ISO 13485 with Power IMS – which modules cover which chapters

What this is about

Medical device manufacturers already running Microsoft 365 sooner or later ask the same question: can an ISO 13485-compliant QMS be built on the existing platform – or is a dedicated MedTech system unavoidable? The honest answer: it depends on which modules of the Power IMS suite are used and where targeted extensions are required.

This article walks through the key modules and maps them to specific clauses of the standard – without compliance promises, but with a clear view of what works today and what is still missing.

Power QMS – the foundation

Power QMS directly covers the document- and process-control-heavy core of ISO 13485:

• Document control with versioning and mandatory comments (clauses 4.2.4 / 4.2.5): parallel approval workflows, complete version history, traceable change reasons
• Read confirmations as training and competence evidence (clause 6.2): every release generates evidence per employee and version
• Navigable process map (clause 4.1): tree structure instead of static Visio diagrams, every process linked to its controlled documents
• Multilingual controlled documents: relevant for DE/EN/FR sites operating on the same master version
• Audit trail (clause 4.2.5): versions, approvals, distributions and read confirmations directly exportable

Out of scope for Power QMS: CAPA, complaints and design controls – these are deliberately covered by other modules or extensions.

Power Audit – internal and supplier audits

For the audit-side requirements of the standard:

• Internal audits (clause 8.2.2): audit planning, checklists, findings, action tracking with a full audit trail
• Supplier audits (clause 7.4.1): scoreable audit cycles per supplier, including re-evaluation
• Audit reports as structured evidence for the notified body

Power CI – CAPA, complaints and continuous improvement (in development)

Power CI closes the gaps that are central for ISO 13485 in the corrective, preventive and complaint-handling space:

• CAPA process (clauses 8.5.2 corrective action / 8.5.3 preventive action): structured intake, root cause analysis, action definition and effectiveness verification
• Complaint handling (clause 8.2.2 of ISO 13485, MDR Art. 87): intake, evaluation, escalation and tracking of customer and market complaints
• Lessons learned and improvement suggestions (clause 8.5.1): low-threshold capture with a downstream evaluation and implementation workflow
• Linkage to Power QMS (controlled documents) and Power Audit (findings as CAPA triggers)

Important: Power CI is currently in development. Until it is generally available, we recommend a supplementary Power App or a third-party tool that can be migrated later.

Power Risk – risk management (coming soon)

ISO 13485 explicitly references risk-based thinking across the product life cycle, anchored in ISO 14971:

• Risk assessments with a configurable risk matrix
• Action tracking and periodic re-evaluation
• Linkage to processes from Power QMS and findings from Power Audit / Power CI

Power Risk is also coming soon. Until release, a supplementary solution (dedicated risk app or established third-party software) is required.

Power Knowledge – knowledge and competence management

Extends the read confirmations from Power QMS with a genuine competence dimension:

• Competence matrix and training evidence (clause 6.2)
• Onboarding paths for regulated roles, e.g. the Person Responsible for Regulatory Compliance (PRRC, MDR Art. 15)
• Training history with effectiveness assessment

Power Contract – contract management (coming soon)

Relevant for the supplier side of the standard:

• Supplier contracts and quality agreements (clause 7.4)
• Deadline and renewal management for regulated contracts
• Linkage to supplier evaluations from Power Audit

Power Safety & Power Maintenance – production environment

Often overlooked but relevant for ISO 13485:

• Power Safety: occupational safety, incident reporting – also covers requirements from clause 6.4 work environment
• Power Maintenance: maintenance of production-critical equipment – relevant for clause 6.3 infrastructure and clause 7.5.1 control of production and service provision

What Power IMS does not (yet) cover

Even with the full suite there are gaps that deliberately sit outside the Power IMS scope:

• Design controls / DHF / DMR / DHR (clause 7.3): Power QMS controls documents but does not replace a dedicated design control system
• Post-market surveillance / vigilance (MDR Art. 83 ff.): Power CI covers complaints but not full PMS reporting to authorities
• UDI management (MDR Art. 27): no UDI database integration in standard
• Software validation of the modules themselves (clause 4.1.6): for electronic records the software has to be validated – this requires a dedicated validation package

Recommended stack for ISO 13485

Pragmatic and stepwise:

• Power QMS as the core (documents, processes, training evidence)
• Power Audit for internal and supplier audits
• Power CI (once available) for CAPA and complaints
• Power Risk (once available) for ISO 14971
• Power Knowledge (once available) for competence management
• Power Maintenance & Power Safety for infrastructure and work environment
• Supplementary Power Apps or specialist tools for design controls, PMS reporting and UDI
• Microsoft Purview / compliance center for a complete tenant-wide audit trail

Conclusion

Power IMS provides a solid base infrastructure for an ISO 13485 QMS and, with Power CI, Power Risk and Power Knowledge, will close the currently open core requirements in the foreseeable future. The suite is not a turnkey 13485 package – design controls, PMS reporting and UDI management remain topics that need to be added explicitly.

For manufacturers with an existing Microsoft 365 landscape this is often the more pragmatic path than a parallel MedTech standalone system: data stays in the own tenant, the licence and permission model is already established, and the QMS core can go live in days rather than months.

If you want to know how your individual stack could look, book a meeting or first explore the modules in detail.