TheArtOfService
Back to Frameworks

ISO 13485:2016

Self-Assess
International
v2016
5 domains
67 controls

ISO 13485:2016 Medical Devices Quality Management Systems Requirements.

Verified

ISO 13485:2016 is a compliance framework from International with 5 domains and 67 controls that map to 95 other frameworks. The largest domains are Product realization – ISO 13485:2016 (30 controls), Measurement, analysis and improvement – ISO 13485:2016 (15 controls), Management responsibility – ISO 13485:2016 (11 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykControl text last updated

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (5)

Management responsibility – ISO 13485:2016

11 controls
Controls in the Management responsibility – ISO 13485:2016 domain of ISO 13485:2016 — 11 controls
CodeTitle
iso-13485-2016::5.1Management commitment
iso-13485-2016::5.2Customer focus
iso-13485-2016::5.3Quality policy
iso-13485-2016::5.4.1Quality objectives
iso-13485-2016::5.4.2Quality management system planning
iso-13485-2016::5.5.1Responsibility and authority
iso-13485-2016::5.5.2Management representative
iso-13485-2016::5.5.3Internal communication
iso-13485-2016::5.6.1General
iso-13485-2016::5.6.2Review input
iso-13485-2016::5.6.3Review output

Measurement, analysis and improvement – ISO 13485:2016

15 controls
Controls in the Measurement, analysis and improvement – ISO 13485:2016 domain of ISO 13485:2016 — 15 controls
CodeTitle
iso-13485-2016::8.1General
iso-13485-2016::8.2.1Feedback
iso-13485-2016::8.2.2Complaint handling
iso-13485-2016::8.2.3Reporting to regulatory authorities
iso-13485-2016::8.2.4Internal audit
iso-13485-2016::8.2.5Monitoring and measurement of processes
iso-13485-2016::8.2.6Monitoring and measurement of product
iso-13485-2016::8.3.1General
iso-13485-2016::8.3.2Actions in response to nonconforming product detected before delivery
iso-13485-2016::8.3.3Actions in response to nonconforming product detected after delivery
iso-13485-2016::8.3.4Rework
iso-13485-2016::8.4Analysis of data
iso-13485-2016::8.5.1General
iso-13485-2016::8.5.2Corrective action
iso-13485-2016::8.5.3Preventive action

Product realization – ISO 13485:2016

30 controls
Controls in the Product realization – ISO 13485:2016 domain of ISO 13485:2016 — 30 controls
CodeTitle
iso-13485-2016::7.1Planning of product realization
iso-13485-2016::7.2.1Determination of requirements related to product
iso-13485-2016::7.2.2Review of requirements related to product
iso-13485-2016::7.2.3Communication
iso-13485-2016::7.3.1General
iso-13485-2016::7.3.10Design and development files
iso-13485-2016::7.3.2Design and development planning
iso-13485-2016::7.3.3Design and development inputs
iso-13485-2016::7.3.4Design and development outputs
iso-13485-2016::7.3.5Design and development review
iso-13485-2016::7.3.6Design and development verification
iso-13485-2016::7.3.7Design and development validation
iso-13485-2016::7.3.8Design and development transfer
iso-13485-2016::7.3.9Control of design and development changes
iso-13485-2016::7.4.1Purchasing process
iso-13485-2016::7.4.2Purchasing information
iso-13485-2016::7.4.3Verification of purchased product
iso-13485-2016::7.5.1Control of production and service provision
iso-13485-2016::7.5.10Customer property
iso-13485-2016::7.5.11Preservation of product
iso-13485-2016::7.5.2Cleanliness of product
iso-13485-2016::7.5.3Installation activities
iso-13485-2016::7.5.4Servicing activities
iso-13485-2016::7.5.5Particular requirements for sterile medical devices
iso-13485-2016::7.5.6Validation of processes for production and service provision
iso-13485-2016::7.5.7Particular requirements for validation of processes for sterilization and sterile barrier systems
iso-13485-2016::7.5.8Identification
iso-13485-2016::7.5.9.1General
iso-13485-2016::7.5.9.2Particular requirements for implantable medical devices
iso-13485-2016::7.6Control of monitoring and measuring equipment

Quality management system – ISO 13485:2016

6 controls
Controls in the Quality management system – ISO 13485:2016 domain of ISO 13485:2016 — 6 controls
CodeTitle
iso-13485-2016::4.1General requirements
iso-13485-2016::4.2.1General
iso-13485-2016::4.2.2Quality manual
iso-13485-2016::4.2.3Medical device file
iso-13485-2016::4.2.4Control of documents
iso-13485-2016::4.2.5Control of records

Resource management – ISO 13485:2016

5 controls
Controls in the Resource management – ISO 13485:2016 domain of ISO 13485:2016 — 5 controls
CodeTitle
iso-13485-2016::6.1Provision of resources
iso-13485-2016::6.2Human resources
iso-13485-2016::6.3Infrastructure
iso-13485-2016::6.4.1Work environment
iso-13485-2016::6.4.2Contamination control

