ISO 13485: what it is, who needs it, and how certification works

What is ISO 13485?

ISO 13485:2016 is the international standard for a quality management system at an organisation that designs, makes, installs or services medical devices, or supplies the companies that do. An accredited certification body audits the system and issues the certificate, then returns every year to check the system still runs as written.

It descends from ISO 9001 and keeps the device parts: risk management through every process, design and development controls, traceability, and complaint handling with reporting to regulators. The current edition is 2016.

Who needs ISO 13485?

Device manufacturers of Class IIa and above selling into the EU, and anyone audited under MDSAP for Australia, Brazil, Japan or the United States. Canada requires an MDSAP certificate to ISO 13485 for Class II to IV devices

US manufacturers since 2 February 2026, when the FDA's QMSR incorporated ISO 13485:2016 by reference. The FDA inspects against it and does not certify

Suppliers and contract manufacturers whose customers ask for the certificate before they will buy

The standard becomes urgent when a distributor asks for the certificate, when the first certification audit goes on the calendar, or when a customer audit finds the quality manual still cites Part 820.

What ISO 13485 asks for, clause by clause

Clauses 1 to 3 are scope, references and terms. The requirements the registrar audits are clauses 4 to 8, and risk management runs through all of them.

Documented procedures, a quality manual, control of documents and records, and a medical device file for each device type or family

A quality policy and objectives, defined responsibilities and authority, a management representative, and management review at planned intervals

Competence and training with records of both, infrastructure, work environment and contamination control

Planning, customer requirements, design and development (7.3), purchasing and supplier control (7.4), production and servicing, identification and traceability, and control of monitoring and measuring equipment

Feedback and complaint handling, reporting to regulatory authorities, internal audit, control of nonconforming product, and corrective and preventive action (8.5.2 and 8.5.3)

How ISO 13485 certification works

1. Gap assessment

Read your procedures and records against every clause and list what is missing, unwritten or not followed.

2. Write and approve the procedures the gaps call for

And train the people who will run them.

3. Run the system and keep the records

4. Stage 1 and Stage 2 audits

The registrar reviews the documentation, then audits the running system on site and issues the certificate or a list of nonconformities to close first.

5. Surveillance and recertification

An audit every year and a full recertification every three years, with every change in between kept in the system the registrar will read.

ISO 13485 IN QUALIO

Qualio maps every procedure and record to its clause, so the registrar finds each one where they expect it

Qualio breaks ISO 13485 down clause by clause and maps your procedures, training records, design controls, supplier files and CAPAs to the clauses they answer. When a record changes, it reassesses the clauses that record touches and recommends a fix for any gap. Copilot drafts the procedure update or the CAPA from the recommendation, and your team approves it. When the registrar sends the dates, you export the audit pack by clause, with the evidence and the approvals behind each one.

Design controls for clause 7.3, read from Jira as the work happens, with the ISO 14971 risk file beside them

Complaints, nonconformances and CAPAs for clause 8, each traceable to the record that raised it

Training assigned on the effective date of every revised procedure, for clause 6.2

Management review run as an event, so clause 5.6 reads the records as they stand

Standards that apply alongside ISO 13485

Medical devicesFDA QMSR: Incorporates ISO 13485:2016 by reference, so your 13485 records answer most of it and the FDA-specific requirements show up as their own gaps
Medical devicesMDSAP: One audit to ISO 13485 that the regulators of Canada, the United States, Australia, Brazil and Japan all accept
Medical devicesEU MDR: Expects a quality management system the notified body can audit, and the technical documentation beside it
Medical devicesISO 14971: The risk management ISO 13485 asks for in every process, from hazard to residual risk
Medical devicesIEC 62304: The software lifecycle inside clause 7.3 when the device is, or contains, software

Bond Digital Health

Bond Digital Health achieved ISO 13485 and IEC 62304 accreditation on Qualio.

Read the Bond Digital Health story

“Just building a compendium of everything you need to show the notified bodies can be tricky if you're doing it manually. We wanted to start on the right footing.”

Daniel AragaoCTO, InVivo Bionics

Guides and checklists for ISO 13485

Toolkit

ISO 13485 toolkit

Checklist

ISO 13485 compliance checklist

Guide

How to prepare for ISO 13485 certification

Questions about ISO 13485

What is ISO 13485?

ISO 13485:2016 is the international standard for a quality management system at a company that designs, makes or services medical devices or supplies those that do. An accredited certification body audits the system and issues the certificate. It is the standard most device regulators expect a manufacturer's quality management system to match.

Is ISO 13485 mandatory?

Not as a law in itself. An MDSAP certificate is required in Canada, the audit is accepted by the other four MDSAP regulators, notified bodies expect it under the EU MDR as the harmonised standard, and since February 2026 it is the core of the FDA's QMSR, which US manufacturers comply with whether or not they hold the certificate.

What is the difference between ISO 13485 and ISO 9001?

ISO 13485 is built on ISO 9001 and written for medical devices. It adds risk management through every process, design and development controls, traceability, sterile and implantable device requirements, and complaint reporting to regulators. It drops ISO 9001's customer satisfaction and continual improvement requirements in favour of keeping the system effective as written.

Does ISO 13485 certification satisfy FDA requirements?

Most of them. The QMSR incorporates ISO 13485:2016 by reference, so a certified system covers the core. The FDA keeps its own requirements on top and inspects rather than certifies, so the certificate is strong evidence and inspection readiness is still yours to show. See FDA QMSR.

How long does ISO 13485 certification take?

It depends on where the system starts. A company writing procedures from scratch needs time to write, approve and train them, then months of records before the registrar's Stage 2 audit. A company with a running system that fits the standard can be certified within a year.

What is the current version of ISO 13485?

ISO 13485:2016, published in March 2016. The European harmonised version is EN ISO 13485:2016 with amendment A11:2021, which aligns it with the EU MDR and IVDR. There is no newer edition.

Can we add ISO 13485 to the standards we already run in Qualio?

Yes. Add it from the library and Qualio assesses the records you already hold against every clause, so the procedures and training that answer ISO 9001, the QMSR or MDSAP count towards 13485 without being re-filed. The first assessment lists what is covered and what is new.

When is the registrar next in?

Bring the date and your current procedures. We will show you ISO 13485 assessed against them clause by clause, with the gaps listed and the audit pack exported the way the registrar reads it.

Book a demo Get the ISO 13485 toolkit

Less time on audit prep. More time on quality.