ISO 13485 is an international standard that sets out the requirements for a quality management system for organisations that design, produce or service medical devices, including medical device software. Following it is voluntary, but it is widely adopted and often expected by regulators and customers as evidence of a controlled, documented approach to quality.
Why it matters: Medical software can directly affect health decisions, such as how much medication someone receives. A quality management system aligned to ISO 13485 gives a company consistent processes for managing risk, documenting work and showing evidence during audits.
In practice: Companies working to ISO 13485 keep controlled documents for requirements, risk analysis, testing and releases. Each release is recorded, each change request written down and each test run documented, reviewed and signed by an authorised person other than the author. Traceability from risk to requirement to test case to execution report is maintained so that auditors can follow it.
Examples:
- A test lead making sure every executed test case in a release has a signed report stored in a document control system.
- An auditor asking to see the trail from a specific risk in the risk analysis file through to the tests that verified its mitigation.
- A company running yearly mandatory training so all staff understand the documentation rules they must follow.
Common pitfalls:
- Relying on a general test management tool alone for documentation, which may not meet the review and sign-off expectations of medical audits.
- Treating documentation as something to finish just before an audit, rather than keeping it current with every release.
Is ISO 13485 mandatory? The standard itself is voluntary, but many markets and regulators expect medical device makers to have a quality management system that meets it or an equivalent, so in practice it is often essential.
What does ISO 13485 mean for software testers? It means testing is planned, documented, reviewed and traceable, and that the motto "if it is not documented, it did not happen" applies to every test run.
