What they are and why they matter more in 2026

  • ISO 13485:2016 sets quality management system requirements for medical devices.
  • ISO 14971 sets requirements for applying risk management to medical devices.

For US companies, ISO 13485 became part of US law in practice on 2 February 2026, when FDA’s QMSR took effect and incorporated ISO 13485:2016 by reference into 21 CFR Part 820. The EU MDR and IVDR rely on harmonised versions of both standards. So almost every device company now needs these texts at hand, and many want to load them into AI tools. That is where the licence becomes the issue.

Where to find it

  • ISO Store and national standards bodies (such as ANSI in the US) sell the standards.
  • Regulators’ pages, such as FDA’s QMSR page, explain how the standards are used, but do not reproduce them.

Licence terms: why “permission required”

ISO’s licence agreement for purchased publications is explicit:

  • Single user. A single-user licence covers one named end-user, and the publication “may not be shared with any other person or stored on shared systems or networks.”
  • No AI use without a separate licence. Section 7(b) says the licensee “is not permitted to access, use, or process the ISO Publication for or related to any machine learning, artificial intelligence (AI)” use. The restriction covers training and evaluation, and “embedding, prompting, querying, comparing, or otherwise enabling” AI or ML models. That includes pasting text into a chatbot or indexing it for RAG.
  • No text and data mining exception. “ISO expressly opts out of the text-and-data-mining exception.”
  • Website notice. Apart from ISO Open Data, “no ISO content may be used for any machine learning and/or artificial intelligence.”

In short, our rating holds: buying the standard does not give you the right to use it in AI.

Using ISO 13485 and 14971 in AI responsibly

  1. Do not upload purchased ISO PDFs into AI tools, including private RAG systems, without a licence that permits it.
  2. Ask ISO or your national body about AI-permitted licences, and keep the written terms.
  3. Use your own documents instead. Your quality manual, procedures, and risk files are yours to analyze.
  4. Reference clause numbers and titles, not full text, in prompts and indexes.
  5. Use the regulation layer: 21 CFR Part 820 and the MDR are reusable texts that point to the standards.
  6. Train staff that the AI restriction applies to quick copy-paste use too.

Common mistakes

  • Assuming a company purchase covers an enterprise AI tool.
  • Thinking a “private” or on-premises model avoids the restriction. The licence covers any AI processing.
  • Relying on the US fair use or EU TDM exceptions, which ISO has contractually opted out of.
  • Believing that QMSR incorporation by reference makes ISO 13485 public.

Checklist

  • Inventory where ISO PDFs are stored and who uses them
  • Remove ISO text from AI indexes unless licensed
  • AI-permitted licence requested where needed
  • Prompts reference clause numbers, not text
  • Staff briefed on AI restrictions
  • Licence terms filed with the quality system

How AskDona helps

AskDona works on your own quality documents. It can map your procedures to clause numbers and to the regulation text in 21 CFR Part 820, without your team needing to load licensed ISO text, unless you hold a licence that allows it.

Run a sample QMSR clause-mapping check on your own procedures

AskDona shows the evidence; your quality team decides.

Editor’s note. This article is general information, not legal advice. The “permission required” rating comes from our source list and is a first-pass judgment, not a legal opinion. Confirm your exact licence terms with ISO or your national standards body.

FAQ

Can I upload ISO 13485 to ChatGPT or a RAG tool? Not under a standard ISO licence. ISO’s terms prohibit AI and ML use, including prompting and querying, without a separate licence.

Does the QMSR make ISO 13485 free? No. It incorporates the standard by reference, but ISO keeps the copyright.

What about text and data mining exceptions? ISO expressly opts out of them in its licence.

What can I do instead? Analyze your own documents, reference clause numbers, use the regulation text, or obtain an AI-permitted licence.

References

All pages opened and checked by October 26, 2026.

SourceWhat it supports
ISO: Terms and conditions, licence agreementSingle user, AI and ML prohibition, TDM opt-out, website AI notice
FDA: Quality Management System RegulationQMSR effective 2 Feb 2026; ISO 13485:2016 incorporated by reference