Medical device QMS requirements in India come down to one test. Can the manufacturer prove, with records, that every batch is made the way its procedure say? A Quality Management System (QMS) protects product quality and, through that, patient safety.
The Central Drugs Standard Control Organization (CDSCO) and State Licensing Authorities enforces the Medical Devices Rules, 2017 (MDR 2017). Its Fifth Schedule sets the QMS requirements for manufacturers. ISO 13485, the international QMS standard for medical devices, often sits beside. It is related but not interchangeable.
This guide covers what the Rules require, how ISO 13485 fits. It also covers which documents matter and how to build the system.
What Is a Medical Device QMS?
A medical device Quality Management System connects the processes, responsibilities and records a manufacturer uses to design, make, test, release and monitor a device. It keeps these activities consistent. It covers purchasing and production. It also covers testing, release, complaints and corrective action.
How does it differ from a general quality system? It must control risk to patients and meet regulatory requirements, not just satisfy customers. ISO 13485 places more weight than ISO 9001 on regulatory requirements, risk management and process validation.
A working QMS delivers:
- Consistency: the same process and the same result, batch after batch
- Traceability: a batch can be followed back to materials and forward to customers
- Risk Control: hazards are controlled
- Product Quality: defects are caught before release
- Regulatory compliance: evidence is ready when an auditor asks
A QMS connects procedures, responsibilities, records, risk controls, production, complaints and corrective actions. Each part must work with the others. A complaint must lead to action when needed. If it never does, the system is broken, no matter how well the SOPs are written.
What are the Medical Device QMS Requirements in India?
In India, the legal QMS requirement for a manufacturer is the Fifth Schedule of the Medical Devices Rules, 2017. QMS is defined as manufacturing requirement in that schedule. The schedule covers design and development, manufacture, packing, labelling, testing, installation and servicing. A manufacturer engaged in only some of these operations need only meet the requirements that apply to them.
At licensing, this works as follows:
- Applicants must file an undertaking that their manufacturing site meets the quality management system requirements (Fifth Schedule). For Class A (other than non- sterile, non measuring), it goes with the application documents. For Class C and D, it goes with the Device Master File and Plant Master File. CDSCO confirms it is mandatory.
- Every manufacturing site must comply with these requirements. These covers suitable premises and equipment, documented procedures, design and production controls, supplier controls, traceability, complaint handling and corrective and preventive action.
- Class B sites are audited by a Notified Body before the license is granted. Class C and D sites are inspected by a team of at least two Medical Device Officers or by a Notified Body.
- After the license is granted, license holder must keep meeting its ongoing conditions. These include keeping the premises and quality system in compliance, allowing inspections, maintaining records, reporting adverse events, carrying out recalls when needed, and informing the licensing authority of changes.
Medical devices in India are divided into four risk classes, A to D. CDSCO confirms that all medical devices are regulated under the Medical Devices Rules, 2017. Requirements depend on device and class.
Clean room classification requirements apply only to specific listed devices. Exemptions from licensing don’t remove the QMS. Facilities making Class A non sterile, non measuring devices and custom made devices must still conform to QMS requirements.
Two August 2026 changes matter. The Second Amendment (G.S.R.743(E)) added a label requirement for outsourced sterilization. The Third Amendment (G.S.R. 744(E)) added “Quality Management System” to the self certification for Class A non sterile, non measuring devices.
The QMS areas, in order that can be build:
Documentation → Management → Risk → Design → Purchasing → Production →
Testing → Nonconformity → CAPA → Audits → PMS
Key Components of a Medical Device QMS
This section covers what a QMS actually contains.
Quality Management and Documentation
The Schedule requires documented quality policy and measurable quality objectives, a quality manual, documented procedures and records. The quality manual must state the QMS scope, justify any exclusions, reference the procedures and describe how processes interact. Documents must be approved, signed and dated, and changes must leave change records.
Controlled documents specify what needs to be done through policies and procedures. Records show what happened through batch records and audit reports.
Risk Management
Risk Management means identifying hazards, analysing risk, applying controls and judging residual risk. Manufacturers must document their risk management process in their product realisation records. This process should follow IS or ISO 14971. Risk analysis outputs feed into design inputs. Design validation also includes risk analysis.
ISO 14971 explains how to carry out the process. The requirement is to follow that process. Certification to ISO 14971 is not required.
Design and Development Controls
Manufacturers that design their own devices must document their design procedures. These cover design inputs, outputs, review, verification, validation and change control. A design history file is also expected.
A manufacturer that carries out design in-house must record that scope in its quality management system. Product realization requirements that do not apply to the device can be left out.
Supplier and Purchasing Controls
Poor material in means a poor device out. The manufacturer must set criteria to select, evaluate and re-evaluate suppliers, keep the evaluation records, define purchasing information and verify purchased product. Outsourced processes stay the manufacturer’s responsibility. CDSCO also expects makers of components used in finished devices to qualify product standards and QMS. Since the Second Amendment, a manufacturer that outsources sterilization must show that site’s license number on the label, mandatory six months after the 14 August 2026 notification.
