医疗相关 ISO 标准准备与证据整理

正文

references/source-ledger.md

Research baseline: 2026-10-01. This refresh directly read official ISO catalogue metadata, FDA/eCFR, MDSAP, Global ACI, CMS/CAP, and Commission sources. It replaces the July 2026 baseline. Retrieval exceptions are recorded below; search-indexed metadata is not a controlled requirements source.

Purpose: version baseline for evidence preparation; not an applicability decision, certification or accreditation criteria, or a substitute for controlled source copies. No proprietary standard text is reproduced. Recheck time-sensitive sources before operational use, and obtain authorized standards and scheme documents.

ISO standards and copyright

ISO 13485:2016

Official page: ISO 13485:2016
Verified metadata: Edition 3; publication date 2016-03; stage 90.93 (confirmed); confirmation recorded 2025-10-31.
Use: identifies the current international edition and lifecycle status.
Limitation: the ISO page is not the complete normative text. Obtain an authorized copy.

EN ISO 13485:2016/A11:2021 distinction

Current Commission index: Harmonised standards
Current MDR decision: Consolidated Decision (EU) 2021/1182, 2026-06-17
IVDR amendment decision: Decision (EU) 2022/729
Commission summary lists for both MDR and IVDR, generated 2026-06-17, directly confirmed EN ISO 13485:2016, AC:2018, and A11:2021. A11:2021 is a European EN amendment, not an ISO international “Amendment 1:2021.”
Evidence: MDR summary source page and IVDR summary source page. The linked PDF contents were read; their filenames retain older dates. Direct EUR-Lex decision retrieval returned an access challenge. Commission summaries have no independent legal effect.
Limitation: verify the latest OJEU citation and the exact requirements for which presumption of conformity is claimed; use of harmonised standards is not a blanket product-conformity decision.

ISO 14971:2019 and European A11

Official page: ISO 14971:2019
Verified metadata: Edition 3; publication 2019-12; stage 90.93, confirmed 2025-03-07.
EU source: Decision (EU) 2022/757
Verified fact: the Commission MDR and IVDR summary PDFs cited above both list EN ISO 14971:2019/A11:2021. A11 is European; it does not change the international ISO 14971 normative part.
Limitation: risk-management evidence remains product- and jurisdiction-specific.

ISO/TR 24971:2020

Official page: ISO/TR 24971:2020
Verified catalogue metadata: Edition 2, published 2020-06; remains the published guidance companion to ISO 14971:2019. Stage 90.92 (to be revised), 2026-07-06.
Proposed successor: ISO/AWI TS 24971-1, stage 20.00 (new project registered). This is an approved work item under development, not a published replacement, amendment, or new normative requirement.
Verified status: a Technical Report. Its guidance is informative, not normative, and conformity is claimed to ISO 14971, never to ISO/TR 24971.
Limitation: a TR cannot be used to relax or reinterpret a normative requirement. Record which guidance the organization adopted and why.

ISO/IEC 17025:2017

Official page: ISO/IEC 17025:2017
Landing page: ISO/IEC 17025 — Testing and calibration laboratories
Verified catalogue metadata: Edition 3, published 2017-11, confirmed 2023-08-18; no successor edition identified. Listed 2018 corrections concern French and Spanish versions, not a replacement English edition.
Use: identifies the current edition for laboratory competence work.
Limitation: use laboratory accreditation as the assurance lane here; a private certificate or an ISO 9001 certificate does not establish ISO/IEC 17025 accreditation. Accreditation is granted by an accreditation body for a defined scope of laboratory activities; nothing in this skill grants or predicts it.

ISO 15189:2022

Official page: ISO 15189:2022
ILAC announcement: ISO 15189:2022 for medical labs published
Verified metadata: Edition 4; published December 2022; cancels and replaces ISO 15189:2012. Catalogue lists ISO 15189:2012 and ISO 22870:2016 as withdrawn.
Verified structural facts: the 2022 edition aligns structurally with ISO/IEC 17025:2017 and incorporates point-of-care testing requirements previously held in ISO 22870. Scheme coverage can still be narrower: CAP 15189 excludes POCT.
Verified transition: the ILAC-agreed transition period for accredited medical laboratories ran to December 2025. Treat the 2022 edition as implemented, not upcoming; a 2012-based quality system is out of date, not "in transition."
Limitation: accreditation scope is per laboratory, per location, and per examination. It is not organization-wide and not equivalent to licensure.

ISO copyright

Official page: ISO copyright
Verified fact: ISO publications are copyright protected; unauthorized copying, scanning, or distribution is prohibited, and reproduction requires permission.
Operational rule: this skill summarizes processes and bibliographic metadata only. Do not paste or generate copyrighted clause text.

United States: FDA QMSR

Final rule

Source: Medical Devices; Quality System Regulation Amendments
Citation/date: 89 FR 7496; published 2024-02-02.
Verified effective date: 2026-02-02.
Verified boundary: ISO certification does not exempt a manufacturer from FDA inspection; FDA does not issue ISO 13485 certificates.
Correction: 2024 correction.
Later source: 2025 QMSR technical amendments. Use the current eCFR rather than reconstructing current requirements from the original final rule alone.

