Your contract manufacturer has ISO 13485 certification and a solid QMS. That’s great — and it still doesn’t satisfy your oversight obligations as the legal manufacturer. Here’s what QMSR and ISO 13485 actually require of each party when manufacturing is outsourced.
Welcome back. You’ve made it to Clause 4, which means you have survived the Scope (Clause 1), the Normative References
ISO 13485 §5.2 is exactly one sentence long — and it puts the weight of knowing and meeting customer and regulatory requirements squarely on top management’s shoulders. Here’s what that actually means in practice.
Welcome back to our meticulous, clause-by-clause walkthrough of ISO/IEC 42001:2023 — the international standard for AI management systems that you’ve
ISO 13485:2016 §5.1 requires top management to demonstrate genuine commitment to the QMS — not just sign the quality policy once a year and call it done. Here’s what that actually looks like, and why auditors can spot the difference from across the room.
§4.2.5 requires you to control your records — identify them, protect them, store them properly, and retain them for as long as required. Records are proof. Treat them accordingly.
Ah, Clause 2. The normative references section. In virtually every ISO management system standard ever published, this is the page
We pulled three of our resident experts into one (virtual) room to tackle the five AI questions medical device manufacturers are wrestling with right now. There was banter. There were citations. Norma kept her composure.
§4.2.4 requires you to actually control your documents — not just own them. Norma explains what that means in practice, what changed from the 2003 version, and why ‘it’s in a shared drive somewhere’ is the document control equivalent of hiding under a blanket.
Section 820.7 is three short paragraphs, and most people skim right past it. Don’t. It’s the provision that turns ISO 13485:2016 from a helpful standard into a legal requirement — and it fundamentally changes how you read the entire QMSR.