ISO 13485 compliance made simpler: control design records, complaints and audits in one place
Q-Hub gives medical device manufacturers a single system for design controls, risk management, complaint handling, traceability and audit-ready evidence.
Get ISO 13485 certification-ready faster
See how medical device manufacturers use Q-Hub to control design records, manage risk, handle complaints and close corrective actions before the auditor arrives.
What is ISO 13485?
ISO 13485:2016 is the internationally recognised quality management standard for organisations involved in the design, development, production, installation and servicing of medical devices. Published by the International Organization for Standardization, it sets requirements for a quality management system that consistently meets customer and applicable regulatory expectations. It applies across the supply chain, from device manufacturers to suppliers of components, sterilisation and other outsourced services, and is widely used to demonstrate compliance with the EU Medical Device Regulation, UK MDR and other regulatory frameworks worldwide.
Certification is granted by an accredited certification body following a two-stage initial audit, then maintained through annual surveillance and three-yearly recertification. Medical device audits are exceptionally evidence-heavy: assessors expect a documented quality manual, a medical device file for each device, design history files, risk management records to ISO 14971, validated processes including sterilisation, complaint and vigilance records, and corrective action driven to root cause. Keeping that documented information current, linked and instantly retrievable is essential to passing.
How Q-Hub maps to ISO 13485:2016 clauses
| Clause | Requirement | How Q-Hub helps |
|---|---|---|
| Clause 4, Quality management system & documentation | Establish a documented QMS with a quality manual, controlled documented information, defined processes and a medical device file for each device type, applying a risk-based approach throughout. | Document Hub controls the quality manual, procedures and each device's medical device file as version-controlled records with approval workflows, controlled distribution and enforced retention. |
| Clause 5, Management responsibility | Demonstrate top-management commitment, set a quality policy and measurable objectives, define responsibilities and authorities, and hold management reviews with defined inputs and outputs. | Document Hub distributes the quality policy with read-and-understood sign-off and holds management review minutes; Company KPIs track quality objectives live for review inputs. |
| Clause 6, Resource management | Provide competent personnel, suitable infrastructure and work environment, and control contamination and cleanliness where product quality can be affected. | Training Hub maintains competency matrices with certification-expiry alerts; Asset Hub schedules calibration and maintenance of equipment and infrastructure, with logs to evidence controlled conditions. |
| Clause 7, Product realization: design controls, purchasing & production | Plan and control design and development with a design history file, verification and validation, control purchasing and suppliers, and validate production and service provision including sterile and process validation. | Document Hub controls design inputs, outputs and the design history file with change history; Register Hub manages approved suppliers and purchasing controls; Smart Forms capture production, sterilisation and process validation evidence with photos. |
| Risk management (ISO 14971) | Apply risk management across the product lifecycle to ISO 14971, maintaining a risk management file that identifies hazards, evaluates and controls risk, and monitors production and post-production information. | Register Hub manages the risk register and risk management file with hazard analysis, risk controls and assigned owners; dashboards keep residual risk visible and link to post-market feedback. |
| Clause 8, Measurement, analysis & improvement | Gather feedback, handle complaints, report to regulatory authorities through vigilance and advisory notices, run internal audits, control nonconforming product and drive corrective and preventive action. | Smart Forms and CAPA capture complaints and nonconformances, drive root-cause analysis, effectiveness checks and vigilance reporting; Audit Hub schedules internal audits with medical device checklists and findings. |
| Traceability & unique device identification (UDI) | Maintain identification and traceability of product throughout realization, including records that link devices to components, batches and, where required, unique device identification. | Document Hub and Register Hub link device records, batch and component data and UDI references, giving a traceable thread from design record through production to distributed device. |
Walk into your ISO 13485 audit with evidence already in order
Medical device assessors demand traceable, objective evidence for design controls, risk management, validated processes and complaint handling. Q-Hub keeps every record time-stamped, linked and instantly retrievable, so surveillance audits stop being a fire drill.
Design history under control
Every design input, output, verification and validation record is versioned in Document Hub with approval history, so the auditor always sees a complete, current design history file.
Risk management traceable
Register Hub links hazards, risk controls and residual risk to ISO 14971, so your risk management file connects cleanly to design records and post-market feedback.
Complaints and vigilance logged
Complaints, feedback and adverse events are captured in Smart Forms and CAPA with timelines, so vigilance reporting and regulatory notifications are fully evidenced.
Corrective action closed out
CAPA drives every complaint and nonconformance to documented root cause and effectiveness check, so no issue is left open when the assessor reviews your records.
