ISO Standards for Medical Devices & IVDs

The first task is simply working out which standards apply, because applying the wrong set is a mistake in both directions. Miss a standard that genuinely applies and you leave a gap a reviewer will find; chase standards that do not apply to your device and you burn effort and money proving conformity nobody asked for. The applicable set depends on what the device is, what it contacts, whether it is sterile, whether it is active, and which markets you are targeting, each of which recognises its own list.

We start every engagement by mapping the standards landscape for your specific product — the quality and risk standards that always apply, the biocompatibility and sterilisation standards triggered by the device’s nature, the labelling and symbol standards, and any product-specific standards for your device type in each target market. That map turns a bewildering field into a defined, manageable list, and it is the foundation everything else is built on. Getting the list right is half the battle.

• Missing an applicable standard leaves a gap reviewers find.
• Chasing inapplicable standards wastes time and money.
• The right set depends on the device, its use and the markets.

Two standards sit at the heart of almost every medical-device programme, and they work best when treated as connected rather than separate. ISO 13485 governs the quality management system — how the whole operation is controlled — while ISO 14971 governs risk management, the systematic identification, evaluation and control of the risks a device presents. The modern expectation, reflected in the regulations, is that risk management is not a standalone file but a discipline woven through the quality system, informing design, production, supplier control and post-market.

We implement these two as a coherent pair: a quality system that has risk thinking running through it, and a risk-management process that actually drives decisions rather than sitting in a binder. This connection is exactly what a good auditor or a demanding notified body looks for, and its absence — a risk file disconnected from the rest of the system — is one of the most common findings. Building them together from the start avoids that gap entirely.

Any device that contacts the body — the skin, a mucous membrane, blood, tissue — has to be shown to be biologically safe, and the framework for that is the ISO 10993 series. Rather than mandating a fixed battery of tests, the series frames a risk-based evaluation: you assess what biological risks the material and contact create, and then determine what testing or existing data is needed to address them. This has moved the field towards a biological evaluation plan and a reasoned argument, not just a stack of test reports.

The common mistakes here are over-testing — running an expensive standard battery when a considered evaluation would need far less — or under-addressing a genuine risk and being caught at submission. We help plan the biological evaluation intelligently: understanding the contact type and duration, leveraging existing material data and literature where legitimate, and commissioning testing only where it is genuinely needed. Done well, biocompatibility is both cheaper and more defensible than the brute-force approach many companies default to.

For sterile devices, sterilisation has its own family of standards, and which apply depends on the method. Ethylene oxide sterilisation, radiation sterilisation, moist heat and others each have detailed standards governing how the process is developed, validated and controlled, because an inadequately validated sterilisation process is a direct patient-safety risk — it can mean a device presented as sterile that is not. Regulators scrutinise this area closely, and rightly so.

We help you identify the right sterilisation standards for your chosen method and build the validation to meet them, connecting this to your broader validation documentation so it forms part of a coherent whole. Sterilisation is one of the areas where the standards are genuinely technical and the consequences of getting them wrong are serious, so it benefits particularly from being handled by people who understand both the standard and the practical validation behind it, not just one or the other.

• Sterilisation standards depend on the method (EO, radiation, etc.).
• Validation is patient-safety-critical and closely scrutinised.
• It should connect to your wider validation programme.

Beyond the big system and safety standards sit the quieter ones that still catch companies out. Standards for symbols, such as ISO 15223, let a device communicate essential information — manufacturer, use-by date, sterility, single-use — through recognised graphics rather than multilingual paragraphs, and using them correctly is part of compliant labelling in many markets. Getting a symbol wrong or omitting a required one is a small mistake with a real capacity to hold up a product.

On top of these, many device types have their own product-specific standards — for infusion sets, for particular implants, for electrical safety of active devices, and countless others — that define detailed technical and performance requirements for that category. We make sure the product-specific standards for your device are identified and met, because these are exactly the ones a company new to a device type does not know to look for, and exactly the ones a reviewer familiar with that device will expect to see addressed.

The real payoff of getting the standards right is that they form a technical foundation that serves every market at once. A device genuinely built to the appropriate recognised standards is a device whose safety and performance are already demonstrated in the language regulators everywhere understand, so the same evidence supports the CDSCO dossier, the CE technical documentation, the FDA submission and others. Standards are, in this sense, the common currency of global device regulation.

We implement the standards with that multi-market foundation in mind, so the work is not repeated for each jurisdiction but built once and drawn on repeatedly. A company that treats standards as a coherent technical base rather than a per-market checklist enters its second and third markets far more cheaply, because the hard evidence is already in place. Turning the intimidating web of standards into that kind of durable foundation is precisely what this service is for.