FDA QMSR landing page

Source: Quality Management System Regulation (QMSR)
Page update: 2026-02-02.
Verified current state: QMSR became effective 2026-02-02; it incorporates ISO 13485:2016 and ISO 9000:2015 Clause 3 by reference, with FDA provisions and other applicable FDA requirements controlling as stated in the regulation.
Verified inspection transition: FDA stopped using QSIT and began the inspection process in Compliance Program 7382.850 on 2026-02-02.

Current eCFR

Source: 21 CFR Part 820
Verified current title: Quality Management System Regulation.
Verified current structure: Subpart A contains current general provisions; Subpart B contains supplemental provisions; remaining legacy subparts are reserved.
Verified incorporation: ISO 13485:2016(E), Third edition, March 1, 2016, and ISO 9000:2015 Clause 3.
Operational rule: use the current eCFR and linked current regulations. Do not use the former QSR section structure as a current requirements map.
Limitation: eCFR is continuously updated and authoritative but unofficial; consult official CFR/Federal Register publications when legal status matters.

FDA QMSR FAQ

Source: QMSR Frequently Asked Questions
Page update: 2026-02-02.
Verified implementation status: FDA began enforcing QMSR on the effective date.
Verified records point: FDA investigators may review QMS records created before 2026-02-02. The former exemption for management-review, quality-audit, and supplier-audit reports was not retained.
Verified boundary: FDA QMSR inspections do not follow the MDSAP audit plan; an ISO certificate does not replace or prevent FDA inspection.
Verified access: FDA points to ANSI read-only IBR access for incorporated standards.

Current inspection program

Source: Inspection of Medical Device Manufacturers Compliance Program 7382.850
Effective date: 2026-02-02.
Verified use: current FDA inspection process aligned to QMSR; QSIT and the superseded device inspection programs are no longer used.
Supplemental education: April 2026 FDA town hall.
Limitation: prepare evidence for actual applicable FDA requirements; this skill does not predict inspection scope, classification, or enforcement outcome.

MDSAP and IMDRF

Current MDSAP Audit Approach

Source: MDSAP Audit Approach
Current document: MDSAP AU P0002.011.
Version date: 2026-08-03, confirmed in the current 171-page document.
Verified high-level model: process-based regulatory audit by recognized Auditing Organizations, with four primary process areas, supporting purchasing linkages, a risk-management foundation, jurisdiction-specific requirements, and a three-year audit cycle.
Direct document: AU P0002.011 PDF. Its URL directory is not its version date. The former .010 baseline is superseded.

MDSAP program and IMDRF foundation

Current program site: MDSAP.global
IMDRF background: IMDRF MDSAP working group
FDA program page: Medical Device Single Audit Program
Verified status: IMDRF development work moved to implementation; current MDSAP documents are managed on MDSAP.global.
Boundary: an MDSAP audit is not generic ISO certification, an FDA inspection plan, or EU notified-body conformity assessment.

European Union: MDR, IVDR, and MDCG

MDR

Source: Regulation (EU) 2017/745, consolidated 2026-07-19
Official EUR-Lex search-indexed metadata identifies the current consolidation as 2026-07-19. Direct retrieval of consolidated legal text returned an access challenge; the contents and any changes since the earlier baseline were not independently assessed in this refresh.
Relevant scope for this skill: manufacturer QMS, technical documentation, conformity assessment, notified bodies, postmarket surveillance, vigilance, and market surveillance.
Limitation: consolidated texts are documentation tools; authentic acts are those published in the Official Journal.

IVDR

Source: Regulation (EU) 2017/746, consolidated 2025-01-10
Official EUR-Lex search-indexed metadata still identifies 2025-01-10 as the current consolidation. Direct legal-text retrieval returned an access challenge; this is metadata verification only, not a fresh review of every operative provision.
Relevant scope for this skill: IVD QMS, technical/performance documentation, conformity assessment, notified bodies, postmarket surveillance, vigilance, and market surveillance.
Limitation: transitional provisions and device-specific deadlines require current, authorized analysis; this skill does not calculate them.

MDCG guidance

Source: MDCG endorsed documents and other guidance
Verified legal status: MDCG guidance is not legally binding; it expresses a common implementation understanding and is regularly revised or archived.
Relevant current item: MDCG 2025-10, post-market surveillance, published December 2025.
Other items must be selected by device, role, transition, and conformity route.

Notified bodies, certification, and accreditation

EU notified bodies

Commission overview: Notified bodies for medical devices
Official list: NANDO
Verified boundary: Member States designate and notify bodies for defined legislation, conformity-assessment tasks, and product/designation codes. NANDO lists the current notified scope.
Operational rule: verify legislation, annex/task, and designation-code scope. Accreditation or ISO certification alone is not notified-body designation.
Retrieval limit: NANDO returned a JavaScript shell; no individual body's current designation was verified. Resolve that scope in the live registry for the actual case.