Production and Process Controls
Each batch needs a verified, approved batch record showing quantity made and quantity approved for distribution. Sterile devices need sterilization records traceable to each batch. Process validation applies where output can’t be verified by later monitoring or measurement. Documented traceability procedures define the extent and the records, with extra requirements for implantables. Measuring equipment is calibrated against standards traceable to the Bureau of Indian Standards (BIS) where available. Batch testing before release and reference-sample retention are required for invasive and in vitro diagnostic devices.
Nonconforming Product and CAPA
Nonconforming products must be identified and controlled. Procedures must be documented. Records of concessions must also be kept. Corrective and preventive actions each require a documented procedure. This must cover review, cause, action, records, and effectiveness checks. Corrective and Preventive Action (CAPA) is a closed loop. If the defect returns, CAPA has failed, even if the form is closed.
Internal Audits and Management Review
Internal audits run at planned intervals. The programme considers the importance of each process and previous results, and auditors can’t audit their own works. Organizations should establish an audit frequency based on process importance and precious audit results.
Management reviews also runs at planned intervals, uses audit, feedback, CAPA and regulatory change inputs and produces recorded decisions.
Complaint Handling and Post Market Surveillance
The manufacturer needs a feedback procedure, a procedure for advisory notices, complaint investigation records (or a documented reason for not investigating), and a procedure to notify adverse events to the regulator. Post Market Surveillance is define as systematic collection and analysis of information from marketed devices. A license holder must report a suspected unexpected serious adverse event, including any recall, within fifteen days. For license retention, CDSCO asks for five years of PMS data covering complaints and CAPA.
What Documents Are Required for a Medical Devices QMS?
Depending on the manufacturer’s activities and applicable requirements, a QMS needs two kinds of evidence. Documents describe what the company is supposed to do. Records demonstrate what the company actually did.
Named in the Fifth Schedule:
- Quality policy, quality objectives and quality manual
- Documented procedures for document control, record control, training needs, traceability, nonconforming product, internal audit, feedback, advisory notices, CAPA and risk management
- Batch records, calibration records, training records, supplier evaluation records, design records, complaint investigation records, audit and management review records
Required by the Rules as license application documents or license conditions:
- Fifth Schedule undertaking with the license application
- Plant Master File and Device Master File
- Manufacturing and sales records, and the inspection book in Form MD-11
- Test and retention-sample records
Does ISO 13485 Apply to Medical Device manufacturers in India?
For a manufacturing licence, ISO 13485:2016 certificate is not required. The legal requirement is Fifth Schedule compliance.
ISO 13485 is the international quality standard for medical devices. It helps companies consistently meet customer and regulatory requirements. The Fifth Schedule covers much of the same ground, so experience with ISO 13485 helps when you prepare for it.
But having an ISO 13485 certificate does not mean you will get a manufacturing license. The certificate only shows that an outside body has checked your quality system against the standard. It does not replace the Fifth Schedule requirements, and it does not approve your product.
Import is different. Importer submit a QMS certificate under the Fourth Schedule. The Schedule asks for a QMS, full quality assurance or production quality assurance certificate issued by the competent authority for the overseas site. The current requirement does not explicitly name ISO 13485.
| Concept | What it is |
Does it alone allow sales in India?
|
| CDSCO/MDR 2107 requirements | Indian law: Fifth Schedule, rules 20 to 23 |
No. Licensing is a separate step
|
| ISO 13485 (Standard) | International QMS standard | No |
| ISO 13485 certificate | Evidence of assessment against the standard |
No. Not required for manufacturing license
|
| Manufacturing license | Form MD-5/MD-6 (Class A/B) or MD-9/MD-10 (Class C/D) |
Yes, for the licensed devices and site
|
Do QMS Requirements Differ by Medical Device class?
Yes, QMS compliance verification differs, but the basic obligation remains the same. Every manufacturing site must meet QMS requirements. Rule 4 defines device classes, while Rule 8 divides licensing responsibilities between state and central authorities. The Central Licensing Authority alone classifies devices.
| Class | Risk (Rule 4) | Licensing (Rule 8) |
How QMS compliance is checked
|
| A (other than non sterile, non measuring) | Low | State Licensing Authority |
Fifth Schedule undertaking; no site audit before license; Notified Body audit after grant
|
| A (non sterile, non measuring) | Low | Online registration |
Facility must conform to QMS; manufacturer self certifies standards and QMS; records can be verified
|
| B | Low-moderate | State Licensing Authority |
Notified Body audit before license
|
| C | Moderate-high | Central Licensing Authority |
Inspection by two or more Medical Device Officers or a Notified Body
|
| D | High | Central Licensing Authority | Same as Class C |
How to Implement a Medical Device QMS in India
To implement a medical device QMS in India, work through eight steps:
Step 1: Identify the device and its class.
