ISO 13485
The quality management standard for medical devices: what it asks you to document, and what the auditor reads when they arrive.
ISO 13485 is the international standard for a quality management system in medical devices. Published as ISO 13485:2016, it sets risk-based requirements for design controls, process validation, identification and traceability, and the record of manufacture kept for every device or batch.
Quality management requirements specific to medical devices, including design controls, risk management, traceability, and the device history record.
International Organization for Standardization (ISO)
Organizations at any stage of the medical device life cycle, and their suppliers. ISO 13485:2016.
Certification is granted to an organization's quality management system by an accredited registrar, never to a product or a vendor.
Organizations involved in the design, production, installation, or servicing of medical devices, and their suppliers.
| Requirement | Module | What It Does |
|---|---|---|
| Record of manufacture per batch | Production | Clause 7.5.1 asks for a record per device or batch that provides traceability and identifies the amount manufactured and the amount approved for distribution. WorkCell writes that from the work order: operators record quantities, scrap, and time at each operation, completion assigns the lot or serial, and released quantity is a state the system holds rather than a number someone tallies on a clipboard. Approving the release against your own procedure stays with your quality function. |
| Identification and traceability | Inventory | Receiving records the lot and its certificate, every issue to a work order preserves the link, and completion assigns the serial or finished lot. One identifier resolves backward to each component lot, the operator on each operation, and the inspection results recorded against it. Clause 7.5.9.2 tightens this for implantable devices, where records of the components, materials, and work environment conditions that could cause the device to miss its specified safety and performance have to be retained. |
| Acceptance activities and enforced hold states | Quality | AQL sampling plans and inspection templates define what gets checked at receiving, in process, and at final, and results land against the characteristic at the operation that produced it. Material that fails sits in a hold state the system enforces, so a rejected lot cannot be issued because the floor was behind schedule. Gage calibration records, which clause 7.6 requires for monitoring and measuring equipment, are not in WorkCell and stay in your calibration system. |
| Nonconforming product and corrective action | Quality | Clause 8.3 wants nonconforming product identified, documented, evaluated, segregated, and dispositioned with a record of the justification. Clause 8.5.2 wants corrective action proportionate to the effect of the nonconformity. WorkCell raises severity-classified nonconformances against the job, the lot, and the part, and escalates systemic causes into an 8-D, which carries the containment, the root cause, the action implemented and the verification of effectiveness that 8.5.2 asks for, each dated against the nonconformity that started it. |
| The build configuration a device was actually made to | Engineering | The standard controls design and development changes, and clause 4.2.3 expects the medical device file to hold the current product specification and manufacturing method. WorkCell versions bills of material and routings with effective dating, and a change supersedes rather than overwrites, so a lot built two years ago still resolves to its own structure and process. Routed engineering change approval and controlled document revision are gaps, not features, and remain in your document system. The standard also requires you to determine the significance of a change to function, performance, usability, safety, and applicable regulatory requirements before approving it, and that determination is a judgement no system makes for you. |
| Attribution and role-based access on every transaction | Workforce | Clause 4.2.5 wants records that stay legible, identifiable, and retrievable for at least the lifetime of the device, and clause 6.2 wants competence and training records for the people doing the work. WorkCell stamps who performed each transaction and when, and enforces permissions by role at the data layer with tenant isolation. It does not hold training records, qualification matrices, or the signed procedures an auditor samples in the first hour. |
Clause 4.2.3 asks for one file per device type or family holding the general description and intended use, the product specification, the specifications or procedures for manufacturing, packaging, storage, handling, and distribution, and the requirements for measuring, monitoring, installation, and servicing. The auditor opens it and then checks that the floor is running what it says. WorkCell holds the part, its revision, its bill of material, and its routing; the file itself and its controlled documents live in your document system.
The auditor chooses a lot off the shelf or out of your shipping log and asks to see its record: when it was made, how much was made, how much was approved for distribution, which component lots went in, who ran each step, and what was inspected. The useful test is how long the answer takes. Pulled out of the work order it is a query; assembled from a paper traveler and three spreadsheets it is an afternoon, and the gaps surface in front of the auditor.
Expect a backward trace from a finished device to every component lot inside it, and a forward trace from a suspect incoming lot to every device it reached and every customer it shipped to. Clause 7.5.9 makes this a documented procedure with a defined extent, not an improvised exercise, and 7.5.9.2 adds that distribution records must let an implantable be traced. WorkCell carries genealogy on every issue, so both directions resolve from one identifier rather than from a parallel workbook.
The standard requires validation of any production process whose resulting output cannot be verified by subsequent monitoring or measurement, with documented criteria for review and approval, approval of equipment and qualification of personnel, defined methods and procedures, and requirements for revalidation. Molding, welding, sterilization, and cleaning usually land here. WorkCell holds the routing, the work center, and the results captured against each run; the protocols, reports, and revalidation schedule are yours to write and sign.
ISO 13485 requires documented procedures for validating the application of computer software used in the quality management system before first use, and after changes, with the approach and activities proportionate to the risk associated with that use. That means you validate WorkCell for your intended use in your configuration. No vendor can perform it on your behalf, and a package another company wrote for its own configuration transfers nothing to you.
Is ISO 13485 certification mandatory?
Not as a matter of law, but in practice it is unavoidable. EU MDR conformity routes, Health Canada through MDSAP, and most device OEM supplier agreements all expect it. Certification is granted to your organization by an accredited registrar after assessing how your organization works, never to a piece of software.
What is the difference between ISO 13485 and 21 CFR Part 820?
Part 820 is United States law and ISO 13485 is a voluntary international standard. Since 2 February 2026, FDA's Quality Management System Regulation incorporates ISO 13485:2016 by reference into Part 820, so those clauses now carry regulatory force in the US alongside FDA-specific additions for labeling, complaints, and recordkeeping.
Does ISO 13485 require a Device History Record?
It does not use that term. Device Master Record and Device History Record are FDA language out of Part 820. The ISO equivalents are the medical device file in clause 4.2.3 and the record of manufacture in clause 7.5.1, which must show the amount manufactured and the amount approved for distribution.
How far does ISO 13485 traceability actually have to reach?
To the extent you define, document, and can defend, which your risk analysis drives. Implantable devices carry a harder requirement under clause 7.5.9.2: records of the components, materials, and work environment conditions that could cause the device to miss its specified safety and performance, plus distribution records that support a trace.
Is WorkCell ISO 13485 certified?
No, and no software can be. Certification applies to an organization's quality management system, assessed by a registrar against how that organization actually operates. What WorkCell does is hold the production, inspection, and traceability records the standard asks you to keep, and for the vendor-side assurance a notified body or customer audit does ask about, we run a SOC 2 programme and will walk your reviewer through the controls behind it under NDA.
What does ISO 13485 require us to do about the software we use?
Validate it for your use. ISO 13485 requires documented procedures for validating computer software used in the quality management system before first use and after changes, scaled to the risk. That validation is performed by you, in your configuration. We can supply configuration detail and answer a supplier questionnaire, not a validated state.
Keep the records as the work happens.
Tell us which ISO 13485 records you assemble by hand today and we will tell you straight which ones WorkCell would carry and which ones it would not.