Pre-market Services
We implement a robust medical device management systems, ensuring compliance with ISO 13485, ISO 27001, NEN 7510-1 and others for quality and information security.
Whether you manufacture medical devices or operate as an economic operator (e.g., importer, distributor, repackager, OEM supplier), implementing a management system can support regulatory compliance. The most widely adopted medical device quality management system (QMS) is ISO 13485 for medical devices, though regional regional requirements may need to be addressed on top of the standard (e.g., in the US, Canada, Brazil, and Australia). For manufacturers entering multiple markets, the Medical Device Single Audit Program (MDSAP) can further streamline compliance and, in some cases, is mandatory.
ISO/IEC 27001 (and NEN 7510-1 in the Netherlands) provides a framework for an information security management system (ISMS) tailored to medical devices. Beyond a QMS and ISMS, management systems can be extended to include Good Clinical Practice (GCP), Privacy Management (ISO/IEC 27701), and Good Machine Learning Practices (GMLP).
At MedQAIR, we specialise in implementing the best management systems for medical devices, covering quality management, information security, and compliance with evolving AI regulations. Our expertise includes ISO 13485, ISO/IEC 27001, and NEN 7510-1, ensuring compliance across design, development, distribution, and post-market surveillance.
Explore our blog posts on MDR, IVDR, and EU AI Act medical device compliance to stay ahead of regulatory changes.
ISO/IEC 27001 has been the reference standard for information security management systems since 2005, and its third edition, ISO/IEC 27001:2022, was published on 25 October 2022 (ISO/IEC 27001:2022 and Amendment 1:2024). The transition from
Manufacturers have been able to register in EUDAMED, the European database on medical devices, since December 2020 for the Actor module and since October 2021 for UDI and device data, but only on a voluntary basis. That changed on 28
Using the EUDAMED UDI/Devices module became mandatory on 28 May 2026. This follows the Commission Decision (EU) 2025/2371, which formally declared the first four modules functional. Published in the Official Journal back on 27 November 2025, that decision kicked off
We are pleased to welcome Eva Kurilova-Sahin to the MedQAIR team. Eva brings a background in medicine, clinical science, radiology, and oncology research, together with experience in AI-enabled medical technology. Over the past 10 years, her work has brought her
The regulatory landscape for medical devices is becoming more complex as artificial intelligence becomes part of diagnosis, monitoring, treatment, and clinical decision support. For manufacturers, understanding the EU AI Act medical devices requirements is now essential alongside the existing Medical
Artificial intelligence is evolving faster than the regulatory frameworks around it. But that gap is beginning to close, with a growing body of AI medical device standards now moving towards publication and wider regulatory recognition.
Find answers to common questions about our services, compliance processes, and how we can assist your business.
Management systems provide the framework for controlling product quality, regulatory compliance, information security, supplier oversight, and post-market activities. Regulators increasingly expect manufacturers and other economic operators to demonstrate that these activities are managed through documented and controlled processes.
ISO 13485 is widely used as the foundation for medical device quality management systems. While compliance with ISO 13485 alone does not guarantee MDR or IVDR compliance, it provides the structure needed to manage design controls, supplier management, risk management, post-market activities, and regulatory documentation.
Yes. A well-designed management system can support compliance across multiple jurisdictions, including the EU (MDR/IVDR), United States (FDA QMSR), Canada (where MDSAP is mandated), Australia, and other international markets. Additional market-specific requirements can then be integrated into the core system.
Information security is increasingly linked to product safety, cybersecurity, privacy, and regulatory compliance. Standards such as ISO/IEC 27001 and NEN 7510-1 help organisations establish governance and controls for managing sensitive information and supporting cybersecurity obligations throughout the product life cycle.
Yes. AI-enabled systems often require additional governance activities related to data management, model development, validation, monitoring, cybersecurity, and change management. Management systems should support these activities while maintaining compliance with applicable medical device and AI regulations.
Yes. Many organisations benefit from integrating quality and information security activities into a single management framework. This helps reduce duplication, improve governance, and create alignment between regulatory compliance, cybersecurity, and operational processes.
The Medical Device Single Audit Program (MDSAP) allows manufacturers to demonstrate compliance with quality management requirements across multiple participating regulatory jurisdictions through a single audit programme. It is particularly important for manufacturers seeking access to the Canadian market.
Management systems establish the procedures, records, responsibilities, and evidence needed during regulatory inspections, certification audits, supplier audits, and due diligence reviews. Well-maintained systems help organisations demonstrate compliance and respond efficiently to audit findings.
Management systems should be reviewed on an ongoing basis to reflect organisational changes, new products, regulatory developments, cybersecurity risks, supplier changes, and audit outcomes. Periodic management reviews help ensure continued effectiveness and compliance.
Common findings include incomplete procedures, inadequate training records, weak supplier controls, insufficient cybersecurity governance, ineffective risk management processes, gaps in post-market activities, and inconsistencies between documented procedures and operational practice.
Yes. Management systems can help organisations establish governance processes for cybersecurity, vulnerability management, incident handling, supplier oversight, access control, and privacy-related activities. These processes support compliance with standards and regulations applicable to healthcare technologies.
Training ensures personnel understand their responsibilities, applicable procedures, regulatory requirements, and organisational processes. Effective training programmes support audit readiness, operational consistency, and ongoing compliance throughout the product lifecycle.
Yes. MedQAIR supports both new implementations and existing systems. Services include gap assessments, remediation planning, audit preparation, process optimisation, supplier management reviews, cybersecurity integration, training, and ongoing quality, security, and regulatory support.
Management systems help organisations establish controlled processes for software development, change management, validation, cybersecurity, supplier management, documentation, and post-market monitoring. These controls support compliance across software medical devices, AI-enabled systems, electronic health record systems, and other digital health technologies.
ISO 13485 is not legally mandatory in every jurisdiction, but it is the de facto global standard for a medical device QMS and is required in practice in most markets. The EU MDR/IVDR requires an “”appropriate”” QMS (Article 10), and Notified Bodies use ISO 13485 as the basis for audit. In the US, FDA’s Quality Management System Regulation (QMSR), effective February 2026, aligns 21 CFR Part 820 with ISO 13485:2016. Canada, Australia, Japan, and other MDSAP countries also use ISO 13485 as the audit standard.