# ISO 13485 quality management system and documentation

Clause 4 explained: regulatory role, outsourcing, QMS software, the quality manual, the medical device file, and how long to keep documents and records.

Source: https://sted.digital/docs/standards/iso-13485/quality-management-system · Last reviewed 17 October 2026 · Strand Standards and regulations

ISO 13485:2016 4.1 asks you to document a quality management system scaled to risk, record your regulatory role, control outsourced processes and validate the software you run it on (4.1.6). Clause 4.2 asks for a quality manual, a medical device file for each device type or family, and documented control of documents (4.2.4) and records (4.2.5).

## The requirement in plain English

**General requirements (ISO 13485:2016 4.1).** You document the [QMS](/docs/glossary/qms) and keep it effective against the standard and the regulations you are under, and you record the role you play under those regulations, such as manufacturer or distributor (4.1.1). You decide which processes the system needs and how they interact, and you control them in proportion to risk (4.1.2). Each process has criteria, resources, monitoring and records (4.1.3). Changes to a process are assessed for their effect on the system and on the devices before you make them (4.1.4).

**Outsourced processes (ISO 13485:2016 4.1.5).** Outsourcing does not move responsibility. You control the supplier in proportion to the risk and to their ability, with a written quality agreement.

**QMS software (ISO 13485:2016 4.1.6).** A documented procedure validates any software you use to run the quality system, before first use and after changes, to a depth that matches the risk of using it. Records show it was done.

**Documentation (ISO 13485:2016 4.2.1 and 4.2.2).** The system's [documented information](/docs/glossary/documented-information) includes the quality policy and objectives, a quality manual, the procedures and records the standard asks for, and whatever else you or a regulation require. The manual states the scope, with the reason for any exclusion or clause that does not apply, includes or references the procedures, and describes how the processes interact.

**Medical device file (ISO 13485:2016 4.2.3).** For each device type or family you keep a file that contains or references the general description and intended use, labelling and instructions for use, product specifications, the procedures for making, packaging, storing, handling and distributing it, the procedures for measuring and monitoring it, and installation and servicing requirements where they apply.

**Control of documents (ISO 13485:2016 4.2.4).** A documented procedure makes sure documents are approved before use, reviewed and re-approved when updated, show their current revision, are available where needed, stay legible, and are protected from loss. External documents are identified and their distribution controlled. Changes are approved by the function that approved the original, or another designated function with the background. Obsolete documents cannot be used by mistake, and you keep at least one copy for a period you define: at least the lifetime of the device, and no shorter than the records made under it.

**Control of records (ISO 13485:2016 4.2.5).** A documented procedure covers how records are identified, stored, secured, retrieved, kept and disposed of, and how confidential health information in them is protected. Records stay legible and retrievable, and any change to one remains visible. You keep them for at least the device's lifetime as you define it, never less than two years from release, or longer where a regulation says so.

This is guidance to help you understand the requirement, not legal advice.

## What good looks like

An 18-person company makes Class IIa diagnostic software. Its quality manual runs to 12 pages: a scope covering design, development, release and post-market support, a process map, and a table listing each procedure against the clauses it meets. The manual says which clauses do not apply and why, such as sterile device requirements and contamination control, because the product is software with no physical form.

Each product has a medical device file. It is an index, not a copy: every line points to a versioned item, such as the intended use statement at version 4, the software requirements at release 2.3, the release procedure and the labelling. When a referenced item is superseded, the release checklist updates the index.

A validation register lists every tool the quality system runs on: the document system, the issue tracker, the code repository, the build pipeline and the complaints inbox. Each has a risk rating, a validation record sized to it and a revalidation trigger. The supplier's validation pack is evidence, not the whole answer.

The company has defined each product's lifetime in its risk management file and sets retention at 10 years after the last release, because EU MDR Article 10(8) asks that for technical documentation. Superseded documents move to an archive marked obsolete, never deleted. Its hosting provider and contract test laboratory each have a signed quality agreement.

## Evidence an auditor expects

- **Quality manual** (required): scope, justified exclusions, the procedures and the process interactions; auditors compare its exclusions with the certificate scope.
- **Record of your regulatory roles** (required): the auditor checks the system matches the role, such as a manufacturer keeping design controls.
- **Medical device file per device type or family** (required): complete, current references; the auditor follows one through to the versions in use.
- **Document and record control procedures** (required): approvals before use, revision status, obsolete documents withdrawn and retained.
- **Defined retention periods** (required): tied to a stated device lifetime and any regulatory minimum.
- **QMS software validation records** (required): a list of tools, the risk reasoning and the validation done.
- **Quality agreements with outsourced suppliers** (required): the auditor checks responsibilities are written down and proportionate to risk.

