ISO 13485:2016 specifies requirements for a quality management system in which an organization must demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements. Such organizations may be involved in one or more stages of the life cycle, including design, development, manufacturing, storage and distribution, installation or maintenance of a medical device, and design and development of related activities (e.g. technical support). ISO 13485:2016 can also be used by suppliers or external parties that provide products, including quality management system-related services, to these organizations.

The requirements of ISO 13485:2016 apply to organizations regardless of size and regardless of type, except where explicitly stated. Wherever the requirements are specified as applying to medical devices, the requirements apply equally to the related services provided by the organization.

Processes required by ISO 13485:2016 that apply to the organization but are not performed by the organization are the responsibility of the organization and are accounted for in the organization's quality management system by monitoring, maintaining and controlling the processes.

If regulatory requirements allow the exclusion of design and development controls, it can be used as a justification for their exclusion from the quality management system. These regulatory requirements may provide alternative approaches that should be addressed in the quality management system. It is the responsibility of the organization to ensure that claims of conformity to ISO 13485:2016 reflect the exclusion of design and development controls. If any requirement in Clause 6, 7 or 8 of ISO 13485:2016 is not applicable due to the activities performed by the organization or the nature of the medical device to which the quality management system applies, the organization need not include such elements as a requirement in the quality management system. For any item found not to be applicable, the organization shall record the justification as described in 4.2.2.