Design controls and document control built for medical device rigour
ISO 13485 lives or dies on the integrity of your design records: the right revision, verified, validated and released. Document Hub controls every design input, output, procedure, work instruction and quality record with enforced approval workflows, automatic version history and controlled distribution, so obsolete revisions never reach production and the design history file stays complete and traceable from concept to release.
- Version-controlled design inputs, outputs, verification and validation with full approval and change history
- A complete design history file and medical device file kept current and instantly retrievable for audit
- Controlled distribution with read-and-understood acknowledgement to prove the current revision is in use
- Retention rules and traceability that satisfy medical device record-keeping and regulatory requirements
Complaint handling, CAPA and vigilance in one connected loop
When a complaint or nonconformance arises, ISO 13485 expects fast assessment, regulatory reporting where required and corrective action driven to genuine root cause. Q-Hub captures complaints, feedback and adverse events with full timelines, links them to affected devices and batches, and runs the complete CAPA loop, while feeding post-market information back into risk management so emerging issues are caught and reported before they escalate.
- Capture complaints, feedback and adverse events with evidence and instant traceability to device and batch
- Assess reportability and evidence vigilance and regulatory notifications with clear audit timelines
- Structured root-cause analysis and effectiveness checks that satisfy corrective and preventive action
- Live dashboards on open complaints, CAPA status and post-market trends feeding risk management
ISO 13485 certification timeline with Q-Hub
Gap analysis & setup
Map your current QMS against ISO 13485:2016. Q-Hub configures Document, Register, Audit, Training and CAPA Hubs around your devices, design processes and applicable regulatory requirements.
Build the evidence
Populate design history files, risk management files to ISO 14971, competency matrices, calibration schedules and supplier registers. Smart Forms start capturing production and validation evidence from day one.
Internal audit & review
Run medical device internal audits in Audit Hub, close findings through CAPA and hold your management review, so the QMS is proven before the certification body arrives.
Stage 1 & 2 certification
Pass the two-stage certification audit with design, risk and complaint evidence already retrievable, then maintain conformity through annual surveillance using live dashboards and audit trails.
Ready to simplify ISO 13485 compliance?
Give your medical device quality team one system for design controls, risk management, complaint handling and corrective action. See Q-Hub in action.
ISO 13485 FAQs
Both are quality management standards, but ISO 13485 is written specifically for medical devices and emphasises regulatory compliance, safety and risk. Unlike ISO 9001:2015, it does not follow the Annex SL high-level structure and places less weight on continual improvement and customer satisfaction, focusing instead on maintaining effective, documented, regulated processes. Holding ISO 9001 does not mean you meet ISO 13485. Q-Hub can manage both quality systems in one platform.
Design controls are the planned activities in Clause 7.3 that manage design and development: design planning, inputs, outputs, review, verification, validation, transfer, change control and the design history file. They ensure a device consistently meets user needs and intended use. In Q-Hub, Document Hub version-controls every design input, output and validation record with approval workflows, keeping a complete design history file that is traceable and audit-ready.
ISO 13485 requires risk management across the product lifecycle and points to ISO 14971 as the method for identifying hazards, evaluating and controlling risk and monitoring post-market information. Certification to ISO 13485 also underpins compliance with the EU Medical Device Regulation and UK MDR, which regulatory bodies expect. Q-Hub's Register Hub maintains the risk management file to ISO 14971 and links it to design records and complaints for full traceability.
ISO 13485 requires organisations to gather feedback, handle complaints promptly, and report adverse events to regulatory authorities through vigilance and advisory notices where required. Complaints must be assessed for reportability, investigated and linked to corrective action. Q-Hub captures complaints and adverse events in Smart Forms, evidences vigilance decisions with clear timelines, drives CAPA to root cause and feeds post-market data back into risk management.
For an organisation starting from a reasonably mature quality system, ISO 13485:2016 certification typically takes six to twelve months, depending on device complexity, scope and resource. The path runs through gap analysis, building design and risk evidence, internal audit, management review and a two-stage certification audit. Q-Hub shortens preparation by configuring your QMS and keeping design, risk and complaint evidence audit-ready throughout.
Q-Hub gives medical device manufacturers one connected QMS. Document Hub controls the quality manual, design history files and medical device files, Register Hub manages the ISO 14971 risk management file and approved suppliers, Smart Forms capture production and validation evidence, Asset Hub schedules calibration, Training Hub proves competence, Audit Hub runs internal audits and CAPA drives complaint handling and corrective action. Together they keep ISO 13485 evidence traceable and instantly retrievable.