
`written, electronic or oral communication that alleges deficiencies related to the identity, quality, durability,
`reliability, safety or performance of a medical device that has been placed on the market
`
`3.5
`implantable medical device
`medical device intended
`
`
`
`to be totally or partially introduced into the human body or a natural orifice, or
`
`
`
`to replace an epithelial surface or the surface of the eye,
`
`by surgical intervention, and which is intended to remain after the procedure for at least 30 days, and which
`can only be removed by medical or surgical intervention
`
`NOTE
`
`This definition applies to implantable medical devices other than active implantable medical devices.
`
`3.6
`labelling
`written, printed or graphic matter
`
` affixed to a medical device or any of its containers or wrappers, or
`
` accompanying a medical device,
`
`related to identification, technical description, and use of the medical device, but excluding shipping
`documents
`
`NOTE
`
`Some regional and national regulations refer to “labelling” as “information supplied by the manufacturer.”
`
`3.7
`medical device
`any instrument, apparatus, implement, machine, appliance, implant, in vitro reagent or calibrator, software,
`material or other similar or related article, intended by the manufacturer to be used, alone or in combination,
`for human beings for one or more of the specific purpose(s) of
`
` diagnosis, prevention, monitoring, treatment or alleviation of disease,
`
` diagnosis, monitoring, treatment, alleviation of or compensation for an injury,
`
`
`
`investigation, replacement, modification, or support of the anatomy or of a physiological process,
`
` supporting or sustaining life,
`
` control of conception,
`
` disinfection of medical devices,
`
` providing information for medical purposes by means of in vitro examination of specimens derived from
`the human body,
`
`and which does not achieve its primary intended action in or on the human body by pharmacological,
`immunological or metabolic means, but which may be assisted in its function by such means.
`
`This definition has been developed by the Global Harmonization Task Force (GHTF). See bibliographic
`NOTE
`reference [15].
`
`© ISO 2003 — All rights reserved
`
`3
`
`
`
`

`

`ISO 13485:2003(E)
`
`3.8
`sterile medical device
`category of medical device intended to meet the requirements for sterility
`
`NOTE
`standards.
`
`The requirements for sterility of a medical device might be subject to national or regional regulations or
`
`4 Quality management system
`
`4.1 General requirements
`
`The organization shall establish, document, implement and maintain a quality management system and
`maintain its effectiveness in accordance with the requirements of this International Standard.
`
`The organization shall
`
`a)
`
`identify the processes needed for the quality management system and their application throughout the
`organization (see 1.2),
`
`b) determine the sequence and interaction of these processes,
`
`c) determine criteria and methods needed to ensure that both the operation and control of these processes
`are effective,
`
`d) ensure the availability of resources and information necessary to support the operation and monitoring of
`these processes,
`
`e) monitor, measure and analyse these processes, and
`
`f)
`
`implement actions necessary to achieve planned results and maintain the effectiveness of these
`processes.
`
`These processes shall be managed by the organization in accordance with the requirements of this
`International Standard.
`
`Where an organization chooses to outsource any process that affects product conformity with requirements,
`the organization shall ensure control over such processes. Control of such outsourced processes shall be
`identified within the quality management system (see 8.5.1).
`
`Processes needed for the quality management system referred to above should include processes for
`NOTE
`management activities, provision of resources, product realization and measurement.
`
`4.2 Documentation requirements
`
`4.2.1 General
`
`The quality management system documentation shall include
`
`a) documented statements of a quality policy and quality objectives,
`
`b) a quality manual,
`
`c) documented procedures required by this International Standard,
`
`d) documents needed by the organization to ensure the effective planning, operation and control of its
`processes,
`
`4
`
`
`© ISO 2003 — All rights reserved
`
`

