ISO 13485 Medical Devices. Audit, CAPA & UDI Traceability. MDR Compliance in 3 Seconds.
IgeraIndustria resolves ISO 13485 queries: UDI traceability (EU Regulation 2017/745), CAPA for medical devices, special process validation, complaint handling and MDR audits. Your quality manager gets the exact clause and applicable regulatory requirement in 3 seconds — no more hours lost in document searches.
ISO 13485: the most demanding quality standard in the regulated industrial sector
With more than 30,000 certified companies worldwide, ISO 13485:2016 is the foundation of the quality system required by EU MDR 2017/745 for medical device manufacturers in Europe. UDI traceability, special process validation and CAPA are not optional — they carry direct regulatory consequences in the event of a failure.
30,000+
Companies certified to ISO 13485 worldwide. A fundamental requirement for exporting medical devices to Europe (MDR), the USA (FDA 21 CFR 820) and Japan (JPAL).
MDR 2017/745
European medical device regulation in force since May 2021. ISO 13485:2016 is the quality management system foundation that the MDR requires of all manufacturers.
Cl. 7.5.3
UDI traceability: every unit must be traceable from raw material to patient. A traceability failure can trigger a mandatory market withdrawal under the MDR.
Cl. 8.5
CAPA in medical devices: corrective actions with regulatory rigour. 51% of FDA Warning Letters to device manufacturers cite inadequate CAPA systems.
Quality managers in medical device companies spend hours determining which UDI traceability records are mandatory by device class, or whether a field incident must be reported to the competent authority within MDR timeframes. IgeraIndustria answers these questions in 3 seconds, citing the exact ISO 13485 clause and the applicable MDR/IVDR requirement, so your quality team can focus on investigation rather than document retrieval.
Instant ISO 13485 queries by clause
IgeraIndustria identifies the exact clause that applies to each question and responds with the requirements, mandatory records and MDR/IVDR regulatory implications that the Notified Body auditor will verify at the next audit.
UDI traceability for medical devices (7.5.3)
UDI traceability requirements by device class (Class I, IIa, IIb, III) under MDR 2017/745. Lot records, serial numbers, critical components, manufacturing and distribution dates. How to document traceability to satisfy a competent authority inspection or a market withdrawal.
Special process validation (7.5.6)
Identification of special processes requiring validation: welding, sterilisation, sterile packaging, embedded software (IEC 62304). IQ/OQ/PQ protocols, critical parameters, acceptance criteria and re-validation when processes or equipment change.
CAPA — Corrective and Preventive Actions (8.5)
Specific CAPA requirements for medical devices: root cause investigation, assessment of the need to notify the competent authority (MDR vigilance), effectiveness verification and required records. Differences between CAPA under ISO 13485 and ISO 9001.
Post-market surveillance and MDR reporting (8.6)
Post-market surveillance obligations: systematic collection of field data, incident assessment, reportability to competent authorities (EUDAMED, FDA). When a Serious Incident report (FSCA) is required and within what statutory timeframes.
Control of non-conforming product (8.3)
Quarantine, identification, evaluation and disposition procedures for non-conforming medical devices. Assessment of impact on products already on the market. Use under concession decision and risk assessment documentation (ISO 14971).
Risk management (7.1 + ISO 14971)
Clause 7.1 of ISO 13485 requires risk management planning throughout product realisation, following ISO 14971:2019. How to document the risk management file, residual risk evaluation and integration of risk controls into design and production.
Full support for ISO 13485 audits and MDR regulatory inspections
Whether preparing for Notified Body audits or FDA and European competent authority inspections, IgeraIndustria provides the support your quality team needs at every phase of the regulatory lifecycle for medical devices.
Gap analysis vs ISO 13485:2016 + MDR
Differences between ISO 13485:2016 and the 2003 version. Additional requirements of MDR 2017/745 and IVDR 2017/746 that go beyond ISO 13485. Gap identification for first-time certification or renewal audits with the Notified Body.