## Common mistakes

### Excluding design when you are the manufacturer

A start-up excludes [design and development, clause 7.3](/docs/standards/iso-13485/design-and-development), to make certification lighter. As the legal manufacturer under EU MDR it carries design responsibility, so the exclusion fails. Exclude only what the regulations allow, and record non-applicable clauses separately with their reasons.

### No device lifetime, so no retention period

Retention rules in the standard depend on a lifetime the company never defined. Records get deleted on an IT default of seven years. Define lifetime per device in the risk file, then set retention from it and from the regulations.

### The spreadsheet nobody validated

The complaint log, the training matrix and the calibration schedule live in spreadsheets with formulas. Auditors raise them under 4.1.6 as unvalidated QMS software. List them, rate the risk, and validate the formulas that matter.

### A medical device file that is a folder dump

The file holds every document ever produced, with no versions. Nobody can say which specification is current. Make it an index of versioned references, and the EU MDR Annex II technical documentation can grow from the same structure.

### Outsourcing without an agreement

The cloud host and the test laboratory work under a purchase order only. Clause 4.1.5 asks for written quality agreements. Write one per critical supplier, naming who does what and how changes are notified.

## How Sted helps

For ISO 13485 clause 4 Sted's knowledge base carries the Document Control Procedure (PRC-DCT), which for medical device organisations requires a Medical Device File for each device type or family and sets out what it contains or references, with its Document Review Record (REC-DCR), which comes with a suggested annual frequency, and External Document Control Record (REC-EDCR), and the Validation of Non-Product Software Procedure (PRC-VNPS) with its Non-Product Software Validation Record (REC-VNPS) for the software you run the quality system on.
Records are part of the Full Management System plan.
An administrator, or a Policy and Process Owner who owns the document, approves a Draft or starts a new version of an Approved one, and only an administrator assigns a document's owner; a document still awaiting review cannot be approved.
Approving sets an effective date and a review date, which starts at the effective date plus the document's review frequency; a review task opens 30 days before the review date and turns overdue after it.
Administrators and a document's owner can open superseded versions from History.
Every exported page carries your organisation and the title in its header, an UNCONTROLLED COPY watermark, a footer naming who exported it, when, the code and version and an export reference, a line to refer to StedOS for the controlled latest version, and a page counter; a document's PDF ends with a revision history of its approved versions, newest first, with date, approver and change notes.

Sted keeps versions, approvals and review dates for the documents it holds. Deciding what each medical device file contains, and keeping it complete, is your work.

## Related guides and terms

- [Document control guide](/docs/guides/document-control): numbering, approval, change and retirement, with an ISO 13485 work instruction example.
- [Documented information](/docs/glossary/documented-information): why ISO 13485 still says documents and records.
- [Management responsibility](/docs/standards/iso-13485/management-responsibility): the quality policy and objectives the manual points to.
- [Documents in Sted](/docs/product/documents): how a document is drafted, approved and versioned.
- [EU MDR technical documentation](/docs/standards/eu-mdr/technical-documentation): the regulator's dossier that the medical device file feeds.
- [ISO 13485 hub](/docs/standards/iso-13485): how clause 4 fits the rest of the standard.

## Frequently asked questions

Q: Does ISO 13485 still require a quality manual?
A: Yes. ISO 13485:2016 4.2.2 requires one, although ISO 9001:2015 dropped it. It must give the scope with any exclusions and their reasons, include or point to your procedures, and describe how your processes interact. A short manual that maps processes to procedures is enough.

Q: What is the difference between a medical device file and technical documentation?
A: The medical device file is ISO 13485's index of what defines a device type: its description, specifications and the procedures to make, check, ship, install and service it. EU MDR technical documentation under Annex II and III is the regulator's full dossier, including clinical evidence and risk management. Most manufacturers build one structure that serves both.

Q: How long must we keep ISO 13485 records?
A: At least the lifetime of the device as you define it, and never less than two years from release, unless a regulation asks for longer. Under EU MDR the technical documentation must stay available for at least 10 years after the last device is placed on the market, or 15 for implantables, so most EU manufacturers set retention by that.