FDA ISO 13485:2016 Audits
Find Out What Medical Device Companies Need to Know About Conducting FDA ISO 13485:2016 Audits
FDA ISO 13485:2016 Audits Team Lead
FDA ISO 13485:2016 Audits Team Lead
Former DOJ Attorney
FDA ISO 13485:2016 Audits Team Lead
Former Senior DOJ Trial Attorney
While compliance in the U.S. and compliance abroad has long required adherence to different standards for medical device companies, this is finally changing. In 2024, the U.S. Food and Drug Administration (FDA) announced that it will be replacing its long-standing quality management system (QMS) requirements for medical device manufacturers with its new “Quality Management System Regulation” (or “QMSR”)—which aligns with ISO 13485:2016. The QMSR will officially replace the QMS requirements in 2026, but the FDA has also announced that companies can begin complying with ISO 13485:2016 in the U.S. now, provided that they continue to comply with the QMS requirements as well.
For companies that are already complying with ISO 13485:2016 elsewhere, this is likely to be a welcome change—though it will require work up front to align their U.S. operations with their operations abroad. But, for those that are unfamiliar with ISO 13485:2016 compliance, ensuring FDA compliance from 2026 onward will involve a much steeper learning curve.
The good news is that, in many respects, ISO 13485:2016 is more general than the FDA’s outgoing QSR—meaning that medical device companies’ QSR compliance programs will suffice for purposes of ISO 13485:2016 compliance in many cases. But, this is not universally true, and companies cannot assume that their QSR compliance programs will remain sufficient going forward. With this in mind, a key first step toward ensuring continued compliance is to conduct an internal ISO 13485:2016 audit.
Conducting ISO 13485:2016 Audits to Ensure QMSR Compliance
In light of the FDA’s adoption of its final rule implementing the new QMSR, which becomes effective February 2, 2026, we are actively working with companies in the medical device industry to ensure that they are prepared to demonstrate compliance with ISO 13485:2016 when the time comes. For those that wish to establish compliance in advance—while also remaining in compliance with the outgoing QSR—we are assisting with the development and implementation of appropriate policies and procedures as well.
A key aspect of establishing ISO 13485:2016 compliance, whether presently or for the future, is conducting an ISO 13485:2016 audit.
Here’s why:
As we mentioned above, while there will be some overlap between QSR compliance and ISO 13485:2016 compliance for many companies, there are also several key differences between the QSR and ISO 13485:2016 (as implemented in the FDA’s new QMSR). As a result, relying on a company’s existing QSR compliance program is not a long-term solution. To assess their needs, medical device manufacturers must compare their QSR compliance efforts to ISO 13485:2016’s requirements; then, once they make the necessary updates and modifications to their compliance programs, they must ensure that these updates and modifications will work in practice going forward.
Our ISO 13485:2016 audit services for medical device manufacturers include:
1. Comparing the Company’s QSR Compliance Program to ISO 13485:2016
Our lawyers and consultants will review your company’s existing QSR compliance program and compare it to the requirements under ISO 13485:2016. We will also work with your company’s key stakeholders to ensure that we have a clear and comprehensive understanding of its FDA-regulated operations so that we can determine what compliance measures are necessary under both sets of regulations.
2. Determining Which QSR Compliance Protocols Are Sufficient for Purposes of ISO 13485:2016 Compliance
Upon reviewing your company’s QST compliance protocols during the ISO 13485:2016 audit process, we will determine which of these protocols are sufficient for purposes of ISO 13485:2016 compliance. In some cases, no substantive or procedural changes will be necessary—although it will still be important to clearly document that the company has affirmatively addressed the compliance implications of the QMSR and ISO 13485:2016.
3. Determining Which QSR Compliance Protocols are Insufficient for Establishing ISO 13485:2016 Compliance
During the ISO 13485:2016 audit process, our lawyers and consultants will also determine which of your company’s QSR compliance protocols are insufficient for establishing ISO 13485:2016 compliance. This will afford your company the opportunity to proactively address its new obligations before the QMSR takes effect in early 2026.
4. Drafting and Assisting with the Implementation of Necessary ISO 13485:2016 Compliance Policies and Procedures
After determining your company’s compliance-related needs through the ISO 13485:2016 audit process, we will draft and assist with the implementation of all necessary ISO 13485:2016 compliance policies and procedures. We take a detail-oriented and custom-tailored approach to this process focused on ensuring that each of our clients is able to manage ISO 13485:2016 compliance as efficiently and cost-effectively as possible.
5. Evaluating the Company’s New ISO 13485:2016 Compliance Program
Finally, after assisting with the implementation of all necessary compliance policies and procedures, we will evaluate your company’s ISO 13485:2016 compliance efforts. We will determine whether your company’s personnel are adhering to its new compliance protocols or whether additional training and enforcement are necessary. Conducting periodic audits is a key component of effective compliance management, and our lawyers and consultants will be available to assist with conducting future ISO 13485:2016 compliance audits as well.
