ISO 13485:2016 was last reviewed and confirmed by ISO in 2025, so the 2016 edition remains current. In the EU, its European adoption, EN ISO 13485:2016 with corrigendum AC:2018 and amendment A11:2021, is a harmonised standard under the MDR. Commission Implementing Decision (EU) 2022/6 of 4 January 2022 added it to the MDR list, and Implementing Decision (EU) 2022/15 of 6 January 2022 did the same under the IVDR. In the US, FDA's QMSR has incorporated ISO 13485:2016 by reference since 2 February 2026.
The requirements text is the same in each case, but the legal effect is not. This article explains what the "EN" adds, what harmonised status gives you under the MDR, and how the same quality system works for the US. Our article on the ISO 13485 quality management system covers the requirements themselves.
What the EN version adds
An EN is a European Standard adopted by a European standardisation organisation. MDCG 2021-5 Rev.1, the MDCG guidance on standardisation, explains how EN ISO standards relate to their ISO originals: the normative text is the same, and the EN adds a European foreword and Annex Z.
| Element | What it is |
|---|---|
| EN ISO 13485:2016 | European adoption of ISO 13485:2016, third edition |
| EN ISO 13485:2016/AC:2018 | Corrigendum, part of the reference published in the Official Journal |
| EN ISO 13485:2016/A11:2021 | European amendment with a revised foreword and Annexes ZA (MDR) and ZB (IVDR). It does not change the ISO requirements |
Sources: ISO; Implementing Decisions (EU) 2022/6 and 2022/15; MDCG 2021-5 Rev.1.
In our view, EU quality system and technical documentation should cite the full reference: EN ISO 13485:2016, EN ISO 13485:2016/AC:2018 and EN ISO 13485:2016/A11:2021. "ISO 13485:2016" alone does not point to the version that carries a presumption of conformity.
Annexes ZA and ZB
According to MDCG 2021-5 Rev.1, an Annex Z shows the relationship between the standard and the legal requirements it aims to cover. Annex ZA does this for the MDR and Annex ZB for the IVDR. They also show which requirements are not covered, or only partly covered.
In our view, Annex ZA is best used as a gap list. It shows where the standard supports a presumption of conformity and where the MDR still needs other evidence. A manufacturer that reads only the clauses knows what its quality system contains, but not how far the presumption reaches.
What harmonised status gives you
Article 8(1) of the MDR provides that devices in conformity with relevant harmonised standards, whose references have been published in the Official Journal, are presumed to be in conformity with the requirements of the MDR covered by those standards. The second subparagraph applies the same presumption to system or process requirements, including those relating to quality management systems. That is why a management system standard can carry a presumption at all.
Three limits apply:
Voluntary: using harmonised standards is voluntary. According to MDCG 2021-5 Rev.1, other solutions are allowed where the manufacturer shows conformity.
Only what is covered: the presumption applies only to the requirements the standard covers, as shown in Annex ZA.
Not a device assessment: an ISO 13485 certificate is not the conformity assessment of a device. Our article on CE mark for a medical device explains the full route.
MDCG 2021-5 Rev.1 also notes that notified bodies take harmonised standards into consideration (Annex VII Section 4.5.1), even where the manufacturer does not claim them.
Article 10(9): what the MDR asks of the quality system
Article 10(9) requires the manufacturer to establish, document, implement, maintain, keep up to date and continually improve a quality management system, proportionate to the risk class and type of device. It must address at least:
(a) a strategy for regulatory compliance;
(b) identification of the applicable general safety and performance requirements;
(c) responsibility of the management;
(d) resource management, including selection and control of suppliers and sub-contractors;
(e) risk management;
(f) clinical evaluation, including PMCF;
(g) product realisation, including planning, design, development, production and service provision;
(h) verification of UDI assignments and consistency of UDI database information;
(i) the post-market surveillance system;
(j) communication with competent authorities, notified bodies, other economic operators, customers and other stakeholders;
(k) processes for reporting serious incidents and field safety corrective actions;
(l) management of corrective and preventive actions and verification of their effectiveness;
(m) monitoring and measurement of output, data analysis and product improvement.
Several of these, such as the regulatory compliance strategy, UDI and vigilance, are MDR-specific. In our view, they are where Annex ZA is most useful, because it shows where EN ISO 13485 alone is not enough.
Article 10(9) also requires changes in harmonised standards to be adequately taken into account in a timely manner. The MDR list of harmonised standards is amended regularly; Implementing Decision (EU) 2026/1231 of 11 June 2026 is a recent example. Our article on EU MDR requirements covers the other Article 10 obligations.
The US: incorporation by reference
The QMSR has applied since 2 February 2026. It incorporates ISO 13485:2016, and Clause 3 of ISO 9000:2015, by reference into 21 CFR Part 820. FDA cites ISO 13485:2016, not the EN version, so Annexes ZA and ZB play no role in the US. Our article on 21 CFR Part 820 explains the QMSR.
The mechanisms differ:
| EU (MDR) | US (QMSR) | |
|---|---|---|
| Text referenced | EN ISO 13485:2016 + AC:2018 + A11:2021 | ISO 13485:2016 |
| Legal mechanism | Presumption of conformity under Article 8 for requirements covered by Annex ZA | Incorporation by reference into 21 CFR Part 820 |
| Is using it optional? | Yes, other solutions are allowed | No, it is part of the regulation |
Sources: MDR Article 8; FDA QMSR.
A hypothetical example
Hypothetical example: a Dutch SaMD manufacturer sells the same software in the EU and the US. It keeps one quality system.
EU file: it cites the full EN reference and uses Annex ZA as a gap list against Article 10(9). For points the annex does not cover, such as UDI database consistency, it documents the procedure that does the work.
Monitoring: it checks amendments to the MDR harmonised standards list in the Official Journal and records whether each one affects its quality system.
US file: it maps the same procedures to the QMSR and ISO 13485:2016, not to Annex ZA.
One set of procedures supports two legal claims. In our view, each file should state clearly which claim it is making.
Conclusion
The requirements of ISO 13485:2016 are the same everywhere, but the legal effect differs. In the EU, the full EN reference gives a presumption of conformity for what Annex ZA covers. In the US, the ISO text is part of 21 CFR Part 820.
In our view, the practical steps are simple: cite the full EN reference in EU documents, read Annex ZA as a gap list, and do not stretch the presumption beyond what it covers.
If you need help setting up or reviewing a quality system for the EU and US, our management system team can help, or contact MedQAIR.
Frequently asked questions
Is EN ISO 13485 different from ISO 13485?
The requirements are the same. The EN version adds a European foreword and Annexes ZA and ZB, which link the standard to the MDR and IVDR.
Which reference should I cite for the MDR?
EN ISO 13485:2016, EN ISO 13485:2016/AC:2018 and EN ISO 13485:2016/A11:2021, as published in the Official Journal.
Is using EN ISO 13485 mandatory under the MDR?
No. Harmonised standards are voluntary. But the quality system duties in Article 10(9) apply in full, and notified bodies take harmonised standards into consideration.
Does a gap in Annex ZA remove a duty under Article 10(9)?
No. It only means the presumption of conformity does not cover that requirement, so conformity must be shown in another way.
Does FDA accept EN ISO 13485?
The QMSR incorporates ISO 13485:2016 by reference. The EN annexes are EU-specific and play no role in the US.