Notified Body audit preparation
Specific requirements reviewed by NBs (BSI, TÜV SÜD, DNV, SGS): CAPA history, UDI traceability, validation records, post-market surveillance, MDR compliance. How to prepare an up-to-date Technical Dossier by device class.
FDA 21 CFR 820 inspection simulation
Typical FDA inspector questions for manufacturers exporting to the USA: design controls, CAPA, complaints, MDRs (Medical Device Reports). Key differences and equivalences between FDA 21 CFR 820 and ISO 13485:2016.
UDI traceability record review
Verification that the UDI traceability system meets MDR requirements by device class, that lot records include all critical components, and that the complete distribution chain can be reconstructed in the event of a market withdrawal.
NC closure in medical device audits
Support for root cause analysis of non-conformities, especially in CAPA (clause 8.5) and UDI traceability (7.5.3). Structuring responses to Notified Bodies and European competent authorities.
Management review (5.6) — MDR inputs
Specific inputs for management reviews in the medical device environment: market feedback, vigilance incidents, CAPA results, internal and NB audit results, updated regulatory requirements (MDR, IVDR, new guidance documents).
The 4 key clauses of ISO 13485:2016 for medical devices
These clauses account for the majority of non-conformities found during Notified Body audits and MDR regulatory inspections. IgeraIndustria explains each one with the exact requirements, MDR/IVDR implications and the most common errors auditors find in medical device manufacturers.
4.2.4 — Control of records
ISO 13485 has far stricter record control requirements than ISO 9001. Medical device records must be retained for a period at least equal to the useful life of the device or, where not specified, for a minimum of 2 years from the date of release by the manufacturer. For implantable devices, MDR retention periods extend to 15 years. Records must be legible, identifiable, retrievable and protected against deterioration or loss. UDI traceability for a recalled lot may require records dating back 10 or more years.
7.5.6 — Validation of special processes
Where the result of a process cannot be verified by subsequent product inspection or testing (sterilisation, welding, sterile packaging, embedded software under IEC 62304), the process must be validated. Validation protocols — IQ, OQ and PQ — must be documented and approved before the start of commercial production. Any change to the process or equipment requires re-validation, or at minimum a documented assessment of its impact on the existing validated state.
8.3 — Control of non-conforming product
In the medical device context, non-conforming product control carries regulatory implications that go well beyond rework. The organisation must assess whether the non-conformity may affect devices already distributed on the market (post-market vigilance), whether notification to the competent authority is required (FSCA), and whether a market withdrawal must be initiated. Any decision to use under concession requires a documented risk assessment under ISO 14971 and explicit approval.
8.5 — CAPA and complaint management
The medical device CAPA system must demonstrate that corrective actions are effective and that the extent of the non-conformity across other products or processes has been assessed. For complaints received from the field, MDR reportability to the competent authority must be evaluated. CAPA records must be retained for the same periods as all other QMS records, and effectiveness verification must be documented within defined timelines.
How IgeraIndustria works for ISO 13485
Five steps from loading your medical device quality management system to receiving answers with the exact clause, UDI requirement and applicable MDR/IVDR implication.
Index your Medical Device Quality Management System
Upload your quality procedures, UDI traceability records, special process validation protocols, CAPA history, complaint records and post-market surveillance data. IgeraIndustria processes them alongside the complete ISO 13485:2016 standard and all MDR/IVDR requirements.
Connect the assistant to your quality and regulatory team
Integrate with your quality portal, Microsoft Teams or deploy as a dedicated assistant for production and regulatory affairs teams. Role-based access control is available, as CAPA and vigilance records may contain sensitive information.
Your quality manager asks questions in plain language
"Which UDI traceability records do we need for our Class IIb device?", "Do we need to report this incident to the competent authority and by when?", "What evidence does the NB need for clause 7.5.6 process validation?"
IgeraIndustria searches two knowledge layers
First within your internal documentation (procedures, UDI traceability records, validation protocols, CAPA history), then within the indexed ISO 13485:2016 standard and MDR/IVDR requirements, including the latest guidance updates.
