You can understand and build much of your QMS yourself
A medical-device quality system does not need to start with a folder full of SOPs.
It starts with understanding what your company actually does, which regulatory responsibilities you hold, and which processes need to be controlled.
The regulatory requirements are public, and there is a recognised international framework for implementing them.
1. Start with the regulation
For medical-device manufacturers, start with MDR Article 10(9).
For IVD manufacturers, start with IVDR Article 10(8).
These provisions describe the areas your quality management system must address, including:
- regulatory strategy
- identification of applicable regulatory requirements
- management responsibility
- resources
- suppliers and subcontractors
- risk management
- clinical or performance evaluation
- product realisation
- UDI and registration
- post-market surveillance
- vigilance
- corrective and preventive actions
- monitoring, measurement and improvement
This is a useful first principle:
Your QMS should reflect the regulatory work your organisation actually needs to control.
It should not exist simply because somebody gave you a standard set of procedures.
2. Use ISO 13485 as the framework
ISO 13485:2016 is the internationally recognised quality-management-system standard for medical devices.
It gives you a structured framework for areas such as:
- document and record control
- management responsibility
- competence and resources
- design and development
- purchasing and supplier control
- production and service provision
- monitoring and measurement
- complaints and feedback
- nonconformities and CAPA
- internal audits
- management review
The standard itself is copyrighted and normally needs to be purchased, but ISO provides introductory material explaining its purpose and how to get started.
ISO also publishes a practical implementation guide for organisations developing and maintaining an ISO 13485 system.
3. Do not confuse ISO 13485 with the MDR or IVDR
ISO 13485 is an important framework, but it does not replace the Regulation.
Your QMS also needs to contain the regulatory processes that apply specifically to your organisation and products.
For an EU manufacturer, that can include:
- regulatory classification and conformity assessment
- PRRC responsibilities
- technical-documentation maintenance
- clinical evaluation or performance evaluation
- PMS, PMCF or PMPF
- vigilance reporting
- economic-operator obligations
- UDI and EUDAMED activities
- management of significant product or QMS changes
A useful question for every process is:
What regulatory obligation is this process controlling?
If there is no good answer, the procedure may not need to exist.
4. Build processes around how the company really works
A startup with five people should not have the same quality system as a multinational manufacturer.
Roles can overlap. Processes can be simple. Several requirements can sometimes be controlled within one procedure.
What matters is that responsibilities are clear, required activities actually happen, records are retained, and the system gives the manufacturer control over its regulatory obligations.
A small QMS that people genuinely use is generally more valuable than a large QMS that exists mainly for an audit.
5. Start with a process map, not an SOP library
Before writing procedures, map the activities your company needs to control.
For example:
product development → risk management → verification and validation → release → post-market monitoring → change control
Then add the organisational processes that support those activities:
document control → training → supplier management → CAPA → internal audit → management review
Only then decide what procedures, templates and records are needed.
This usually produces a much leaner and more usable system.
Useful starting resources
Good places to begin include:
- MDR Article 10(9) for the manufacturer's QMS obligations
- IVDR Article 10(8) for the corresponding IVD requirements
- ISO 13485:2016 for the recognised medical-device QMS framework
- ISO's free introduction to ISO 13485
- the European Commission's harmonised standards page
- applicable MDCG guidance for specific processes such as PMS, vigilance, clinical evidence and software
You do not need to understand every regulatory document before beginning.
Start by identifying your obligations and build the system around them.
Where Fabola comes in
The difficult part is usually not writing an SOP.
It is deciding which processes your company actually needs, how detailed they need to be, who should own them, and how the QMS should connect to your product-development and regulatory strategy.
Fabola helps build quality systems around the organisation rather than forcing the organisation into a generic QMS template.
We can help you:
- define the minimum QMS appropriate to your current stage
- map MDR or IVDR requirements to your processes
- define roles and responsibilities, including PRRC responsibilities
- establish a practical document structure
- write or review the procedures that are genuinely needed
- connect design controls, risk management, clinical or performance evidence and post-market activities
- prepare for ISO 13485 and Notified Body assessment
- identify where a process can remain simple now and where more control will be needed as the company grows
The aim is not to create more quality documentation.
It is to build a system that controls the right things, generates the right evidence and can grow with the company.