Your Compliance Coverage

If you comply with ISO 13485:2016, you already cover:

ISO 19011:2018

21%

14 controls mapped

Compare →

ISO 10005:2005

19%

13 controls mapped

Compare →

ISO 9001

18%

12 controls mapped

Compare →

+ 92 more: ISO 9001:2015 (16%), ISO 50001:2018 - Energy Management Systems (15%)

See all 95 mapped frameworks ↓

Maps to 95 other frameworks

67 total controls
ISO 19011:2018
14 source controls mapped|26 target controls covered
21%
ISO 10005:2005
13 source controls mapped|11 target controls covered
19%
ISO 9001
12 source controls mapped|5 target controls covered
18%
ISO 9001:2015
11 source controls mapped|18 target controls covered
16%
ISO 50001:2018 - Energy Management Systems
10 source controls mapped|6 target controls covered
15%
ISO 14004:2016
9 source controls mapped|11 target controls covered
13%
ASIS SPC.1-2009 - Organizational Resilience Standard
8 source controls mapped|9 target controls covered
12%
ISO 22000:2018
6 source controls mapped|12 target controls covered
9%
AS9100D - Aerospace Quality Management System
5 source controls mapped|6 target controls covered
7%
ISO/IEC 38500:2024
4 source controls mapped|6 target controls covered
6%
ISO 27005:2022
3 source controls mapped|8 target controls covered
4%
ISO 28001:2007 Supply Chain Security Management
3 source controls mapped|3 target controls covered
4%
ISO 22301:2019
3 source controls mapped|7 target controls covered
4%
ISO 14064 - Greenhouse Gas Accounting and Verification (Parts 1-3)
3 source controls mapped|2 target controls covered
4%
AS9100D:2016 - Quality Management Systems for Aviation, Space, and Defence
3 source controls mapped|3 target controls covered
4%
ISO 14001:2015
3 source controls mapped|8 target controls covered
4%
ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence
3 source controls mapped|4 target controls covered
4%
Australia NHMRC National Statement on Ethical Conduct in Human Research
3 source controls mapped|2 target controls covered
4%
ISO 22000
2 source controls mapped|2 target controls covered
3%
ISO/IEC 23894:2023
2 source controls mapped|8 target controls covered
3%
ISO 31000:2018
2 source controls mapped|6 target controls covered
3%
ISO/IEC 42001:2023
2 source controls mapped|2 target controls covered
3%
ISO 22318
2 source controls mapped|3 target controls covered
3%
ISO 26000:2010
2 source controls mapped|4 target controls covered
3%
ISO 39001:2012 - Road Traffic Safety Management
2 source controls mapped|3 target controls covered
3%
ISO/IEC 27004:2016
2 source controls mapped|2 target controls covered
3%
ISO 22320:2018
2 source controls mapped|3 target controls covered
3%
ISO/IEC 27031:2011
2 source controls mapped|2 target controls covered
3%
ISO 22316
2 source controls mapped|2 target controls covered
3%
ISO 22317
2 source controls mapped|2 target controls covered
3%
Canada's Anti-Spam Legislation (CASL)
2 source controls mapped|2 target controls covered
3%
ISO/IEC TR 24028:2020
2 source controls mapped|7 target controls covered
3%
NIST SP 800-160
2 source controls mapped|2 target controls covered
3%
BCBS 239
2 source controls mapped|1 target controls covered
3%
ISO 45001:2018
2 source controls mapped|2 target controls covered
3%
ISO/IEC 17025:2017 - General Requirements for Testing and Calibration
2 source controls mapped|6 target controls covered
3%
ISO 37301:2021
2 source controls mapped|6 target controls covered
3%
ISO 37001:2016
2 source controls mapped|3 target controls covered
3%
ISO 27701:2019
2 source controls mapped|3 target controls covered
3%
ISO 56002
2 source controls mapped|3 target controls covered
3%
ISO/IEC 27006-1:2024
2 source controls mapped|2 target controls covered
3%
ISO/IEC 17025:2017 - General Requirements for Testing and Calibration Laboratories
2 source controls mapped|2 target controls covered
3%
ISO 55001:2014
2 source controls mapped|2 target controls covered
3%
ISO 55001
2 source controls mapped|2 target controls covered
3%
BS 65000:2014 - Guidance on Organizational Resilience
2 source controls mapped|1 target controls covered
3%
ISO 37301
2 source controls mapped|2 target controls covered
3%
ISO 31000
1 source controls mapped|1 target controls covered
1%
ISO/IEC 29147:2018
1 source controls mapped|2 target controls covered
1%
PCI PIN Security
1 source controls mapped|1 target controls covered
1%
NIST SP 800-183
1 source controls mapped|2 target controls covered
1%
NSA Guidance for Transition to Quantum-Resistant Cryptography
1 source controls mapped|1 target controls covered
1%
ISO/IEC 27701:2019
1 source controls mapped|1 target controls covered
1%
UK Bribery Act 2010
1 source controls mapped|1 target controls covered
1%
Brazil AI Framework
1 source controls mapped|1 target controls covered
1%
ISO/IEC 30111:2019
1 source controls mapped|1 target controls covered
1%
ISO/IEC 27557:2022 - Organisational Privacy Risk Management