Answer with clause, UDI/MDR requirement and evidence
The response cites the ISO 13485 clause and the applicable MDR/IVDR requirement, specifies which records are mandatory, the statutory retention periods, and whether the case requires notification to the competent authority.
IgeraIndustria in action — UDI traceability and CAPA ISO 13485
A real query about whether a field complaint must be reported to the competent authority under MDR 2017/745, resolved in under 3 seconds with the exact clause.
Quality Manager / Medical Devices
We received a complaint from a hospital about a Class IIb catheter that failed during a procedure without causing patient injury. Do we need to report this to the competent authority? What is the deadline?
IgeraIndustria
ISO 13485:2016 Cl.8.2.2 + MDR 2017/745 Art.87 — Post-Market Vigilance
REPORTABILITY ASSESSMENT: incident without injury → assess whether the device could have caused or contributed to death or serious injury (MDR Art.2(65))
- • KEY CRITERION: Failure of a Class IIb catheter during a procedure is a potential serious incident until causality is excluded
- • MDR DEADLINE: If reportable → 15 calendar days from awareness (30 days if additional investigation is needed)
- • IMMEDIATE ACTION: Open complaint record + root cause investigation + retain the returned device for analysis
Note: the competent authority may request the final investigation report — maintain complete documentation from day one
✓ ISO 13485:2016 Clause 8.2.2 + MDR 2017/745 Art.87 · Confidence: 99.4%
85
employees at an electromedical device manufacturer
0
deficiencies at the NB audit
-65%
audit preparation time
We manufacture Class IIb vital signs monitors and our first ISO 13485 renewal audit with the NB was a nightmare: three months preparing documentation that the auditor reviewed in two days. Since deploying IgeraIndustria, our quality manager can answer any question about UDI traceability, CAPA or vigilance in real time. Our last renewal audit: zero deficiencies for the first time in eight years of certification.
*Representative testimonial based on real client results
Frequently asked questions — ISO 13485:2016 Medical Devices
How does UDI traceability work for medical devices under EU Regulation 2017/745 (MDR)?
EU Regulation 2017/745 (MDR) establishes the Unique Device Identification (UDI) system for all medical devices placed on the European market. Each device must carry a UDI code composed of two elements: the UDI-DI (Device Identifier), which identifies the model and manufacturer, and the UDI-PI (Production Identifier), which captures the lot number, serial number, manufacturing date and expiry date. ISO 13485:2016 (clause 7.5.3) requires a traceability system that must integrate with UDI. Manufacturers must register UDIs in EUDAMED and ensure that every distributed unit can be traced from raw material to patient. Complete UDI traceability is a critical requirement in the event of a market withdrawal or incident investigation under the MDR.
What is CAPA for medical devices and how does it differ from ISO 9001?
CAPA (Corrective and Preventive Actions) is the system for managing quality incidents and system improvement, governed by clause 8.5 of ISO 13485:2016. In the medical device sector, CAPA carries regulatory implications well beyond those required by ISO 9001: every CAPA must assess whether notification to the competent authority is required (MDR vigilance reporting), whether the non-conformity may be present in other products already distributed on the market, and whether a Field Safety Corrective Action (FSCA) must be initiated. CAPA effectiveness must be verified and documented, and records must be retained for at least the useful life of the device. According to FDA data, 51% of Warning Letters issued to medical device manufacturers cite inadequate CAPA systems.
Which special processes must be validated under ISO 13485:2016 clause 7.5.6?
ISO 13485:2016 (clause 7.5.6) requires validation of all processes whose results cannot be verified by subsequent product inspection or testing. The most common special processes in medical device manufacturing include: sterilisation (EO, steam, radiation, plasma), welding (ultrasonic, laser, thermal bonding), sterile packaging, functional coatings and surface treatments, critical cleaning processes, and embedded software in active devices (requiring validation per IEC 62304). Each special process requires a validation protocol covering IQ (Installation Qualification), OQ (Operational Qualification) and PQ (Performance Qualification), documented critical process parameters, defined acceptance criteria, and a re-validation plan triggered by any process or equipment change.
