Bond prepares ISO 13485 certification in Iraq and Kurdistan.
The quality management system for the medical device sector. It controls design, production, storage, distribution and servicing, and hospital buyers and device manufacturers ask for it by name.
ISO 13485 Medical devices quality management systems · Medical devices
What ISO 13485 is
ISO 13485:2016 is the international standard for a quality management system in the medical device sector. It asks a company to control the design, production, storage, distribution and servicing of devices, to run risk management across the whole life of the product, and to keep records that trace every device back to its batch and forward to the customer. It applies to manufacturers and equally to importers, distributors and service companies. The certification body issues the certificate to the company.
What the standard requires
- Clauses 1 to 3 cover scope, normative references and terms. Clauses 4 to 8 are the requirements an auditor checks, and this standard does not use the Annex SL structure that ISO 9001 uses.
- Clause 4, quality management system. A quality manual, the procedures the standard names in writing, and a medical device file under clause 4.2.3 for each device or device family.
- Clause 4.1.6, software validation. Any software used inside the quality system, from the stock and traceability system to the temperature loggers, is validated before use and the validation is recorded.
- Clause 5, management responsibility. Management signs the quality policy, appoints a management representative, defines the regulatory requirements that apply, and holds the management review.
- Clause 6, resource management. Competence records for every person whose work affects product quality, plus controlled premises, equipment, temperature and contamination control.
- Clause 7.1 and 7.3, planning and design. Risk management runs across the whole life of the device to ISO 14971. If the company designs, clause 7.3 adds inputs, outputs, review, verification, validation, transfer and change control in a design file.
- Clause 7.4 and 7.5, purchasing and production. Suppliers are evaluated and monitored, processes and sterilisation are validated, and traceability records identify the batch of every device delivered.
- Clause 8.2.1 and 8.2.3, feedback and reporting. A complaint file, feedback from post market use, and a written procedure for notifying the Ministry of Health and any other authority when a complaint meets the reporting criteria.
- Clause 8.3.3, product after delivery. Advisory notices and a recall procedure that has been tested on a real lot, with the route back through the hospital or the clinic written down.
- Clause 8.5, improvement. Corrective and preventive action for every nonconformity and complaint, with evidence that the correction worked before the record is closed.
Who needs ISO 13485 in Iraq and Kurdistan
The buyers that ask for ISO 13485
| Buyer or list | What they ask for |
|---|---|
| Kimadia | The State Company for Marketing Drugs and Medical Appliances under the federal Ministry of Health runs the public tenders that supply state hospitals, and asks suppliers for the manufacturer's certificates and a quality system. |
| Federal Ministry of Health device registration | The device and the local agent are registered before the product can be sold. The agent's storage, traceability and complaint handling are part of the file. |
| KRG Ministry of Health | Hospital procurement in Erbil, Sulaymaniyah and Duhok runs on its own tenders, and private hospital groups in Erbil apply the same supplier checks. |
| Foreign device manufacturers | European, Turkish, Chinese and Korean manufacturers require an appointed distributor to hold a quality system covering storage, distribution, complaint feedback and recall before the agreement is signed. |
| Saudi Food and Drug Authority | A medical device marketing authorisation for Saudi Arabia asks for an ISO 13485 certificate from a body the authority recognises. |
| UAE Ministry of Health and Prevention | Device and establishment registration in the United Arab Emirates asks for the manufacturer's ISO 13485 certificate as part of the technical file. |
| UN agencies through UNGM | ungm.org. One free registration covers UNICEF, UNDP, WFP, UNHCR, IOM and FAO. Medical supply lines are assessed on quality system and traceability. |
| KRG Approved Suppliers Center | asc.gov.krd. Annual registration. Certificates must come from a recognised conformity body to clear the quality criteria. |
Two tracks, you choose one
Certificate track
5 daysAn importer, distributor or service company that needs a valid certificate to complete a Ministry of Health file, to be appointed by a foreign manufacturer, or to answer a quality clause in a hospital tender before the deadline. We prepare the compliance system in five working days. The certification body then issues the certificate, and its calendar sits outside the five days.