First, confirm that the product meets the medical device definition. Then fix its intended use, because the class depends on it. The class is checked against CDSCO’s published list, and only the Central Licensing Authority can classify a device.
Step 2: Identify applicable requirements.
List every requirement that touches your device and your activity. That means the relevant rules, the Fifth Schedule and the Fourth Schedule documents. Product standards are set out in rule 7. BIS standards come first, then ISO/IEC, and a validated manufacturer standard is used only where nothing else exists.
Step 3: Run a QMS gap assessment.
Compare what you do today with what the Fifth Schedule asks for. Put the SOPs, records and risk files side by side. A missing procedure is easy to spot. A missing record is harder. Every gap found should be logged, with an owner.
Step 4: Develop the documentation you need.
Write only what your operations need: the quality manual, required procedures, work instructions and forms. Design records are added where you design. Filler adds bulk, not control.
Step 5: Implement the processes.
Now the system has to run. Approved procedures are released to the floor, documents are controlled and records are kept. Changes go through change control, and traceability is maintained where it applies.
Step 6: Train people and keep records.
People work to the QMS, so they must understand it. Training needs are defined for each role, and competence is checked, not assumed. Education, training and experience records are kept for every person.
Step 7: Audit and review.
Audit your own system before someone else does. Internal audits are run at planned intervals, findings are closed out, and management review ties it together. The Schedule fixes no frequency. Set yours by process risk and past findings, and be ready to defend it.
Step 8: Prepare for licensing assessment.
Check the portal checklist, including the Fifth Schedule undertaking, Plant Master File and Device Master File. A Qualified technical staff is also required. Class B sites face a Notified Body assigned by the State Licensing Authority. Moving a manufacturing site in India triggers a fresh QMS inspection or audit. After licensing, it is a Medical Device Officer’s duty, subject to licensing authority instructions, to inspect licensed sites at least once a year.
Common Medical Device QMS Compliance Challenges
Most problems aren’t missing paperwork. They are mismatches. The usual mistakes includes:
- Treating the QMS as paperwork
- Copying generic ISO procedures
- SOPs nobody follows
- Weak risk documentation
- CAPA that closes without fixing anything
- Poor supplier controls
- Incomplete training records
- Weak complaint and PMS processes
- Poor audit readiness
A company can maintain extensive documentation and still have weak medical device QMS compliance if established procedures are not followed or records do not reflect actual practices. A QMS is effective only when documented procedures, actual practices and objective records are aligned.
Many manufacturers write SOPs first and test them against the production floor later. In practice, that leaves a gap between the documented QMS and what operators actually do. Running one real batch against the draft SOPs usually exposes it.
Conclusion
Medical device QMS compliance in India depends on meeting regulatory requirements, implementing documented processes, and maintaining objective evidence of compliance. The Medical Devices Rules, 2017 and CDSCO set the requirement through the Fifth Schedule. ISO 13485 helps you build the system, but it isn’t required for a manufacturing licence and doesn’t replace one. Compliance doesn’t end at approval. Your controls and records have to keep running.
Not sure if your QMS would hold up at a CDSCO audit or inspection? Connect with Artixio for a practical gap check on your QMS, documentation, ISO 13485 readiness and manufacturing licence preparation, tailored to your device and site. Reach out to us info@artixio.com.
FAQs
Q1. What is a medical device QMS in India?
It is the documented system a manufacturer uses to control how a device is made, tested, released and monitored. It links procedures, records, risk management and corrective action, and it supports patient safety. Indian law ties it to the Fifth Schedule of MDR 2017.
Q2. What are the QMS requirements under Medical Devices Rules 2017?
The Fifth Schedule (clauses 4 to 8) sets them. License applicants must show the site complies and file an undertaking. The medical device QMS requirements in India are then verified by Notified Body audit (Class B) or inspection (Class C/D). License holders must also meet the rule 26 conditions.
Q3. Is ISO 13485 mandatory for medical device manufacturers in India?
No, not for a manufacturing license. CDSCO’s FAQ says an ISO 13485:2016 certificate isn’t required. What is required is compliance with the Fifth Schedule, shown by an undertaking and then an audit or inspection. Importers submit a QMS certificate under the Fourth Schedule instead.
Q4. Do Class A medical devices require a QMS?
Yes. Class A devices other than non-sterile, non-measuring ones need a license, with a Fifth Schedule undertaking and a later Notified Body audit. For non-sterile, non-measuring devices, CDSCO says the manufacturing facility must conform to QMS requirements, and the August 2026 amendment adds QMS to the self-certification.
Q5. What documents are required for a medical device QMS?
Depending on your activities: the Fifth Schedule undertaking, quality policy and objectives, quality manual, document and record control procedures, batch and manufacturing records, the Plant and Device Master Files, plus procedures and records for risk, suppliers, training, CAPA, audits, complaints and PMS.
