ISO 13485 Document Templates (Quality Manual, Software Validation, Supplier Quality Agreement)
This is an editable ISO 13485 document template set in one place: a quality manual outline, a software validation plan that suits ERP and QMS software, and a supplier quality agreement. Fill the fields once and export a Word or PDF draft you can adapt.
Fill in
ISO 13485 Document Templates
Part A. Quality Manual (outline)
Document: Quality Manual Organization: Acme Medical Devices Ltd, 12 Industrial Park, Springfield Issue date: 2026-10-20 Quality manual owner: Director of Quality
A1. Scope and exclusions
This quality management system applies to the design, manufacture, and distribution of: Class II single-use surgical instruments. The organization acts as: Manufacturer.
List any requirement of ISO 13485:2016 clause 6, 7 or 8 that is not applicable and the justification (for example, design and development excluded for a contract manufacturer that does not design). Regulatory requirements cannot be excluded.
A2. Process interactions and procedures
| Clause | Topic | Documented procedure required | Our document ID |
|---|---|---|---|
| 4.2.4 | Control of documents | Yes | QP-001 |
| 4.2.5 | Control of records | Yes | QP-002 |
| 5.6 / 8.2.4 | Management review and internal audit | Yes (audit) | QP-003 |
| 7.4 | Purchasing and supplier evaluation | Yes | QP-004 |
| 7.5.6 | Process validation | Yes | QP-005 |
| 8.3 | Control of nonconforming product | Yes | QP-006 |
| 8.5.2 | Corrective action | Yes | QP-007 |
| 8.5.3 | Preventive action | Yes | QP-008 |
Part B. Software Validation Plan
Software: ERP system (inventory, lot traceability, nonconformance module) Version: Release 2026.1 Organization: Acme Medical Devices Ltd
Clause 4.1.6 requires validation of software used in the quality management system before initial use and after changes, in proportion to risk. Clause 7.5.6 and 7.6 apply to software used in production and monitoring.
B1. Intended use and risk
Intended use: record lot and serial traceability, control inventory status (quarantine, released, rejected), and route nonconformances for Class II single-use surgical instruments.
Risk assessment: describe how a software failure could affect product quality or compliance, rate the risk (high, medium, low), and set the validation depth to match. A lot status error that allows shipment of rejected product is high risk.
B2. Validation activities
| Step | Activity | Evidence | Owner |
|---|---|---|---|
| 1 | User requirements specification approved | Signed URS | |
| 2 | Supplier assessment (vendor documentation, release notes) | Supplier record | |
| 3 | Installation verification (environment, version, configuration) | IQ record | |
| 4 | Test cases for lot status, traceability, access roles, audit trail | OQ results with screenshots | |
| 5 | Test with real workflows and data | PQ results | |
| 6 | Release and training | Validation summary report, training records | |
| 7 | Change control and revalidation criteria | Change records |
Part C. Supplier Quality Agreement
Between Acme Medical Devices Ltd (Buyer) and Precision Plastics GmbH (Supplier). Product or service covered: Injection moulded housings, part PN-7741. Effective date: 2026-10-20.
1. Quality system: Supplier maintains a quality management system appropriate to the product (ISO 13485 or ISO 9001 certification, or equivalent, as agreed). 2. Specifications: Supplier manufactures to the Buyer's current drawing, specification and approved revision. Supplier does not change materials, process, site or sub-supplier without prior written notice and Buyer approval. 3. Inspection and records: Supplier provides a certificate of conformance and the agreed inspection data with each lot and keeps records for the period stated in the agreement. 4. Traceability: Supplier maintains lot traceability to raw material. 5. Nonconformance and corrective action: Supplier notifies Buyer within an agreed time of any suspected nonconformance and responds to corrective action requests within the agreed time. 6. Audit and access: Buyer, its customers and regulators may audit the Supplier's processes related to this product on reasonable notice. 7. Complaints and recalls: Supplier cooperates in investigations and field actions.
Approvals
This is a starting point, not legal advice or a certified quality system. ISO 13485 requires documents appropriate to your products and regulatory role, so adapt every section. Do not reproduce text of the standard. Software validation depth must be justified by risk for your ERP and QMS tools.
ERP validation support
Optional: talk through validating an ERP or AI tool used in a regulated quality system.
Optional. The tool and every export work without this. No spam.
What ISO 13485 requires you to document
ISO 13485:2016 requires a quality manual (clause 4.2.2), a set of documented procedures for specific processes, and records that show the system runs. Many people over-document. The standard explicitly requires procedures for control of documents, control of records, internal audit, nonconforming product, corrective action, and preventive action, among others, and you decide the depth for the rest. It also requires a medical device file (4.2.3) for each device type or family. Use this set as the skeleton and add what your regulatory role needs, such as FDA 21 CFR 820 or EU MDR requirements.
Software validation for ISO 13485
Clause 4.1.6 requires validation of software applications used in the quality management system, with the approach proportional to risk and its intended use. ERP systems that hold lot traceability, inventory status, nonconformance records and document approvals fall inside this. A sensible plan states the intended use, assesses the risk, defines test cases for the functions that affect product quality, and sets criteria for revalidation after upgrades or configuration changes. Keep the evidence: test scripts, results, screenshots and an approval signature. Cloud ERP updates arrive often, so agree how releases are assessed.
