ISO certification · ISO 13485Medical devices
Keybridge prepares ISO 13485 certification in Iraq and Kurdistan.
Manage quality across the medical-device activities within your organisation’s scope. We confirm the scope and the buyer’s stated requirements before preparation starts.
ISO 13485 Medical devices quality management systems
ISO 13485 at a glance
- Published
- March 2016. ISO 13485:2016 is the current edition and it is what auditors check against today.
- Structure
- Not Annex SL. 8 clauses, kept close to the older ISO 9001:2008 layout, so it does not line up clause for clause with ISO 9001:2015. Clauses 4 to 8 carry the auditable requirements.
- Certifiable
- Yes. The company is certified for a named scope, such as import, storage, distribution and servicing. The certificate is not a device approval, a CE mark or a Ministry of Health registration.
- Certificate validity
- Check the dates and current status of the issued certificate; continued validity depends on meeting the certification body’s conditions.
- Surveillance
- Follow-up audits check that the management system continues to meet requirements between certification decisions.
- Audit planning
- Sites, activities, workforce and complexity affect the audit plan; the certification body determines the required audit time.
- What the scope covers
- Only the sites and activities written into the scope. Anything left out of it is not covered.
- What the certificate says
- The company name, the standard, the scope and the dates the certificate runs.
- Language of the system
- We write the documentation in the language the company works in: Arabic, Kurdish or English. Labels and instructions for use follow what the manufacturer and the Ministry of Health require.
What ISO 13485 is
ISO 13485:2016 is the international standard for a quality management system in the medical device sector. It asks a company to control the design, production, storage, distribution and servicing of devices, to run risk management across the whole life of the product, and to keep records that trace every device back to its batch and forward to the customer. It applies to manufacturers and equally to importers, distributors and service companies.
What the standard requires
- Clauses 1 to 3 cover scope, normative references and terms. Clauses 4 to 8 are the requirements an auditor checks, and this standard does not use the Annex SL structure that ISO 9001 uses.
- Clause 4, quality management system. A quality manual, the procedures the standard names in writing, and the documentation clause 4.2.3 requires for each device or device family.
- Clause 4.1.6, software validation. Any software used inside the quality system, from the stock and traceability system to the temperature loggers, is validated before use and the validation is recorded.
- Clause 5, management responsibility. Management signs the quality policy, appoints a management representative, defines the regulatory requirements that apply, and holds the management review.
- Clause 6, resource management. Competence records for every person whose work affects product quality, plus controlled premises, equipment, temperature and contamination control.
- Clause 7.1 and 7.3, planning and design. Risk management runs across the whole life of the device to ISO 14971. If the company designs, clause 7.3 adds inputs, outputs, review, verification, validation, transfer and change control recorded for each design.
- Clause 7.4 and 7.5, purchasing and production. Suppliers are evaluated and monitored, processes and sterilisation are validated, and traceability records identify the batch of every device delivered.
- Clause 8.2.1 and 8.2.3, feedback and reporting. A complaint log, feedback from post market use, and a written procedure for notifying the Ministry of Health and any other authority when a complaint meets the reporting criteria.
- Clause 8.3.3, product after delivery. Advisory notices and a recall procedure that has been tested on a real lot, with the route back through the hospital or the clinic written down.
- Clause 8.5, improvement. Corrective and preventive action for every nonconformity and complaint, with evidence that the correction worked before the record is closed.
Who needs ISO 13485 in Iraq and Kurdistan
Medical device importers and distributorsControl storage, traceability and complaint handling for the devices supplied.
Hospital equipment suppliers and service companiesConnect installation, servicing and equipment records to the supported device range.
In vitro diagnostic and reagent suppliersManage storage conditions, lot traceability and information supplied with diagnostic products.
Dental and prosthetics laboratoriesControl device specifications and production records for customised dental or prosthetic work.
Sterile and single use product suppliersProtect product condition and sterile-barrier integrity during handling and distribution.
Orthopaedic and implant distributorsMaintain device identification and traceability throughout supply and complaint follow-up.
Manufacturers of consumables and device packagingControl production processes and packaging characteristics that affect device quality.
Buyer requirements
| Buyer or list | What they ask for |
|---|---|
| Kimadia | Review this buyer’s current supplier criteria for the products or services offered. Certificate scope, buyer acceptance and tender eligibility need to be checked separately. |
| Federal Ministry of Health device registration | Check the current registration instructions for your activity and category. Confirm whether this standard is requested and which issuing bodies are accepted. |
| KRG Ministry of Health | Check the current registration instructions for your activity and category. Confirm whether this standard is requested and which issuing bodies are accepted. |
| Foreign device manufacturers | Review this buyer’s current supplier criteria for the products or services offered. Certificate scope, buyer acceptance and tender eligibility need to be checked separately. |
| Saudi Food and Drug Authority | Review this buyer’s current supplier criteria for the products or services offered. Certificate scope, buyer acceptance and tender eligibility need to be checked separately. |
| UAE Ministry of Health and Prevention | Check the current registration instructions for your activity and category. Confirm whether this standard is requested and which issuing bodies are accepted. |
| UN agencies through UNGM | Check the individual procurement notice for the required certificate and scope. Registration on UNGM does not replace the tender’s qualification criteria. |
| KRG Approved Suppliers Center | Check the current registration instructions for your activity and category. Confirm whether this standard is requested and which issuing bodies are accepted. |
What shapes your investment
- Number of sites and warehouses, and whether the auditor has to travel to Erbil, Sulaymaniyah, Baghdad or Basra.
- Whether the company designs devices or only imports, stores, distributes and services them, because design brings clause 7.3 into the audit and adds auditor days.
- Number of device families and their risk class, which sets how much risk management and device documentation the system carries.
- Whether sterile devices, implants or in vitro diagnostics are in the scope, which adds validation work and technical auditor time.
- Headcount, which sets how many auditor days the audit takes.
- Languages the documentation, the labels and the instructions for use are written in.
- How much usable documentation and how many validation records already exist in the company.
- Whether ISO 13485 is built alone or together with ISO 9001 as one system, and the number of findings during the audit.
The proposal names the scope, the deliverables and the dates before work starts.