Achieving Medical Device Status: The Critical Path of ISO 13485 Compliance for Antimicrobials

Why ISO 13485 Compliance Matters for Antimicrobial Products

When a clinician reaches for an antimicrobial wound spray, they are not just selecting a product—they are placing trust in a system. That system, whether they realise it or not, is underpinned by ISO 13485 compliance: the international quality management standard purpose-built for medical devices. For companies like Spray8, achieving and maintaining this certification is not a box-ticking exercise. It is the structural backbone that determines whether a product can be marketed as a medical device, whether regulators will accept it, and whether healthcare professionals will integrate it into their protocols.

ISO 13485:2016 sets out the requirements for a quality management system (QMS) where an organisation needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and regulatory requirements. Unlike ISO 9001, which is general-purpose, ISO 13485 is prescriptive, risk-aligned, and deeply embedded in the regulatory frameworks of markets ranging from the EU (MDR 2017/745) to the FDA’s 21 CFR Part 820.

For antimicrobial products—particularly those utilising active ingredients like hypochlorous acid (HOCl)—the pathway to medical device status demands rigorous documentation, validated manufacturing processes, clinical evidence, and post-market surveillance. This article walks through that critical path, drawing on peer-reviewed research and real-world regulatory experience.

Understanding the Regulatory Landscape for Antimicrobial Medical Devices

Classification Challenges for Antimicrobial Sprays

One of the first hurdles any antimicrobial manufacturer faces is classification. Is the product a medical device, a biocidal product, a cosmetic, or a pharmaceutical? The answer depends on the primary mode of action, the intended purpose claimed, and the jurisdiction in question.

In the European Union, products intended to prevent, diagnose, monitor, treat, or alleviate disease through pharmacological, immunological, or metabolic means fall under the medicinal product directive. However, products whose principal intended action is achieved by physical means—such as a wound cleansing spray that creates a barrier or delivers an antimicrobial agent through a physical mechanism—may be classified as medical devices under the Medical Device Regulation (MDR).

This distinction is critical. A product like Spray8’s wound care range, which utilises HOCl delivered through a spray mechanism for wound management, must navigate this classification carefully. The intended use claim on the label, the mechanism of action, and the anatomical site of application all feed into the classification decision.

The Role of ISO 13485 in Market Access

ISO 13485 certification is not merely recommended—it is functionally mandatory for market access in most regulated markets. The standard provides a framework for managing quality across the entire product lifecycle, from design and development through production, installation, and servicing.

Research published in peer-reviewed literature has demonstrated that organisations implementing ISO 13485-aligned QMS frameworks show measurable improvements in product consistency, complaint handling efficiency, and regulatory audit readiness (PMID: 26776882). For antimicrobial manufacturers, where batch-to-batch consistency of active ingredient concentration directly impacts safety and efficacy, these system-level controls are non-negotiable.

Building a Quality Management System Under ISO 13485

Design Controls and Risk Management (ISO 14971 Integration)

ISO 13485 does not operate in isolation. Clause 7.3 on design and development dovetails directly with ISO 14971, the risk management standard for medical devices. For an antimicrobial spray, this means:

• Design inputs must be clearly defined: intended use, target population, mechanism of action, concentration specifications, shelf life requirements, and packaging compatibility.
• Design outputs must be verified against inputs through testing—antimicrobial efficacy (e.g., log reduction values per EN 13727), cytotoxicity (ISO 10993-5), and skin irritation (ISO 10993-10).
• Risk analysis must identify hazards—microbial contamination during manufacture, degradation of active ingredient over time, user error in application—and implement controls to mitigate them to acceptable levels.

A 2019 analysis of medical device regulatory submissions found that inadequate risk management documentation was among the top three reasons for regulatory submission delays, particularly for Class II devices where antimicrobial claims require robust clinical evidence packages (PMID: 31089024).

