ISO certification · ISO 13485Medical devices

Keybridge prepares ISO 13485 certification in Iraq and Kurdistan.

Manage quality across the medical-device activities within your organisation’s scope. We confirm the scope and the buyer’s stated requirements before preparation starts. Buyer acceptance depends on the certificate scope, issuing body and the requirements set by the buyer. We review those requirements before preparation.

Get a proposal All standards

ISO 13485 Medical devices quality management systems

ISO 13485 at a glance

Published: March 2016. ISO 13485:2016 is the current edition and it is what auditors check against today.
Structure: Not Annex SL. 8 clauses, kept close to the older ISO 9001:2008 layout, so it does not line up clause for clause with ISO 9001:2015. Clauses 4 to 8 carry the auditable requirements.
Certifiable: Yes. The company is certified for a named scope, such as import, storage, distribution and servicing. The certificate is not a device approval, a CE mark or a Ministry of Health registration.
Certificate validity: The assessment body confirms the applicable schedule and continuing requirements for your scope.
Surveillance: The assessment body confirms the applicable schedule and continuing requirements for your scope.
Audit days, 10 to 50 people: The assessment body confirms the applicable schedule and continuing requirements for your scope.
What the scope covers: Only the sites and activities written into the scope. Anything left out of it is not covered.
What the certificate says: The company name, the standard, the scope and the dates the certificate runs.
Language of the system: We write the documentation in the language the company works in: Arabic, Kurdish or English. Labels and instructions for use follow what the manufacturer and the Ministry of Health require.

What ISO 13485 is

ISO 13485:2016 is the international standard for a quality management system in the medical device sector. It asks a company to control the design, production, storage, distribution and servicing of devices, to run risk management across the whole life of the product, and to keep records that trace every device back to its batch and forward to the customer. It applies to manufacturers and equally to importers, distributors and service companies.

What the standard requires

Clauses 1 to 3 cover scope, normative references and terms. Clauses 4 to 8 are the requirements an auditor checks, and this standard does not use the Annex SL structure that ISO 9001 uses.
Clause 4, quality management system. A quality manual, the procedures the standard names in writing, and the documentation clause 4.2.3 requires for each device or device family.
Clause 4.1.6, software validation. Any software used inside the quality system, from the stock and traceability system to the temperature loggers, is validated before use and the validation is recorded.
Clause 5, management responsibility. Management signs the quality policy, appoints a management representative, defines the regulatory requirements that apply, and holds the management review.
Clause 6, resource management. Competence records for every person whose work affects product quality, plus controlled premises, equipment, temperature and contamination control.
Clause 7.1 and 7.3, planning and design. Risk management runs across the whole life of the device to ISO 14971. If the company designs, clause 7.3 adds inputs, outputs, review, verification, validation, transfer and change control recorded for each design.
Clause 7.4 and 7.5, purchasing and production. Suppliers are evaluated and monitored, processes and sterilisation are validated, and traceability records identify the batch of every device delivered.
Clause 8.2.1 and 8.2.3, feedback and reporting. A complaint log, feedback from post market use, and a written procedure for notifying the Ministry of Health and any other authority when a complaint meets the reporting criteria.
Clause 8.3.3, product after delivery. Advisory notices and a recall procedure that has been tested on a real lot, with the route back through the hospital or the clinic written down.
Clause 8.5, improvement. Corrective and preventive action for every nonconformity and complaint, with evidence that the correction worked before the record is closed.

Who needs ISO 13485 in Iraq and Kurdistan

Medical device importers and distributorsStorage, traceability and complaint handling are relevant quality controls for medical-device distribution. Confirm the applicable regulatory and buyer requirements.

Hospital equipment suppliers and service companiesISO 13485 may be relevant to the management of this activity. Confirm the applicable scope and any buyer requirement before seeking certification.

In vitro diagnostic and reagent suppliersCold chain records, lot traceability and expiry control decide whether a laboratory result can be defended.

Dental and prosthetics laboratoriesA custom made device is a device, so the order, the design record and the delivery note have to trace back to the patient and the material batch.

Sterile and single use product suppliersSterile devices carry validation, batch records and storage conditions that an auditor samples directly.

Orthopaedic and implant distributorsISO 13485 may be relevant to the management of this activity. Confirm the applicable scope and any buyer requirement before seeking certification.

Manufacturers of consumables and device packagingA manufacturer that appoints a supplier passes its own regulatory obligations down through the purchasing controls in clause 7.4.

The buyers that ask for ISO 13485

Buyer or list	What they ask for
Kimadia	Review this buyer’s current supplier criteria for the products or services offered. Certificate scope, buyer acceptance and tender eligibility need to be checked separately.
Federal Ministry of Health device registration	Check the current registration instructions for your activity and category. Confirm whether this standard is requested and which issuing bodies are accepted.
KRG Ministry of Health	Check the current registration instructions for your activity and category. Confirm whether this standard is requested and which issuing bodies are accepted.
Foreign device manufacturers	Review this buyer’s current supplier criteria for the products or services offered. Certificate scope, buyer acceptance and tender eligibility need to be checked separately.
Saudi Food and Drug Authority	Review this buyer’s current supplier criteria for the products or services offered. Certificate scope, buyer acceptance and tender eligibility need to be checked separately.
UAE Ministry of Health and Prevention	Check the current registration instructions for your activity and category. Confirm whether this standard is requested and which issuing bodies are accepted.
UN agencies through UNGM	Check the individual procurement notice for the required certificate and scope. Registration on UNGM does not replace the tender’s qualification criteria.
KRG Approved Suppliers Center	Check the current registration instructions for your activity and category. Confirm whether this standard is requested and which issuing bodies are accepted.

What shapes your investment

Number of sites and warehouses, and whether the auditor has to travel to Erbil, Sulaymaniyah, Baghdad or Basra.
Whether the company designs devices or only imports, stores, distributes and services them, because design brings clause 7.3 into the audit and adds auditor days.
Number of device families and their risk class, which sets how much risk management and device documentation the system carries.
Whether sterile devices, implants or in vitro diagnostics are in the scope, which adds validation work and technical auditor time.
Headcount, which sets how many auditor days the audit takes.
Languages the documentation, the labels and the instructions for use are written in.
How much usable documentation and how many validation records already exist in the company.
Whether ISO 13485 is built alone or together with ISO 9001 as one system, and the number of findings during the audit.

The proposal names the scope, the deliverables and the dates before work starts.

ISO 13485 questions we are asked

How long does certification take?

Preparation depends on your scope, existing records and any gaps to address. The assessment body controls its own schedule and decision.

What should we prepare before starting?

Tell us your activities, locations and any buyer requirement. We then identify the existing procedures and records needed for the initial review.

Will this meet our buyer’s requirements?

We review the buyer’s stated requirement against the scope and issuing body before proceeding. Acceptance of your supplier application remains the buyer’s decision.

What happens after certification is granted?

Keep the system and records current, address findings and follow the assessment body’s surveillance and renewal requirements. Any ongoing support is agreed separately.

Does ISO 13485 replace product approval?

No. It addresses the quality management system. Product registration, market access and any applicable conformity requirements must be checked separately.

Can a distributor use ISO 13485?

The standard can be relevant to organisations involved in the medical-device supply chain. The scope must reflect the distributor’s actual responsibilities and activities.

Prepare for ISO 13485 certification.

Tell us about your organization’s activities, the sites involved and any buyer requirements. We will review your current position and identify the work needed to prepare.

Business inquiry

WhatsApp Telegram info@keybridge.krd