`

`ISO 13485:2003(E)
`
`e)
`
`records required by this International Standard (see 4.2.4), and
`
`f)
`
`any other documentation specified by national or regional regulations.
`
`Where this International Standard specifies that a requirement, procedure, activity or special arrangement be
`“documented”, it shall, in addition, be implemented and maintained.
`
`For each type or model of medical device, the organization shall establish and maintain a file either containing
`or identifying documents defining product specifications and quality management system requirements (see
`4.2.3). These documents shall define the complete manufacturing process and, if applicable, installation and
`servicing.
`
`The extent of the quality management system documentation can differ from one organization to another
`
`NOTE 1
`due to
`a)
`the size of the organization and type of activities,
`
`b)
`
`the complexity of processes and their interactions, and
`
`c)
`
`the competence of personnel.
`
`NOTE 2
`
`The documentation can be in any form or type of medium.
`
`4.2.2 Quality manual
`
`The organization shall establish and maintain a quality manual that includes
`
`a)
`
`the scope of the quality management system, including details of and justification for any exclusion and/or
`non-application (see 1.2),
`
`b)
`
`the documented procedures established for the quality management system, or reference to them, and
`
`c) a description of the interaction between the processes of the quality management system.
`
`The quality manual shall outline the structure of the documentation used in the quality management system.
`
`4.2.3 Control of documents
`
`Documents required by the quality management system shall be controlled. Records are a special type of
`document and shall be controlled according to the requirements given in 4.2.4.
`
`A documented procedure shall be established to define the controls needed
`
`a)
`
`to review and approve documents for adequacy prior to issue,
`
`b)
`
`to review and update as necessary and re-approve documents,
`
`c)
`
`to ensure that changes and the current revision status of documents are identified,
`
`d)
`
`to ensure that relevant versions of applicable documents are available at points of use,
`
`e)
`
`to ensure that documents remain legible and readily identifiable,
`
`f)
`
`to ensure that documents of external origin are identified and their distribution controlled, and
`
`g)
`
`to prevent the unintended use of obsolete documents, and to apply suitable identification to them if they
`are retained for any purpose.
`
`© ISO 2003 — All rights reserved
`
`5
`
`
`
`

`

`ISO 13485:2003(E)
`
`The organization shall ensure that changes to documents are reviewed and approved either by the original
`approving function or another designated function which has access to pertinent background information upon
`which to base its decisions.
`
`The organization shall define the period for which at least one copy of obsolete controlled documents shall be
`retained. This period shall ensure that documents to which medical devices have been manufactured and
`tested are available for at least the lifetime of the medical device as defined by the organization, but not less
`than the retention period of any resulting record (see 4.2.4), or as specified by relevant regulatory
`requirements.
`
`4.2.4 Control of records
`
`Records shall be established and maintained to provide evidence of conformity to requirements and of the
`effective operation of the quality management system. Records shall remain legible, readily identifiable and
`retrievable. A documented procedure shall be established to define the controls needed for the identification,
`storage, protection, retrieval, retention time and disposition of records.
`
`The organization shall retain the records for a period of time at least equivalent to the lifetime of the medical
`device as defined by the organization, but not less than two years from the date of product release by the
`organization or as specified by relevant regulatory requirements.
`
`5 Management responsibility
`
`5.1 Management commitment
`
`Top management shall provide evidence of its commitment to the development and implementation of the
`quality management system and maintaining its effectiveness by
`
`a) communicating to the organization the importance of meeting customer as well as statutory and
`regulatory requirements,
`
`b) establishing the quality policy,
`
`c) ensuring that quality objectives are established,
`
`d) conducting management reviews, and
`
`e) ensuring the availability of resources.
`
`For the purposes of this International Standard, statutory requirements are limited to the safety and
`NOTE
`performance of the medical device only.
`
`5.2 Customer focus
`
`Top management shall ensure that customer requirements are determined and are met (see 7.2.1 and 8.2.1).
`
`5.3 Quality policy
`
`Top management shall ensure that the quality policy
`
`a)
`
`is appropriate to the purpose of the organization,
`
`b)
`
`includes a commitment to comply with requirements and to maintain the effectiveness of the quality
`management system,
`
`c) provides a framework for establishing and reviewing quality objectives,
`
`6
`
`
`© ISO 2003 — All rights reserved
`
`