Steps- We read the tender, the distribution agreement or the registration file on day one, and confirm the scope and the body the buyer accepts.
- We fix the scope by activity and device family on day one and record which clauses are excluded and the reason for each exclusion.
- We write the document set on day two and day three: quality manual, the procedures the standard names, the medical device file structure and the forms.
- We build the risk management file to ISO 14971 for the device families in the scope on day three.
- We write the complaint, regulatory reporting, advisory notice and recall procedures on day four, then trace one real lot forward and backward to prove they work.
- We train each process owner on day four in a half day session on the records that person keeps, including storage, receiving and complaint handling.
- We run the first internal audit and the management review on day five, then book the certification body. The body sets the stage 1 and stage 2 dates on its own calendar, and we prepare the site and attend both stages.
- The device quality system, complete in five working days
- Scope statement with every exclusion justified in writing
- Quality manual and the procedures the standard names
- Medical device file for each device family in the scope
- Risk management file to ISO 14971
- Complaint, regulatory reporting, advisory notice and recall procedures
- Traceability exercise record on a real lot, internal audit report and management review minutes
- The certification body booking and a three year surveillance and renewal calendar
Implementation track
6 to 14 weeksA manufacturer, or a distributor that is audited by the manufacturer that appointed it, that wants design, storage and complaint records to come from daily work and to hold up in a regulatory inspection.
Steps- We analyse what the company designs, makes, imports or services, and what the Ministry of Health and its buyers require, then send a proposal.
- We map every process with the people who run it and build the risk management file to ISO 14971 with them.
- We write the documentation in Arabic, Kurdish or English, including the medical device file for each device family.
- We validate the processes and the software the standard requires to be validated, from sterilisation to the stock and temperature systems, and record each validation.
- We train every department and hand the records over to the process owners.
- We let the system run live for three to four weeks so the certification body sees real receiving, storage, servicing and complaint records.
- We run the internal audit programme and the management review, then prepare the site and attend stage 1 and stage 2.
- Process map and a medical device file for each device family
- Full documented system in the working language
- Risk management file to ISO 14971 fed by production and post market data
- Process, sterilisation and software validation records
- Training and competence records for every department
- Three to four weeks of live receiving, storage and complaint records
- Supplier evaluation file and a complaint log with the regulatory reporting decision on each entry
- Internal audit programme, management review minutes and a three year surveillance calendar we run with you
The certification body issues the certificate.
The implementation track, week by week
| Phase | Weeks | What happens |
|---|---|---|
| Scope and regulatory requirements | Weeks 1 to 2 | We confirm the device families, the activities the certificate covers, the Ministry of Health obligations that apply, and which body the buyer accepts. |
| Process mapping and risk file | Weeks 2 to 4 | We sit with each department, map how the product moves, and build the risk management file to ISO 14971 with the people who handle it. |
| Documentation and device files | Weeks 3 to 7 | Quality manual, procedures, forms and a medical device file for each family, written in Arabic, Kurdish or English. |
| Validation | Weeks 6 to 9 | We validate the processes, the sterilisation where it applies, and the software used in the quality system, including stock, traceability and temperature monitoring. |
| Training and rollout | Weeks 8 to 10 | A session per department on the records that department owns, plus a session for management on the review and the reporting decisions. |
| Records running live | Weeks 9 to 12 | The system runs in daily operations for three to four weeks so there is real receiving, storage, servicing and complaint evidence for the auditor to sample. |
| Internal audit and management review | Weeks 12 to 13 | We run the first internal audit against every clause, trace one real lot in both directions, log the findings, and hold the management review with the owner. |
| Certification audit | Weeks 13 to 14 | The accredited body runs stage 1 on the documents and stage 2 on site, including the warehouse and the service workshop. We prepare the site, attend both, and answer the findings. |
What we do, what you do
We do
- Confirm the scope, the device families and the certification body the buyer accepts, before any work starts.
- Write the whole documented system, including the medical device file for each device family, in the language the company works in.
- Build the risk management file to ISO 14971 with the people who design, store or service the product.
- Write the complaint, regulatory reporting, advisory notice and recall procedures and test them on a real lot.
- Train the process owners and management on the records they have to keep.