How should complaint handling and post-market surveillance be managed under ISO 13485?
ISO 13485:2016 (clause 8.2.2) requires a documented process for receiving, evaluating and investigating any complaint related to distributed devices. Each complaint must be assessed to determine whether it constitutes a reportable incident under MDR 2017/745: if the device could have caused or contributed to the death or serious injury of a patient, notification to the competent authority is mandatory (timeframe: 15 calendar days for serious incidents, 10 days for imminent risk of death). All complaints, including non-reportable ones, must be recorded and periodically analysed as part of the Post-Market Surveillance (PMS) system, which MDR 2017/745 requires to be proactive, systematic and documented throughout the device lifetime.
How do you prepare a ISO 13485 renewal audit with a Notified Body?
ISO 13485 renewal audits conducted by Notified Bodies (BSI, TÜV SÜD, DNV, SGS) focus on the highest-risk clauses: traceability (7.5.3), process validation (7.5.6), CAPA (8.5), post-market surveillance (8.6) and MDR compliance (Annex IX/X). For efficient preparation: review the NC history from the previous audit and verify effective closure of all associated CAPAs; confirm that all special processes are validated and re-validations are current; verify that the UDI traceability system enables full reconstruction of each lot's history; and prepare an updated Technical Dossier including clinical evidence and risk management documentation (ISO 14971) for each active product line. IgeraIndustria can surface the exact clause requirements and required records during any phase of audit preparation.
What is the difference between the MDR for medical devices and the IVDR for in vitro diagnostics?
EU Regulation 2017/745 (MDR, Medical Device Regulation) governs general medical devices, while EU Regulation 2017/746 (IVDR, In Vitro Diagnostic Regulation) specifically covers in vitro diagnostic medical devices (reagents, kits, analysers). The main differences: the MDR classifies devices into Classes I, IIa, IIb and III, whereas the IVDR uses Classes A, B, C and D. The IVDR requires clinical performance evidence (performance studies) rather than clinical evidence as defined for the MDR. The IVDR has been in force since 26 May 2022, with transitional periods extending to 2027 for certain legacy devices. Both regulations require ISO 13485 as the basis of the quality management system and mandate use of EUDAMED for device registration, incident reporting and Notified Body certificates.
IgeraIndustria ISO 13485 Plans
No long-term commitment. Cancel any time.
Starter
For medical device manufacturers pursuing first-time ISO 13485 certification, or distributors that need to query MDR/IVDR requirements and UDI traceability without spending weeks searching through documentation.
- ISO 13485:2016 pre-indexed
- Queries by clause and UDI
- Basic MDR/IVDR requirements
- 1,000 queries/month
- Assistant for the quality manager
- Email support
Professional
For certified manufacturers with an active quality system, periodic NB audits and the need for continuous support for quality, production, regulatory affairs and post-market surveillance teams.
- ISO 13485 + internal documentation indexed
- Assisted CAPA and UDI traceability management
- NB audit support by clause
- 5,000 queries/month
- Updated MDR/IVDR requirement alerts
- Priority support
Enterprise
For manufacturer groups with multiple product lines, various device classes (I, IIa, IIb, III) and presence in multiple regulated markets (EU MDR, FDA 21 CFR 820, PMDA Japan).
- Multi-product and multi-regulation
- ISO 13485 + MDR + FDA 21 CFR 820
- Assisted post-market vigilance management
- Unlimited queries
- 99.9% uptime SLA
- Dedicated customer success
Manage ISO 13485 clause by clause. Start today.
- Free 14-day trial — no credit card required
- ISO 13485:2016 + MDR/IVDR pre-indexed from day one
- Upload your internal quality documentation: procedures, CAPA, UDI traceability, process validations
- Support for Notified Body audits and FDA inspections