ISO 13485 Gap Analysis Template with ISO 9001 and QMSR Comparison
This ISO 13485 gap analysis template walks the clauses of ISO 13485:2016, shows where each one differs from ISO 9001, and turns your maturity scores into a single gap number. Edit the rows, add your own clauses and export to Excel.
| ISO 13485 clause | Topic | What the clause asks for (summary) | Versus ISO 9001 | Weight (1-3) | Maturity (0-4) | Gap points | Owner | Action to close gap | |
|---|---|---|---|---|---|---|---|---|---|
6 | |||||||||
9 | |||||||||
2 | |||||||||
2 | |||||||||
6 | |||||||||
6 | |||||||||
9 | |||||||||
2 | |||||||||
6 | |||||||||
3 | |||||||||
6 | |||||||||
9 | |||||||||
2 | |||||||||
2 |
Rows are examples. Add a row for every clause and sub-clause that applies to your scope, including documented exclusions under clause 1.2. Summaries are paraphrased, read the standard itself for the exact requirements.
Get a second pair of eyes on your gap list
Optional: we can review your exported gap analysis and show which traceability and CAPA evidence your ERP can already produce.
Optional. The tool and every export work without this. No spam.
How to use the gap analysis template
Start with the clause list in the standard's table of contents: 4 Quality management system, 5 Management responsibility, 6 Resource management, 7 Product realization and 8 Measurement, analysis and improvement. For each clause, score weight 1 to 3 by patient and regulatory risk and maturity 0 to 4 by how well you do it today with objective evidence. The sheet multiplies weight by the distance from full maturity so a weak high risk clause outweighs a weak low risk one.
- Score from records you can show an auditor, not from intent
- Record an owner and a specific action per gap
- Re-score monthly and export a copy for management review
ISO 9001 and ISO 13485 comparison in practice
ISO 13485 is not a superset of ISO 9001. It drops the customer satisfaction and continual improvement emphasis and replaces them with regulatory compliance and device safety. Expect the largest new work in design controls, risk management through the lifecycle, process validation, traceability, complaint handling and regulatory reporting. The column Versus ISO 9001 flags which clauses a company coming from ISO 9001 will find familiar and which have no equivalent.
- No ISO 9001 equivalent: medical device file, complaint handling, regulatory reporting
- More prescriptive: documentation, design, purchasing, traceability
- Medical device specific: work environment, sterile device and implant controls
Comparing with FDA QSR and QMSR
FDA's Quality Management System Regulation (QMSR) amends 21 CFR Part 820 and incorporates ISO 13485:2016 by reference, with effect from 2 February 2026. A gap analysis for US devices therefore uses the same clause structure and adds the FDA specific items: complaint files, medical device reporting under Part 803, UDI, labeling and the records FDA can inspect that ISO auditors do not always request. Keep one extra column or a second sheet for the FDA specific actions.
Common mistakes
Teams score a clause as mature because a procedure exists, even though records show it is not followed. Others forget software used in the QMS, including ERP lot traceability and electronic signatures, which clause 4.1.6 requires to be validated for its intended use. Finally, exclusions are only allowed for clause 7 requirements that do not apply, and they must be justified in the quality manual.
Frequently Asked Questions
How long does an ISO 13485 gap analysis take?
For a small manufacturer with an existing ISO 9001 system, a first pass usually takes a few days of interviews and record sampling. The scoring is quick, but collecting evidence per clause is what takes time. Plan a second pass after corrective actions are in place.
Is ISO 13485 the same as ISO 9001 plus medical rules?
No. It follows a similar structure, but it is built around regulatory compliance and risk, drops several ISO 9001 improvement and customer satisfaction requirements and adds device specific controls for design, validation, traceability and complaints.
Does QMSR replace ISO 13485 for US devices?
QMSR incorporates ISO 13485:2016 by reference into 21 CFR Part 820 and adds FDA specific requirements. Certification to ISO 13485 is still voluntary for FDA purposes, but the content you must meet is now aligned.
Can I exclude clauses from my ISO 13485 scope?
Only clause 7 requirements that do not apply to your activities can be excluded, and the reason must be recorded in your quality manual. Clauses 4, 5, 6 and 8 cannot be excluded.
If your lot genealogy, complaints and CAPA data sit in an on-prem ERP, Netray can add a private AI layer that answers trace and audit questions from that data without sending it outside your network.
Related Tools
ISO 13485 Internal Audit Plan and Management Review Template
Fill-in ISO 13485 internal audit plan and management review minutes covering required inputs and outputs, with guidance on clause 7.5.
Quality & InspectionISO 13485 Internal Audit Checklist
A clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged.
Compliance & ContractsFDA 21 CFR 820 to ISO 13485 Clause Crosswalk
Map each 21 CFR 820 quality system topic to the corresponding ISO 13485 clause to speed up QMSR gap assessments and procedure rewrites.
More Quality & Inspection tools
See all- CAPA Corrective and Preventive Action Form Template
- Device History Record (DHR) Template
- Process Validation IQ OQ PQ Template
- Medical Device Complaint Handling Form Template
- ISO 14971 Risk Management Worksheet
- Sterilization Load Record Template
- Medical Device Design Verification Protocol Template
- Medical Device Supplier Evaluation Scoring Worksheet
- Medical Device Cleanroom Environmental Monitoring Log
Keep exploring
Free tools
- ISO 13485 Internal Audit ChecklistA clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged.
- ISO 13485 Quality Plan Template with Medical Device File ExampleA fill-in ISO 13485 quality plan with a medical device file content example and a clause compliance checklist table.
- ISO 13485 Document TemplatesAn editable ISO 13485 template set covering a quality manual outline, a software validation plan for ERP and quality software, and a supplier quality agreement.
Guides
- ISO 13485 ERP Requirements for Medical Device Contract ManufacturersWhat ISO 13485 and FDA QMSR actually require of an ERP at a medical device contract manufacturer: records, traceability, change control and software validation.
- ERP for Medical Device Manufacturing: Compliance, Traceability, and ValidationERP for medical device manufacturing: FDA 21 CFR Part 820, ISO 13485, UDI and DHR traceability requirements, plus vendor fit and implementation guidance.
- ISO 13485 Medical Injection Molding Validation: IQ, OQ and PQHow medical injection molders structure IQ, OQ, PQ validation under ISO 13485: equipment, process window, capability runs, lot traceability and ERP records.
AI on your ERP
- AI on Your ERP for Medical Device Manufacturing Under QMSR and ISO 13485Private AI on your ERP for medical device makers: DHR assembly, UDI, complaints, CAPA and supplier controls under FDA QMSR and ISO 13485, kept on your own infrastructure.
- AI on Infor SyteLine for Medical Device Manufacturers: Genealogy, DHR and Audit EvidencePrivate AI on Infor SyteLine for medical device makers: lot and serial genealogy, DHR assembly, UDI and QMSR evidence, with human approval on every write.
Manufacturing hubs
- MDMA, AdvaMed and medical device manufacturing: regulation, ERP and AI realitiesMDMA and AdvaMed medical device manufacturing: FDA QMSR, ISO 13485, UDI and EU MDR, plus the ERP, traceability and private AI issues device makers face.
- Medical Device Manufacturing in Minneapolis-St. PaulMedical device manufacturing in Minneapolis-St. Paul: ecosystem, FDA and ISO 13485 requirements, and ERP, quoting and document problems contract makers face.