Put our highly experienced team on your side
Dr. Nick Oberheiden
Founder
Attorney-at-Law
Lynette S. Byrd
Former DOJ Trial Attorney
Partner
Brian J. Kuester
Former U.S. Attorney
Hon. Kevin McCarthy
55th Speaker, U.S. House of Representatives (ret.)
Government Consultant
Mike Pompeo
Of Counsel
Former U.S. Secretary of State
John W. Sellers
Former Senior DOJ Trial Attorney
Linda Julin McNamara
Federal Appeals Attorney
Nicholas B. Johnson
Former Prosecutor
Roger Bach
Former Special Agent (DOJ)
Chris J. Quick
Former Special Agent (FBI & IRS-CI)
Michael S. Koslow
Former Supervisory Special Agent (DOD-OIG)
Ray Yuen
Former Supervisory Special Agent (FBI)
5 Key Aspects of ISO 13485:2016 Compliance (QMSR Compliance) for Medical Device Companies
For any medical device company, establishing ISO 13485:2016 compliance (and QMSR compliance) will involve addressing five key aspects of the ISO. While these aren’t the only aspects that companies need to address, addressing these will set the stage for effective and consistent ISO 13485:2016 compliance. When we conduct ISO 13485:2016 internal audits, five of our key areas of focus are:
- Quality Management Systems – Even with the expiration of the QSR, maintaining effective quality management systems remains a key component of FDA compliance for medical device companies in the United States.
- Management Responsibility – Under ISO 13485:2016, company management must take the lead in establishing, maintaining, and enforcing compliance. Executives and managers must have a clear and comprehensive understanding of their companies compliance obligations under the ISO, and they must demonstrate a clear commitment to compliance.
- Resource Management – ISO 13485:2016 requires that medical device manufacturers manage their resources in such a way as to promote sterile and compliant work environments. This is one area in particular where companies may need to take steps above and beyond what they are currently doing under the FDA’s outgoing QSR.
- Product Realization – Compliance with ISO 13485:2016 involves taking (and documenting) several key steps before bringing new medical devices to market. Going forward, companies will need to be prepared to demonstrate compliance with these steps during the premarket submission process.
- Measurement, Analysis, and Improvement – Measurement, analysis, and improvement (as necessary) are key elements of ISO 13485:2016 compliance; and, as a result, they should be core considerations during the ISO 13485:2016 audit process.
FAQs: FDA ISO 13485:2016 Compliance for Medical Device Manufacturers in the U.S.
What Is the Difference Between a QMSR Audit and an ISO 13485:2016 Audit?
In the United States, medical device manufacturers will need to comply with the FDA’s new QMSR beginning February 2, 2026. As the QSMR adopts ISO 13485:2016 in the U.S. a QMSR audit serves the same purpose as an ISO 13485:2016 audit.
Are ISO 13485:2016 Audits Mandatory for Medical Device Companies Under the FDA’s New QMSR?
Medical device companies are not legally required to conduct ISO 13485:2016 audits in the United States. However, practically speaking, conducting these audits is an essential component of an overall FDA compliance program.
What Can (and Should) Medical Device Companies Do to Ensure ISO 13485:2016 Compliance in the U.S.?
To ensure compliance with ISO 13485:2016 (and the FDA’s new QMSR), medical device companies should perform an internal audit of their existing compliance programs under the outgoing QSR to determine what additional compliance measures are necessary. After undergoing the internal audit process and implementing ISO-specific compliance measures, these companies should also conduct periodic ISO 13485:2016 audits to ensure that they remain compliant on an ongoing basis.
Does the FDA Conduct ISO 13485:2016 Audits?
The FDA will begin assessing medical device manufacturers’ compliance with ISO 13485:2016 on February 2, 2026. As a result, manufacturers will need to be prepared for FDA ISO 13485:2016 audits (or “inspections”) by this date. The two main types of ISO 13485 audits are internal and external audits. Being prepared means having documentation on hand that clearly demonstrates comprehensive compliance with the ISO 13485:2016 requirements.
What Are the Risks of ISO 13485:2016 Non-Compliance for Medical Device Companies (as of February 2, 2026)?
Once the FDA’s new QMSR takes effect in early 2026, the risks of ISO 13485:2016 non-compliance for medical device companies will be substantial. Non-compliance will lead to unnecessary delays (and costs) during the premarket submission process; and, if a manufacturer is found to be noncompliant during a postmarket FDA ISO 13485:2016 audit, the manufacturer may be forced to pull its devices from the market (in addition to facing other penalties).
Contact Oberheiden P.C. About Conducting an FDA ISO 13485:2016 Compliance Audit
The lawyers and consultants at Oberheiden P.C. assist medical device companies with all aspects of FDA compliance. This includes helping companies prepare to meet the new ISO 13485:2016 compliance requirements under the FDA’s impending QMSR. If you would like to know more about our ISO 13485:2016 audit and compliance services, please call 888-680-1745 or contact us online to schedule a complimentary initial consultation today.
