ISO 13485 Maturity · Medical Devices · Quality Management Systems
Your ISO 13485 quality system, measured process by process and turned into a costed action plan.
10 themes, a 5-level scale. And the action that moves each level to the next.
The framework’s 10 themes, already written from L1 to L5. One company, one business unit, or 300 at once.
ISO 13485 Maturity · Medical Devices · Quality Management Systems
10 themes, 5-level scale.
Nordhavn Industries
53 / 100
They measure their maturity with Datamensio
An example
This could be your situation.
Take one company as an example: three sites, three spreadsheets, no shared answer.
Nobody can consolidate.
Nordhavn Industries, 2,400 people in Hamburg, Lyon and Porto. A client asks where the group stands. Each site answers in its own spreadsheet, with its own scales.
Three weeks, a single base.
One ISO 13485:2016 assessment launched across all three sites at once, from the managers’ interview notes. The framework was already written, its 10 themes and levels L1 to L5 too.
Two costs avoided before being committed.
A score of 53 out of 100, with the gap concentrated on three themes. The AI companion spotted that two actions duplicated those of another audit. The committee report took one sentence to request.
What it saved them
- 3sites measured on the same base, instead of three questionnaires to reconcile
- 2duplicate actions caught before the spend
- 1committee report, with no manual rework
These figures are an example. They could be yours.
The standard imposes processes. Datamensio says where you stand.
01
The framework is already written
Themes, questions and levels L1 to L5, all written. You do not start from an empty spreadsheet.
02
The score lands the same day
Online, by self-assessment link or in interview. Theme by theme, comparable over time.
03
The gap becomes a costed plan
Every step up carries its action. The AI prioritises on expected effect, not on the order of the standard.
04
Progress can be demonstrated
Campaign after campaign, against your target and against your own past. That is what your board asks for.
The maturity scale
One level, the next, and the action that links the two.
This mechanism (one level, the level above, and the action linking the two) is what turns an observation into a trajectory.
Are special processes, whose results cannot be verified by subsequent monitoring, validated and revalidated after modification?
- N1
No formal identification of special processes. Control relies on operator experience and final inspections.
- N2
Special processes are identified and an initial validation exists for some of them. Modifications do not systematically trigger revalidation.
- N3
Each special process has a documented validation protocol, with acceptance criteria and a report. Any modification goes through an impact analysis before returning to production.
- N4
Revalidations are triggered by the change management process, tracked and linked to the medical device file. Critical parameters are subject to continuous monitoring.
- N5
Process monitoring data feeds into a periodic review of the validation plan, with a documented reassessment of acceptance criteria and validation states.
Action to move from L2 to L3
Link revalidation to the change management process: add an impact analysis on validated processes to the change request form, and rule on each request in a weekly change review before any return to production.
« With Datamensio, we meet our objectives far more efficiently. The ERDF inspection services and our supervising ministry particularly appreciated an approach that gives them reliable data. »
Director, CCI 94CCI Île-de-France
« We believe this is the most suitable solution to scale our transformation project and measure impact according to our needs. »
Maja SucekChief Operating Officer, Interreg Danube
Rarely on its own
Frameworks combine. Put several together to cover your business, or have the AI write yours.
Take your first measurementon ISO 13485.
What this framework covers
ISO 13485:2016 sets out the requirements for a quality management system for organisations that design, produce, install, distribute or service medical devices, as well as for their service providers. The standard follows a process based structure and adds sector specific requirements: stronger document control, the medical device file, risk management throughout realisation, process and software validation, traceability, product cleanliness, post market activities and complaint handling. Unlike ISO 9001, customer satisfaction is not the guiding objective here: product safety and compliance with regulatory requirements are.
In practice, the difficulty does not lie in the text but in keeping it alive over time. The system exists, built for certification, and then it evolves at the pace of product changes, supplier changes and staff turnover. The recurring questions are concrete. Does risk management under ISO 14971 genuinely feed into design and production, or does it remain a file reopened once a year? Are special process validations revalidated after modification, or inherited from the initial state? Do complaints and post market surveillance data flow back into design, or do they stop at case by case handling?
