ISO 13485:2016 4.1: General requirements

The organization documents a quality management system and keeps it effective as the standard and the applicable regulatory requirements demand, recording the regulatory role or roles it holds (for example manufacturer, authorized representative, importer or distributor). It determines which processes the system needs and how they apply across the organization, taking those roles into account; controls those processes using an approach based on risk; and determines the order in which they run and how they interact. For every process it: determines the criteria and methods needed to run and control it effectively; makes sure the resources and information needed are available; carries out the actions required to reach the planned results; monitors, measures as appropriate and analyses the process; and keeps the records needed to show conformity to the standard and compliance with regulatory requirements. Any change to these processes is assessed for its effect on the quality management system and on the medical devices produced under it, and is controlled. Where the organization outsources a process that affects product conformity, it monitors and controls that process and remains responsible for conformity; the controls are proportionate to the risk and to the outside party's ability to meet requirements, and include written quality agreements. The organization documents procedures for validating software used within the quality management system, applied before first use and after changes, with an approach proportionate to the risk of using the software, and keeps records of the validation.