ISO 13485:2016 undergoes a systematic review every five years. The latest, conducted in 2025, concluded on 31 October 2025 with the confirmation of the standard without changes. The 2016 version remains in force and no revision project is open to date. The next systematic review is expected around 2030.
What a systematic review is, and what it is not
Every ISO standard is reviewed at least every five years. At the end of this systematic review, the national member bodies of the relevant technical committee (ISO/TC 210 for ISO 13485) vote to confirm, revise or withdraw the standard. A periodic review therefore does not automatically lead to a revision: in 2025, confirmation was the outcome.
If a revision were ever decided, it would go through formal, public stages: committee draft (CD), draft international standard (DIS), final draft (FDIS), then publication. This process generally takes several years, and a revised standard comes with a transition period during which certificates issued against the previous version remain valid. None of these stages has been started to date; progress can be checked on the standard’s page on iso.org.
The discussion topics to watch
No draft text for a future version exists today. Several topics nevertheless recur in industry discussions and could feed a possible revision, without any decision having been taken.
Articulation with the MDR and the IVDR. The 2016 version was published before these two regulations. Their articulation with the standard, particularly on post-market surveillance, clinical evaluation and vigilance, is currently handled through the Z annexes of EN ISO 13485 and the regulations’ own requirements.
Cybersecurity. Medical device cybersecurity was not a topic in the 2016 version. It is now addressed by other frameworks, including the MDCG 2019-16 guidance and IEC standards, notably IEC 81001-5-1.
Software used in the QMS. Section 4.1.6 on the validation of QMS software is often considered brief in light of today’s digital environments (online tools, SaaS solutions).
What this means for your QMS
The applicable version is and remains ISO 13485:2016 (EN ISO 13485:2016 in Europe). There is no reason to change your QMS in anticipation of a revision that has not been started. The best preparation remains a robust QMS built on the 2016 version, properly covering all its clauses, including those under discussion, and incorporating the requirements of the MDR and the IVDR where the standard falls short.