The European regulatory context has shifted the centre of gravity. Regulation 2017/745 on medical devices and Regulation 2017/746 on in vitro diagnostic medical devices have raised expectations on clinical evaluation, post market surveillance, the surveillance plan and the person responsible for regulatory compliance. The amended version EN ISO 13485:2016/A11:2021 establishes correspondence with these regulations. A common confusion persists: ISO 13485 certification is not equivalent to CE marking. It prepares the assessment by the notified body, it does not replace it.
The maturity assessment answers a different question from the certification audit. The audit concludes with conformity, a minor non-conformity or a major one. The assessment places each process on a progressive scale and points to the action that moves it up a level. A system can be compliant on paper and fragile in practice, because it rests on two people or on an unwritten practice. The maturity level exposes this fragility before the audit, and allows several sites or business units to be compared on the same grid.
In Datamensio, the framework is ready to use and remains yours. You adjust the themes, questions and levels according to your scope, device class and role in the supply chain. AI refines the level descriptions using the CMMI method, or builds a variant from your quality manual and existing procedures.
Reference standard: ISO 13485:2016
The themes assessed
Quality management system and documentation
Quality manual, scope and justified exclusions, control of documents and records, medical device file, control of software used within the system.
Management responsibility
Quality policy and objectives, management representative, management review, definition of roles and internal communication.
Resource management and competence
Staff qualification and training, infrastructure, work environment, contamination control and product cleanliness conditions.
Realisation planning and risk management
Alignment with ISO 14971, application of risk throughout product realisation, acceptability criteria, updating the risk management file.
Design and development
Planning, inputs and outputs, reviews, verification, validation, transfer to production, control of changes and design file.
Purchasing and supplier control
Evaluation and selection criteria, performance monitoring, quality agreements, verification of purchased product, management of supplier changes.
Production and service provision
Production control, validation of special processes and production software, identification and traceability, preservation, installation and servicing activities.
Control of monitoring and measuring equipment
Inventory, calibration and verification, management of observed deviations, validation of measurement software.
Post market surveillance and complaints
Feedback, complaint handling, reporting to competent authorities, vigilance, field safety corrective actions.
Measurement, analysis and improvement
Internal audits, control of non conforming product, data analysis, corrective and preventive actions, closure timelines and effectiveness verification.
A short version of the framework is available for the online self-assessment.
Frequently asked questions
Does the assessment deliver ISO 13485 certification?
No. Certification is granted by an accredited body, following an audit. The assessment measures the maturity of your system, identifies gaps and produces the action plan that prepares for that audit.
What is the difference between a maturity assessment and a certification audit?
The audit concludes with conformity or a non-conformity, minor or major. The assessment places each process on a progressive scale and specifies the action that moves it to the next level. The two complement each other: the assessment prepares and prioritises, the audit validates.
Is ISO 13485 enough for CE marking?
No. Regulation 2017/745 and Regulation 2017/746 impose their own obligations, notably on clinical evaluation, post market surveillance and the person responsible for regulatory compliance. A solid ISO 13485 system forms the foundation of the file, it does not replace the conformity assessment procedure.
How long does the assessment take?
The short version can be completed in a single working session. The full version, run collaboratively with process owners, typically spans one to two weeks, with most of the time spent gathering evidence from the design, production and regulatory affairs teams.
Can the framework be adapted to our scope?
Yes. You can amend the questions, levels and themes according to your role in the chain, manufacturer, subcontractor or distributor, and according to device class. AI can also build a variant from your quality manual and procedures.
How can several production sites be compared?
Each site is assessed against the same framework, which makes scores comparable by theme. The benchmark across business units highlights differences in practice, and a cross site roadmap consolidates common actions rather than duplicating them site by site.
Is regulatory expertise needed to answer?
The questions focus on quality management practices, not on the technical content of files. A quality manager or an internal auditor can answer them. Questions relating to design or regulatory affairs can be assigned to the right contributor in collaborative mode.
Where is the data hosted?
In France, with OVH, backed up with Scaleway. No transfer outside the European Union. The AI models used can be selected, including from European providers.