Medical device manufacturing is regulated as a system: the device, the process that makes it and the equipment that runs the process. That is why buying, moving or modifying a machine in a validated medical process is a regulated event, not just a maintenance task.
FDA’s Quality Management System Regulation became effective on February 2, 2026. It amends 21 CFR Part 820 by incorporating ISO 13485:2016 by reference, so the U.S. requirement and the international standard now share one framework. ISO 13485:2016 itself has been reconfirmed and is expected to remain unchanged until 2030. For deeper context on device pathways, see MBB’s medical quality and regulatory guide.
ISO 13485 requires documented maintenance for production equipment, validation of processes whose output cannot be fully verified afterward, validation of software used in production and the quality system, and controlled changes. A new machine, a relocated machine, a control retrofit or even a new coolant can be a change that has to be evaluated, and often revalidated, before product ships.
Issued by ISO (TC 210) · certifiable
The quality management system standard for organizations involved in any stage of a medical device’s life, including contract manufacturers and machine shops supplying device makers. It emphasizes regulatory compliance, risk-based control, documented processes, process validation, cleanliness and contamination control, traceability and complaint handling.
Contract machinists for orthopedic, surgical and dental devices are routinely required to hold ISO 13485. Equipment qualification and change control are audited.
Machines leaving a validated medical cell are worth more with their IQ/OQ records, maintenance history and accuracy reports, even though the validation itself does not transfer.
Plan qualification time and cost when you buy: installation and operational qualification at minimum, and process requalification for the parts you move onto it.
Status (reviewed October 7, 2026): ISO 13485:2016 is current and has been reconfirmed; it is expected to remain unchanged until 2030.
Source: ISO 13485 (ISO) ↗
Issued by U.S. Food and Drug Administration
The U.S. quality system requirement for finished medical device manufacturers. Effective February 2, 2026, it incorporates ISO 13485:2016 by reference with FDA-specific additions, replacing the former Quality System Regulation.
Finished-device manufacturers are directly regulated; their suppliers, including machine shops, inherit requirements through purchasing controls and supplier agreements.
Selling equipment into device manufacturing? Buyers will want documentation that supports their own qualification work.
FDA inspections can examine equipment maintenance, calibration, process validation and change records for the machines that make your device.
Status (reviewed October 7, 2026): Effective February 2, 2026.
Source: FDA: QMSR ↗ 21 CFR 820 (eCFR) ↗
Issued by ISO (TC 210)
The risk management process for medical devices across their life cycle: hazard identification, risk estimation and evaluation, risk control and monitoring of production and post-production information.
Why it matters: Manufacturing process risks (wrong feature, burr, contamination, residue) feed device risk files; process FMEAs for machining reference it.
Status (reviewed October 7, 2026): ISO 14971:2019 is the current edition.
Source: ISO Online Browsing Platform ↗
Issued by Participating regulators: Australia (TGA), Brazil (ANVISA), Canada (Health Canada), Japan (MHLW/PMDA), United States (FDA)
One audit of a manufacturer’s quality system, by an authorized auditing organization, that participating regulators can use in place of separate audits.
Why it matters: Device makers selling in several of these markets often hold MDSAP certificates; their supplier expectations follow.
Source: FDA: MDSAP ↗
Issued by European Union
The regulation governing medical devices placed on the EU market, with notified-body conformity assessment for most classes, CE marking, clinical evaluation, UDI and post-market surveillance.
Why it matters: Many U.S. device makers sell in the EU. Their legacy devices are moving to MDR certificates, which keeps supplier documentation in demand.
Status (reviewed October 7, 2026): Under Regulation (EU) 2023/607, legacy devices that met the conditions (QMS in place and notified-body application by May 26, 2024; written agreement by September 26, 2024) may remain on the market until December 31, 2027 for class III and most class IIb implantable devices, and until December 31, 2028 for other class IIb, class IIa and class I sterile or measuring devices.
Issued by Required through ISO 13485 and 21 CFR 820; method guidance from GHTF SG3/N99-10 (now under IMDRF)
Installation qualification confirms the equipment is installed correctly with the right utilities and documentation. Operational qualification shows the process works across its intended operating range. Performance qualification shows it consistently produces acceptable product under normal conditions. Required for processes whose results cannot be fully verified by inspection; commonly applied to machining cells, cleaning, passivation, marking and packaging.
Machine purchases, relocations, rebuilds and control upgrades are change-control events that can require partial or full requalification.
Leave the IQ/OQ binder with the machine if you can. It shortens the buyer’s work even though they must requalify.
Ask the seller for the original IQ documents, manuals, electrical drawings and accuracy reports. They are the raw material of your own IQ.
Source: IMDRF (GHTF archive) ↗
Issued by ISO (TC 194)
How to evaluate the biological safety of a device and its materials, including residues from manufacturing.
Why it matters: Cutting fluids, cleaning agents and lubricants can leave residues. Changing coolant on an implant line is a change to evaluate, not just a purchasing decision.
Status (reviewed October 7, 2026): ISO 10993-1:2025 (published November 2025) replaces the prescriptive endpoint table of the 2018 edition with a risk-based approach.
Source: ISO Online Browsing Platform ↗
Issued by ASTM International (Committee F04)
Common material specifications for surgical implants: F136 (wrought Ti-6Al-4V ELI), F138 (wrought 316L-type stainless bar and wire), F1537 (wrought cobalt-chromium-molybdenum) and F2063 (wrought nickel-titanium shape-memory alloy).
Why it matters: Material certs must call out the exact specification. These alloys also drive machine choice: titanium and CoCr reward rigidity, high-pressure coolant and thermal stability.
Source: ASTM International ↗
Issued by ASTM International
Passivation removes free iron and other contaminants from stainless surfaces after machining to restore corrosion resistance; A967 defines treatments and tests, A380 gives cleaning and passivation practice.
Why it matters: A routine step after machining stainless instruments and implants, and a validated process in its own right.
Source: ASTM International ↗
Issued by ISO (TC 209)
Defines cleanroom classes (ISO Class 1 through 9) by airborne particle concentration and how to test them.
Why it matters: Final cleaning and packaging areas for implants are often classified cleanrooms; machining itself usually is not, but what leaves the machine must be cleanable to the validated level.
Source: ISO Online Browsing Platform ↗
Issued by ISO (TC 198)
Validation and routine control of the main sterilization methods, and requirements for the packaging systems that keep devices sterile.
Why it matters: Sterilization is downstream of machining, but part design, burrs, blind holes and residues all affect whether a device can be cleaned and sterilized reliably.
Source: ISO Online Browsing Platform ↗
Issued by FDA
Requires most devices to carry a unique device identifier in human- and machine-readable form, with data submitted to FDA’s GUDID database. Some devices require direct marking on the device itself.
Why it matters: Direct part marking is often done by laser on or next to the machining line, and it must not compromise the surface or the material.
Source: FDA: UDI system ↗
Machine Blue Book does not sell certification, consulting or machines, and is not affiliated with any standards body named here. Standards are copyrighted by their publishers; this reference describes them in our own words and links to the issuing organization. It is educational, not legal or regulatory advice. Facts reviewed October 7, 2026. Found an error or a change? Tell the editor.