1 source controls mapped|1 target controls covered
1%
NIST SP 1800-32
1 source controls mapped|1 target controls covered
1%
ISAE 3402 - Assurance Reports on Controls at a Service Organisation
1 source controls mapped|1 target controls covered
1%
PCI P2PE
1 source controls mapped|1 target controls covered
1%
FFIEC IT Examination Handbook
1 source controls mapped|1 target controls covered
1%
OWASP ASVS
1 source controls mapped|1 target controls covered
1%
PCI SSF
1 source controls mapped|1 target controls covered
1%
Critical Infrastructure Risk Management Program (CIRMP) Rules 2023
1 source controls mapped|1 target controls covered
1%
FBI CJIS Security Policy
1 source controls mapped|1 target controls covered
1%
ISO 27043
1 source controls mapped|1 target controls covered
1%
ISO/IEC 27050 - Electronic Discovery (Parts 1-4)
1 source controls mapped|1 target controls covered
1%
SANS Incident Handler's Handbook and PICERL Methodology
1 source controls mapped|1 target controls covered
1%
Canada ITSG-33 - IT Security Risk Management
1 source controls mapped|1 target controls covered
1%
NIST SP 800-171
1 source controls mapped|1 target controls covered
1%
NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements
1 source controls mapped|1 target controls covered
1%
ISO 20400:2017 - Sustainable Procurement
1 source controls mapped|1 target controls covered
1%
ISO 26262:2018 - Functional Safety for Road Vehicles
1 source controls mapped|1 target controls covered
1%
IEC 62304:2015 Medical Device Software Lifecycle Processes
1 source controls mapped|1 target controls covered
1%
ISO 37001
1 source controls mapped|1 target controls covered
1%
ISO 19011
1 source controls mapped|1 target controls covered
1%
ISO 10006:2003
1 source controls mapped|1 target controls covered
1%
IEC 60601-1 - Medical Electrical Equipment Safety
1 source controls mapped|1 target controls covered
1%
ISO 10007:2017
1 source controls mapped|3 target controls covered
1%
COPPA
1 source controls mapped|1 target controls covered
1%
ITIL 4
1 source controls mapped|1 target controls covered
1%
SOC 1 (SSAE 18 / ISAE 3402)
1 source controls mapped|1 target controls covered
1%
Aged Care Quality Standards 2019 (repealed edition)
1 source controls mapped|1 target controls covered
1%
Cambodia Sub-Decree on Personal Data Protection (Sub-Decree No. 134)
1 source controls mapped|1 target controls covered
1%
AICPA Privacy Management Framework (PMF)
1 source controls mapped|1 target controls covered
1%
APPI
1 source controls mapped|1 target controls covered
1%
EDPB Guidelines 1/2026 on processing of personal data for scientific research purposes
1 source controls mapped|1 target controls covered
1%
ISO 41001:2018 - Facility Management Systems
1 source controls mapped|2 target controls covered
1%
ISO 30401
1 source controls mapped|1 target controls covered
1%
ISO 37002:2021 - Whistleblowing Management Systems
1 source controls mapped|2 target controls covered
1%
ISO/IEC 27003:2017
1 source controls mapped|2 target controls covered
1%
ISO 22313:2020 - Guidance on Business Continuity Management Systems
1 source controls mapped|1 target controls covered
1%
APRA CPS 220 Risk Management
1 source controls mapped|1 target controls covered
1%
ISO 45001
1 source controls mapped|1 target controls covered
1%
NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management
1 source controls mapped|1 target controls covered
1%
EBA Guidelines on ICT and Security Risk Management (EBA/GL/2019/04)
1 source controls mapped|1 target controls covered
1%
Compare ISO 13485:2016 with ISO 19011:2018

Coverage is not the same as your position

This page shows what ISO 13485:2016 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is ISO 13485:2016 and who does it apply to?

ISO 13485:2016 is a compliance framework from International with 5 domains and 67 controls. ISO 13485:2016 Medical Devices Quality Management Systems Requirements. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does ISO 13485:2016 actually require?

ISO 13485:2016 has 67 controls organised across 5 domains. The largest domains are Product realization – ISO 13485:2016 (30 controls), Measurement, analysis and improvement – ISO 13485:2016 (15 controls), Management responsibility – ISO 13485:2016 (11 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of ISO 13485:2016 do I already cover?

ISO 13485:2016 maps to 95 other compliance frameworks. The top mapping partners are ISO 19011:2018 (21% coverage), ISO 10005:2005 (19% coverage), ISO 9001 (18% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement ISO 13485:2016?

Start your ISO 13485:2016 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO 13485:2016 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 67 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 703 frameworks.

Get Started Free →

Free forever — no credit card required