Process Validation and Manufacturing Controls

Once the design is locked, the manufacturing process must be validated. For antimicrobial products, this typically involves:

• IQ/OQ/PQ (Installation/Operational/Performance Qualification) of production equipment
• Environmental monitoring of cleanroom or controlled manufacturing areas
• Batch record documentation ensuring traceability from raw material to finished product
• Stability testing confirming that the antimicrobial agent maintains its labelled concentration throughout the claimed shelf life

ISO 13485:2016, Clause 7.5.6, requires that organisations validate any processes where output cannot be verified by subsequent monitoring or measurement. For antimicrobial manufacturing—where the absence of contamination cannot be confirmed without destructive testing—this clause drives significant investment in in-process controls and environmental monitoring.

Supplier Management and Incoming Quality Control

Clause 7.4 of ISO 13485 addresses purchasing and supplier management. For antimicrobial products, key suppliers typically include active ingredient manufacturers, packaging component suppliers, and contract sterilisation services. Each must be:

• Evaluated and approved against defined criteria
• Subject to ongoing monitoring through audit schedules and incoming inspection data
• Managed through a documented supplier quality agreement that specifies change notification obligations

A failure in supplier management can cascade rapidly. If a raw material specification drifts outside acceptable tolerances, the antimicrobial efficacy of the final product may be compromised—yet without robust incoming inspection and supplier oversight, the issue may not be detected until post-market surveillance flags an increase in adverse event reports.

Clinical Evidence Requirements for Antimicrobial Medical Devices

Generating the Evidence Package

ISO 13485:2016, Clause 7.3.6, requires design verification and validation activities that confirm the product meets user needs and intended uses. For antimicrobial wound care products, this translates into a clinical evidence package that may include:

• In vitro efficacy studies: Minimum inhibitory concentration (MIC) testing, time-kill assays, and zone of inhibition studies against clinically relevant organisms (MRSA, Pseudomonas aeruginosa, Escherichia coli, Candida albicans).
• Biocompatibility testing: Per ISO 10993 series—cytotoxicity, sensitisation, and irritation studies.
• Clinical investigations or literature reviews: Depending on the classification and regulatory pathway, either a formal clinical investigation or a systematic literature review demonstrating safety and performance.

Research on medical device clinical evidence generation has highlighted that the quality of clinical data is directly correlated with regulatory approval timelines. Studies with well-defined endpoints, appropriate statistical power, and transparent reporting of adverse events move through review processes significantly faster than those with methodological gaps (PMID: 28931442).

Post-Market Surveillance and Vigilance

ISO 13485 certification is not a one-time achievement. Clause 8.2.1 through 8.2.4 establish requirements for feedback, complaint handling, and post-market surveillance. For antimicrobial medical devices, this means:

• Establishing a system for collecting and analysing complaints, adverse events, and near-misses
• Conducting trend analysis to identify systemic issues before they become widespread safety concerns
• Reporting serious incidents to relevant competent authorities within mandated timeframes
• Feeding post-market data back into the risk management file and, where necessary, triggering design changes or field safety corrective actions (FSCAs)

The EU MDR has significantly strengthened post-market surveillance requirements, mandating periodic safety update reports (PSURs) for Class IIa and above devices. For manufacturers of antimicrobial products sold in European markets, this represents an ongoing resource commitment that must be budgeted and staffed from the outset.

Common Pitfalls in ISO 13485 Implementation for Antimicrobial Manufacturers

Documentation Gaps and Inadequate Change Control

The most frequently cited finding in ISO 13485 audit reports is inadequate change control. When a formulation is modified, a supplier is changed, or a manufacturing process is adjusted, the impact on product safety and performance must be assessed, documented, and approved before implementation. Too many organisations treat change control as an administrative formality rather than a risk management tool.