- Write a user requirements specification before testing
- Test access roles and audit trail, not only happy paths
- Risk based: test hardest where failure can reach the patient
- Revalidate on major upgrades and relevant configuration changes
Supplier quality agreements
Clause 7.4 requires you to evaluate and monitor suppliers based on their effect on product quality, and the controls scale with risk. A supplier quality agreement is the contract-level way to make them accept change notification, record keeping, traceability, audit access and corrective action timing. Keep it clear and balanced rather than clever; suppliers will sign a short document faster. Link the agreement to your approved supplier list, so the status of each supplier is visible to purchasing.
Common mistakes
Copying another company's manual verbatim is the most common error: auditors will ask staff about it and the answers will not match. Other mistakes include a software validation done once at go-live and never revisited, a quality manual that excludes design when the company does design, and supplier agreements that nobody monitors. Review these documents at management review and after any process change.
Frequently Asked Questions
Is a quality manual mandatory in ISO 13485?
Yes. Clause 4.2.2 requires a quality manual that includes the scope, exclusions with justification, the documented procedures or references to them, and a description of how the processes interact. Its length and format are up to you.
Do I have to validate my ERP under ISO 13485?
If it is used in the quality management system or affects product quality, such as lot traceability, inventory status or nonconformance records, clause 4.1.6 requires validation proportional to risk. The depth depends on the intended use.
Can a supplier quality agreement replace supplier audits?
No. The agreement sets expectations and legal rights, while evaluation and monitoring under clause 7.4 uses audits, performance data or certificates depending on risk. Use both for critical suppliers.
How many procedures does ISO 13485 need?
There is no fixed number. The standard names the processes that need documented procedures, and you add others needed for effective operation. A small manufacturer can often cover the required set in fewer than twenty documents.
If your ERP holds lot traceability and nonconformance records, Netray can build a read-only AI layer on your own servers that helps you gather validation evidence and answer auditor questions.
Related Tools
ISO 13485 Internal Audit Report Template
A fillable ISO 13485 internal audit report with scope, findings by clause, CAPA references, conclusions and a short audit checklist. Includes realistic sample content.
Quality & InspectionISO 13485 Internal Audit Checklist
A clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged.
Quality & InspectionISO 13485 Supplier Audit Checklist
A clause-based checklist for auditing component, material and service suppliers to a medical device manufacturer, covering QMS, process control, traceability and change control.
Compliance & ContractsFDA 21 CFR 820 to ISO 13485 Clause Crosswalk
Map each 21 CFR 820 quality system topic to the corresponding ISO 13485 clause to speed up QMSR gap assessments and procedure rewrites.
More Compliance & Contracts tools
See all- UDI Label Data Field Reference
- Medical Device Recall Cost Estimator
- Medical Device Standards Reference Table (ISO, IEC, ASTM)
- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
- SyteLine Security and User Access Audit Checklist
- Infor XA (MAPICS) User Access Review Worksheet
- China ERP Data Security and Compliance Assessment
Keep exploring
Free tools
- ISO 13485 SOP Template and Quality Manual OutlineA fill-in ISO 13485 SOP template plus a quality manual outline mapping clauses 4 to 8 to your procedure numbers. Export to Word or PDF.
- ISO 13485 Quality Plan Template with Medical Device File ExampleA fill-in ISO 13485 quality plan with a medical device file content example and a clause compliance checklist table.
- ISO 13485 Supplier Audit ChecklistA clause-based checklist for auditing component, material and service suppliers to a medical device manufacturer, covering QMS, process control, traceability and change control.
Guides
- ISO 13485 ERP Requirements for Medical Device Contract ManufacturersWhat ISO 13485 and FDA QMSR actually require of an ERP at a medical device contract manufacturer: records, traceability, change control and software validation.
- ISO 13485 Medical Injection Molding Validation: IQ, OQ and PQHow medical injection molders structure IQ, OQ, PQ validation under ISO 13485: equipment, process window, capability runs, lot traceability and ERP records.
- ERP for Medical Device Manufacturing: Compliance, Traceability, and ValidationERP for medical device manufacturing: FDA 21 CFR Part 820, ISO 13485, UDI and DHR traceability requirements, plus vendor fit and implementation guidance.
AI on your ERP
- AI on Your ERP for Medical Device Manufacturing Under QMSR and ISO 13485Private AI on your ERP for medical device makers: DHR assembly, UDI, complaints, CAPA and supplier controls under FDA QMSR and ISO 13485, kept on your own infrastructure.
- AI for Dynamics 365 Business Central in Medical Device ManufacturingPrivate AI for Business Central medical device manufacturers: lot and serial genealogy, DHR assembly, supplier controls and audit prep for QMSR and ISO 13485.
Manufacturing hubs
- MDMA, AdvaMed and medical device manufacturing: regulation, ERP and AI realitiesMDMA and AdvaMed medical device manufacturing: FDA QMSR, ISO 13485, UDI and EU MDR, plus the ERP, traceability and private AI issues device makers face.
- Medical Device Manufacturing in Minneapolis-St. PaulMedical device manufacturing in Minneapolis-St. Paul: ecosystem, FDA and ISO 13485 requirements, and ERP, quoting and document problems contract makers face.