ISO 13485 certification-body accreditation

Current Global ACI documents: Global ACI document library
Current cross-reference: Global ACI–IAF/ILAC table, version 14.0, 2026-09-14
Published replacements: Global ACI-TECH-3-006 (M) replaces IAF MD 8:2023; Global ACI-TECH-3-007 (M) replaces IAF MD 9:2023. Both are version 1.0, issued 2026-07-10 with library implementation date 2026-08-28. The former June table's “in process” status is no longer current.
Boundary: these documents address accreditation/certification bodies applying ISO/IEC 17011 or ISO/IEC 17021-1 for ISO 13485 certification. They do not establish product conformity, notified-body designation, regulatory applicability, or market authorization. Check the current scheme and issuer's scope for the actual case.

Accreditation: GLOBAC and the recognition arrangement

Launch announcement: Global Accreditation Cooperation Incorporated launch
Transition guidance: Specifying use of GLOBAC accreditation
Verified transition: Global Accreditation Cooperation Incorporated commenced full operations on 2026-01-01, bringing together the former ILAC and IAF and launching its own Multilateral Recognition Arrangement. Certificates and accredited results issued under the former IAF MLA / ILAC MRA continue to be recognized during the transition.
Operational rule: check the current recognition-arrangement wording, logo rules, and document designations before reproducing any accreditation claim in a document. Legacy "ILAC MRA" / "IAF MLA" phrasing may be transitional rather than current.
Boundary: recognition arrangements concern accreditation bodies. They do not make an accredited result a regulatory approval or a product conformity decision.

Accreditation: traceability and decision-rule policy

Use the current Global ACI library and September cross-reference above together:

Topic	Current document at review	Legacy document / status
Metrological traceability	ILAC P10:07/2020, implementation July 2021	Proposed Global ACI-TECH-1-011 remains “in process”
Decision rules and statements of conformity	Global ACI-TECH-1-002 (G), v1.0, issued/implemented 2026-06-26	Replaces ILAC G8:09/2019
Calibration uncertainty and CMCs	Global ACI-TECH-1-009 (M), v1.0, issued/implemented 2026-06-26	Replaces ILAC P14:09/2020

Prior archive: ILAC policy series. Do not infer current designations from the legacy archive alone.
Metrological companion: BIPM JCGM publications still lists JCGM 106:2012, The role of measurement uncertainty in conformity assessment (also published as ISO/IEC Guide 98-4:2012).
Boundary: documenting a decision rule does not establish its fitness for the customer's purpose. These local tools neither compute uncertainty nor decide conformity. Check controlled scheme requirements before adopting a policy.

United States medical laboratories: CLIA is a separate lane

CMS program: CLIA.
Applicability: 42 CFR 493.3 covers applicable clinical testing; it explicitly exempts research laboratories that do not report patient-specific results for diagnosis, prevention, treatment, or assessment of health. Do not state that every US laboratory handling human specimens requires CLIA certification. Other exceptions and state rules require case-specific review by the authorized owner.
Current CMS overview: Certification, accreditation, and test complexity.
Approved accreditation organizations: CMS specialty/subspecialty list. Verify the actual approved program and scope; do not infer deemed status from an organization's name or from ISO 15189 itself.
Program-specific evidence: CAP 15189 accreditation process requires CAP Laboratory Accreditation Program participation, excludes POCT, and requires a quality manual even though ISO 15189:2022 itself does not require one.
Operational rule: keep ISO 15189 readiness, CLIA certification/deemed status, licensure, and inspection outcomes separate. Authorized laboratory and compliance owners determine the applicable route.

Citation API and local-tool boundary

The shared citation footer links an arXiv record; none of this skill's scripts calls a network API. The arXiv API manual documents the public GET https://export.arxiv.org/api/query endpoint, an id_list query parameter (comma-separated IDs), and an Atom XML response, without credentials or a request body. Pagination uses start (default 0) and max_results (default 10). An unversioned ID resolves to the latest version. On the review date a read-only GET with id_list=2609.00065 returned the expected 2609.00065v2 record; the footer's HTTP endpoint redirected to HTTPS. This verifies citation metadata, not the paper's scientific claims. Publisher websites, document downloads, and NANDO above are source links, not APIs implemented by these local tools.

Verification limits

Official catalogue metadata was directly available in this refresh; the former “confirm on iso.org” retrieval limitation is resolved. Full normative standards were neither copied nor used to derive a clause-by-clause compliance checklist.
Current Commission summary PDFs and guidance were read. EUR-Lex consolidation dates were only verified through official indexed metadata after access challenges; obtain and assess the operative legal text before relying on a transition or deadline.
NANDO entity-level designation and organization-specific accreditation recognition were not tested. No certificate, laboratory, device, or organizational evidence was assessed for conformity. Local tests use synthetic records.