- Run the first internal audit and chair the management review.
- Select certification bodies, collect their quotes, and book the audit dates.
- Prepare the site, attend stage 1 and stage 2, and write the corrective actions for every finding.
- Keep the surveillance and recertification dates in a calendar and prepare each audit.
You do
- Name one management representative who can give about five hours a week.
- Give us the distribution agreements, the device list, the Ministry of Health registrations, the import records and any procedures the company already keeps.
- Release each process owner for a half day of training and a half day for the internal audit.
- Carry out the storage items the standard requires, such as temperature monitoring and logging, segregation of returned and expired product, and controlled access to the store.
- Use the forms in daily work during the live period so the auditor sees real receiving, storage and complaint records.
- Have the owner or general manager attend the management review, which takes about two hours.
- Pay the certification body directly, or through us at cost with the receipts.
- Have the owner or general manager present at the opening and closing meetings of the certification audit.
What moves the price
- Number of sites and warehouses, and whether the auditor has to travel to Erbil, Sulaymaniyah, Baghdad or Basra.
- Whether the company designs devices or only imports, stores, distributes and services them, because design brings clause 7.3 into the audit and adds auditor days.
- Number of device families and their risk class, which sets the size of the risk management file and the number of medical device files.
- Whether sterile devices, implants or in vitro diagnostics are in the scope, which adds validation work and technical auditor time.
- Effective headcount, which sets the auditor days under the IAF MD 5 table with the medical device rules in IAF MD 9.
- Whether the certificate has to come from a body accredited under an IAF member or a locally accredited body is enough.
- Languages the documentation, the labels and the instructions for use are written in.
- How much usable documentation and how many validation records already exist in the company.
- Whether ISO 13485 is built alone or together with ISO 9001 as one system, and the number of findings at stage 2.
The proposal names the scope, the deliverables and the dates before work starts.
ISO 13485 questions we are asked
We prepare the compliance system in five working days on the certificate track. The implementation track runs six to fourteen weeks. The certification body then issues the certificate. Bodies serving Erbil and Baghdad set their own audit dates.
The proposal names the scope, the deliverables and the dates before work starts.
A certificate from a body accredited by IQAS, for example KQC in Erbil, is valid in Iraq and accepted for KRG lists. IQAS is not a member of the IAF Multilateral Recognition Arrangement. Foreign device manufacturers appointing a distributor, the Saudi Food and Drug Authority and the UAE Ministry of Health and Prevention normally require a body accredited under an IAF member, such as Bureau Veritas, SGS or TUV. We confirm which one the buyer accepts before any body is booked.
Kimadia, the State Company for Marketing Drugs and Medical Appliances under the federal Ministry of Health, supplies the state hospitals through public tenders and asks suppliers for the manufacturer's certificates and a quality system. KRG Ministry of Health procurement in Erbil, Sulaymaniyah and Duhok applies the same checks, and private hospital groups follow. Foreign manufacturers require the certificate before signing a distribution agreement. The KRG Approved Suppliers Center at asc.gov.krd renews registration each year. Most hospital buyers accept ISO 13485 on its own, and a company that also sells general equipment to the MNR Approved Vendor List at mnronline.com/avl keeps ISO 9001 for that scope.
No. ISO 13485:2016 certifies the company's quality management system. A CE mark under EU Regulation 2017/745 covers the device itself and is issued by a notified body, and the Iraqi Ministry of Health registers the device and the local agent separately. A quality system certificate is one input to those files. We prepare the system and tell you which of the 3 routes your product actually needs.
Three years from the date of issue. The certification body runs a surveillance audit each year and a recertification audit in year three. We keep those dates in a calendar and prepare the company for each one. If a surveillance audit is missed the body can suspend the certificate, and a suspended certificate will fail a Kimadia tender check and a list renewal at the KRG Approved Suppliers Center.
Yes. We work anywhere in Iraq, in Basra, Baghdad, Kirkuk, Erbil, Sulaymaniyah and Duhok, and in the Gulf. The office is in Erbil and the team travels to the site.
Business inquiry
Select a target. Two questions follow, and the file reaches the desk on WhatsApp. A reply comes within four working hours.