CSC Open-Sources Its ISO 13485 QMS

1 January 2026

The Clinical Scientific Computing (CSC) team is pleased to announce that it has open-sourced its ISO 13485 quality management system (QMS).

The Medicines and Healthcare products Regulatory Agency (MHRA) requires organisations that manufacture medical devices to comply with ISO 13485. CSC builds, deploys, and evaluates software as a medical device (SaMD) and AI as a medical device (AIaMD), operating as an ISO 13485-certified body within a QMS.

This QMS was developed over several years by CSC and is currently in use at Guy’s and St Thomas’ NHS Foundation Trust (GSTT), London. So far, it has survived 18 internal audits and three external ISO 13485 audits conducted by two different notified bodies in the UK.

To help others navigate medical-device regulatory requirements, we have made this QMS publicly available. It can be found at this location, where you will find a GitHub repository containing a template as well as instructions for its use.

Our AI Safety Lead, Anil Mistry, who led the project as the Quality Management Officer (QMO), had this to say upon its release:

Adhering to regulatory aspects of software development is necessary to ensure patient safety. However, in terms of product development, meeting the relevant standards can add months—even years—to reaching the deployment and evaluation stages, let alone market access through CE/UKCA certification.

With the release of this QMS, we are targeting NHS institutions that are looking to create their CSC teams (this is whom we initially built it for), start-ups, small and medium enterprises, and academic institutions.

Open-sourcing our QMS aligns with one of our primary aims: to build a community centred on best practice. As part of this community, we seek to demystify regulatory requirements, develop useful AI products that the NHS can use or purchase for patient benefit, generate the technical documentation required by hospitals to test prototype apps, and implement processes that reflect appropriate clinical risk management (DCB0129 / DCB0160 / ISO 14971).