Insufficient Validation of Software and Automated Systems

Modern manufacturing environments rely heavily on software—from ERP systems managing batch records to SCADA systems controlling production equipment. ISO 13485:2016, Clause 4.1.6, requires validation of software used within the QMS. This includes:

• Manufacturing execution systems (MES)
• Laboratory information management systems (LIMS)
• Document management systems
• Statistical analysis software used for stability trending

Failure to Integrate Regulatory Strategy with Quality Strategy

Quality management and regulatory affairs must function as integrated disciplines. A QMS designed without input from regulatory experts may fail to address jurisdiction-specific requirements—for example, the FDA’s unique device identification (UDI) requirements, or the EU’s EUDAMED database obligations. For companies marketing antimicrobial products across multiple geographies, the QMS must be flexible enough to accommodate divergent regulatory expectations.

Spray8’s Approach to Quality and Compliance

At Spray8, the commitment to ISO 13485 compliance is embedded in every stage of product development and manufacturing. From raw material qualification through finished product release, every batch is tested, every process is validated, and every deviation is investigated.

The wound care product line exemplifies this approach. Each formulation undergoes comprehensive efficacy testing against clinically relevant pathogens, biocompatibility assessment per ISO 10993, and stability validation ensuring consistent antimicrobial activity throughout the product’s shelf life. The manufacturing environment is controlled, monitored, and subject to regular internal and external audit.

For consumers and healthcare professionals exploring antimicrobial solutions for skin health, the skin treatment range offers products developed under the same rigorous quality framework. Whether the application is acute wound management, post-procedural skin care, or chronic wound support, the underlying quality system ensures that every product performs as intended, every time.

Frequently Asked Questions

What is ISO 13485, and why does it matter for wound care products?

ISO 13485 is the international standard for quality management systems specific to medical devices. It ensures that products are designed, manufactured, and distributed consistently and safely. For wound care products, this means verified antimicrobial efficacy, confirmed biocompatibility, and reliable manufacturing quality.

How long does it take to achieve ISO 13485 certification?

Implementation timelines vary, but most organisations require 12 to 18 months to build, implement, and mature a QMS to the point where it is ready for third-party certification audit. This includes document creation, process validation, internal audits, management review, and corrective action closure.

Is ISO 13485 certification required to sell medical devices?

While not always explicitly named in every regulation, ISO 13485 certification is effectively required for market access in most regulated markets. The EU CE marking process, Health Canada licensing, and TGA registration in Australia all expect or require a QMS that meets ISO 13485 or equivalent standards.

What is the difference between ISO 13485 and ISO 9001?

ISO 9001 is a generic quality management standard applicable to any industry. ISO 13485 is specific to medical devices and includes additional requirements for regulatory compliance, risk management, design controls, traceability, and post-market surveillance. Organisations in the medical device sector typically implement ISO 13485 rather than ISO 9001.

How does ISO 13485 compliance benefit end users?

For patients and clinicians, ISO 13485 compliance provides assurance that the product has been rigorously tested, manufactured under controlled conditions, and is subject to ongoing post-market monitoring. It reduces the risk of defective products reaching the market and ensures that any safety issues are detected and addressed promptly.

Can a product be both a medical device and a biocidal product?

Yes, in some cases. The classification depends on the primary mode of action and the intended purpose as claimed by the manufacturer. A product intended to physically cleanse a wound with an antimicrobial agent delivered via spray mechanism may be classified as a medical device, whereas the same chemical intended to disinfect surfaces would fall under the Biocidal Products Regulation. Regulatory advice should be sought early in product development.

Conclusion: Quality as a Competitive Advantage

Achieving ISO 13485 compliance is neither quick nor inexpensive. It demands investment in people, processes, documentation, and culture. But for antimicrobial manufacturers committed to building trust with healthcare professionals and patients, it is the only credible path forward.

The regulatory environment is tightening globally. The EU MDR has raised the bar for clinical evidence and post-market surveillance. The FDA is increasingly harmonising its QMS requirements with international standards. Competent authorities are conducting more frequent and more rigorous inspections. In this environment, a robust ISO 13485 QMS is not just a compliance tool—it is a competitive advantage.

For Spray8, quality is not a department. It is a discipline that runs through every function—from R&D to manufacturing to customer service. It is what makes it possible to deliver antimicrobial products that clinicians trust and patients rely on, day after day.