ISO 13485: the quality management system for medical devices

If you design, manufacture or distribute medical devices, ISO 13485 is the foundation that underpins compliance with the MDR. What it requires, who it is for and how to get it.

ISO 13485 is the international standard that sets out the requirements for a quality management system for organizations in the medical device sector. Unlike ISO 9001, it is not designed to measure customer satisfaction but to show that the company consistently meets customer requirements and applicable regulatory requirements. In Europe, that mainly means Regulation (EU) 2017/745, known as the MDR. In this guide we look at what the standard requires, how it differs from ISO 9001, how it connects to risk management under ISO 14971 and, above all, why ISO 13485 certification and CE marking are two different things that are often confused.

What is ISO 13485 and what is it for?

ISO 13485 is the quality management standard for medical devices "for regulatory purposes". The title says it all: its purpose is to help you show customers and authorities that you can provide medical devices and related services that consistently meet the applicable requirements. The current edition is ISO 13485:2016, which ISO has reviewed and confirmed without substantive changes.

For an SME, the practical value is twofold. On the one hand, the standard organizes the processes that the MDR requires you to have in any case: control of design, suppliers, production and complaints. On the other, it provides a common, internationally recognized language that lets you talk to customers, distributors and authorities without having to explain how you work every time. If you want a general introduction to what an ISO certification is, you will find the basics in our guide to ISO certifications.

A standard designed for regulatory requirements

The fundamental difference from other management system standards is its focus. ISO 13485 puts regulatory compliance and safety of the device at the centre, not commercial growth or customer satisfaction in the broad sense. That is why it requires more documented procedures, more records and more formal controls than ISO 9001.

A concrete example helps. In an ISO 9001 system you decide how much to document the complaint-handling process, as long as it works. In an ISO 13485 system a complaint must be handled through a written procedure, assessed to determine whether it needs to be reported to the competent authority and linked to post-market surveillance. The logic is always the same: every decision must leave verifiable evidence, because sooner or later someone will ask you to prove it.

Who it applies to: not just manufacturers

The standard is aimed at organizations involved in one or more stages of the life cycle of a medical device. These include design and development, production, storage and distribution, installation and servicing. ISO 13485 can also be used by external suppliers that work for these organizations.

In practice, certification is relevant to very different profiles. There is the manufacturer that designs and produces a device under its own brand. There is the subcontractor that moulds plastic components or carries out sterilization for others. There is the distributor that manages warehousing, traceability and recalls. And there is the software house that develops software classified as a medical device. For many suppliers ISO 13485 is not a legal obligation, but it is the requirement that the manufacturer customer writes into the supplier qualification agreement.

How does ISO 13485 relate to the MDR?

The MDR requires every manufacturer to have a quality management system, and ISO 13485 is the most widely used way to build one. They are not the same thing, though: the regulation is law, while the standard is a voluntary tool that helps you comply with it.

Article 10 and the mandatory quality management system

Article 10 of the MDR sets out the general obligations of manufacturers. Among them is the obligation to establish, document, implement, maintain, keep up to date and continually improve a quality management system proportionate to the risk class and type of device. The obligation applies to all manufacturers, with the sole exception of investigational devices.

The regulation also lists the minimum aspects the system must cover. These include the strategy for regulatory compliance, identification of the general safety and performance requirements, management responsibility, resource management including suppliers, risk management, clinical evaluation, product realization, unique device identification (UDI), post-market surveillance, reporting of serious incidents, and corrective and preventive actions.

The harmonised version and the presumption of conformity

The European version of the standard, EN ISO 13485:2016 with amendment A11:2021, is published as a harmonised standard in support of the MDR. Amendment A11 added the annexes that map the requirements of the standard to those of the regulation. Applying a harmonised standard gives you a presumption of conformity with the requirements of the regulation that the standard covers.

Note the word "covers", however. The presumption applies only to the requirements listed in the mapping annexes of the EN version, not to the whole regulation. A well-built ISO 13485 system is therefore a solid foundation, but it does not exempt you from checking point by point what the MDR requires.

What ISO 13485 does not cover on its own

Some MDR obligations require processes that the standard does not describe in detail. The most typical case is the regulatory compliance strategy: device classification, choice of the conformity assessment procedure and management of significant changes. Other examples are clinical evaluation and post-market clinical follow-up, management of UDI codes and the person responsible for regulatory compliance, required by Article 15 of the regulation.

A company that has "only" ISO 13485 and is approaching the MDR therefore needs to supplement its system with these elements. This is one of the areas where we see the most delays: the quality system is there, but the link to the regulation is missing.

ISO 13485 certification and CE marking: what is the difference?

ISO 13485 certification attests that your quality management system conforms to the standard. CE marking attests that the device conforms to the MDR and can be placed on the European market. They are two different acts, issued under different rules, even when the assessments take place in the same period.

ISO 13485 certification is voluntary and is issued by an accredited certification body, in accordance with ISO/IEC 17021-1 and the IAF MD 9 mandatory document dedicated to medical device quality management systems. Conformity assessment for CE marking, on the other hand, requires the involvement of a notified body for most risk classes: a body designated by a national authority specifically for the MDR. When the notified body assesses the quality management system under Annex IX of the MDR, it issues an EU certificate, which is not an ISO 13485 certificate.