`

`ISO 13485:2003(E)
`
`d)
`
`is communicated and understood within the organization, and
`
`e)
`
`is reviewed for continuing suitability.
`
`5.4 Planning
`
`5.4.1 Quality objectives
`
`Top management shall ensure that quality objectives, including those needed to meet requirements for
`product [see 7.1 a)], are established at relevant functions and levels within the organization. The quality
`objectives shall be measurable and consistent with the quality policy.
`
`5.4.2 Quality management system planning
`
`Top management shall ensure that
`
`a)
`
`b)
`
`the planning of the quality management system is carried out in order to meet the requirements given in
`4.1, as well as the quality objectives, and
`
`the integrity of the quality management system is maintained when changes to the quality management
`system are planned and implemented.
`
`5.5 Responsibility, authority and communication
`
`5.5.1 Responsibility and authority
`
`that responsibilities and authorities are defined, documented and
`Top management shall ensure
`communicated within the organization.
`
`Top management shall establish the interrelation of all personnel who manage, perform and verify work
`affecting quality, and shall ensure the independence and authority necessary to perform these tasks.
`
`National or regional regulations might require the nomination of specific persons as responsible for activities
`NOTE
`related to monitoring experience from the post-production stage and reporting adverse events (see 8.2.1 and 8.5.1).
`
`5.5.2 Management representative
`
`Top management shall appoint a member of management who, irrespective of other responsibilities, shall
`have responsibility and authority that includes
`
`a) ensuring that processes needed for the quality management system are established, implemented and
`maintained,
`
`b)
`
`reporting to top management on the performance of the quality management system and any need for
`improvement (see 8.5), and
`
`c) ensuring the promotion of awareness of regulatory and customer requirements throughout the
`organization.
`
`The responsibility of a management representative can include liaison with external parties on matters
`NOTE
`relating to the quality management system.
`
`5.5.3
`
`Internal communication
`
`Top management shall ensure that appropriate communication processes are established within the
`organization and that communication takes place regarding the effectiveness of the quality management
`system.
`
`© ISO 2003 — All rights reserved
`
`7
`
`
`
`

`

`ISO 13485:2003(E)
`
`5.6 Management review
`
`5.6.1 General
`
`Top management shall review the organization’s quality management system, at planned intervals, to ensure
`its continuing suitability, adequacy and effectiveness. This review shall include assessing opportunities for
`improvement and the need for changes to the quality management system, including the quality policy and
`quality objectives.
`
`Records from management reviews shall be maintained (see 4.2.4).
`
`5.6.2 Review input
`
`The input to management review shall include information on
`
`a)
`
`results of audits,
`
`b) customer feedback,
`
`c) process performance and product conformity,
`
`d) status of preventive and corrective actions,
`
`e)
`
`follow-up actions from previous management reviews,
`
`f)
`
`changes that could affect the quality management system,
`
`g)
`
`recommendations for improvement, and
`
`h) new or revised regulatory requirements.
`
`5.6.3 Review output
`
`The output from the management review shall include any decisions and actions related to
`
`a)
`
`improvements needed to maintain the effectiveness of the quality management system and its processes,
`
`b)
`
`improvement of product related to customer requirements, and
`
`c)
`
`resource needs.
`
`6 Resource management
`
`6.1 Provision of resources
`
`The organization shall determine and provide the resources needed
`
`a)
`
`to implement the quality management system and to maintain its effectiveness, and
`
`b)
`
`to meet regulatory and customer requirements.
`
`8
`
`
`© ISO 2003 — All rights reserved
`
`

`

`ISO 13485:2003(E)
`
`6.2 Hum