An example: class I and class IIa

Consider two companies. The first produces a class I device that is non-sterile and has no measuring function: for CE marking it declares conformity itself, without a notified body. It must still have a quality system compliant with the MDR, and ISO 13485 certification is the most credible way to demonstrate this to hospitals and distributors.

The second produces a class IIa device. Here the notified body assesses the quality management system and the technical documentation. Having a well-established ISO 13485 system makes the assessment much smoother, but the ISO certificate does not replace the assessment required by the regulation. Many manufacturers coordinate the two assessments precisely to avoid duplicating work.

What does ISO 13485 require beyond ISO 9001?

ISO 13485 shares the process approach with ISO 9001, but it is more prescriptive and more focused on product safety. One structural difference: ISO 9001 follows the common structure of management system standards, whereas ISO 13485 has kept its own structure and includes an annex mapping it to ISO 9001. If you already know ISO 9001, our guide to the ISO 9001 quality management system gives you the starting point; here we focus on what changes.

More documentation and the medical device file

ISO 13485 requires documented procedures for many processes where ISO 9001 leaves you free to choose. In addition, for each type or family of devices it requires you to keep a medical device file: the set of documents describing the product, its specifications and the processes for manufacturing, packaging, labelling, installation and servicing.

Document retention also has stricter rules. Records must remain available for at least the lifetime of the device as defined by the manufacturer, and in any case for no less than the applicable requirements demand. For a company producing implants with a long service life, this means archives that last many years and must remain readable.

Risk applied to processes and to the product

ISO 9001 talks about risks and opportunities at system level. ISO 13485 applies a risk-based approach to the control of quality system processes and requires documented risk management in product realization. If you want to understand how risk is handled in management systems in general, you will find more in our guide to risks and opportunities in ISO standards.

The standard also requires you to validate the software used in the quality system and in production processes, proportionately to the risk. The spreadsheet that governs batches or the ERP that records traceability are not IT details: if they get it wrong, the system gets it wrong.

Maintaining effectiveness, not just improving

Where ISO 9001 stresses continual improvement and customer satisfaction, ISO 13485 requires you to maintain the effectiveness of the system and to collect market feedback as an input for product safety. Complaints must be handled through precise procedures, assessed for reporting to the authorities and linked to corrective actions.

There are also specific requirements that ISO 9001 does not cover: control of the work environment and contamination, requirements for sterile devices, enhanced traceability for implantable devices, advisory notices and handling of returned products. These are the areas where an "ISO 9001" company discovers it has more work to do than expected.

How does ISO 14971 risk management fit in?

ISO 14971 is the international standard on the application of risk management to medical devices. It describes a process to identify hazards, estimate and evaluate risks, control them and monitor the effectiveness of the controls throughout the life cycle. It is also available as a European harmonised standard.

ISO 13485 and ISO 14971 work as a pair. The first requires you to have a risk management process for the product; the second tells you how to do it. ISO 14971 does not set acceptable risk levels: it requires the manufacturer to define objective acceptability criteria and apply them consistently. It does not in itself require a quality management system, but in practice risk management lives inside the ISO 13485 system.

A typical mistake is to treat the risk management file as a document to be filled in once, at the design stage. In reality it must be updated with post-market data: a recurring complaint, a reported incident or a change of supplier for a critical component are all events that can change the assessment. If the risk analysis never moves, an auditor will read it as a sign that the link between production, complaints and design is not working.

How do you get ISO 13485 certification?

The path to certification follows the typical stages of any management system, with some extra attention specific to the sector. How long it takes depends on the complexity of the devices, the number of processes and how structured the company already is.

Initial analysis and scope

The first step is to define the certification scope precisely: which devices, which sites, which life-cycle stages. ISO 13485 allows certain requirements to be excluded only in specific cases: for example, design can be excluded if the applicable regulatory requirements permit it, and product realization requirements that do not apply to your activities can be declared not applicable, with a justification.

A lot depends on this. A distributor that neither designs nor manufactures will have a much leaner system than a manufacturer of sterile devices. A subcontractor that moulds components must agree with the customer which responsibilities remain with it and which pass to the manufacturer. A well-run initial analysis compares the current situation with the standard and the regulatory requirements, and produces a concrete plan.

Implementation and internal audit

Next comes the build phase: procedures, medical device files, risk management, supplier qualification, production control, and handling of complaints and reports. The system must then run long enough to produce real records: a certification audit does not assess written procedures but processes that work.

Before the external audit you need a complete internal audit and a management review. If you follow the path with Complaion, you carry out the internal audit with us: it is conducted by the Complaion Lead Auditor, who assesses the system with an eye that is independent of the people who run it day to day. You will find a dedicated guide on how to organize an effective ISO internal audit.

Certification audit and three-year cycle

The certification audit takes place in two stages: the first checks documentation and readiness, the second checks on site that the system is effective. You will find them described in our guide to stage 1 and stage 2 audits. Auditors must have specific competence in medical devices and regulatory requirements, as required by IAF MD 9.

The certificate has a three-year cycle, with surveillance audits at least once a year and a recertification audit at expiry. In the meantime the system must keep working: complaints, corrective actions, supplier audits and risk management updates are exactly what auditors will look for.

Why is the quality system decisive in the transition to the MDR?

The quality system is the starting condition on which everything else depends, including in the transition from the old directives to the MDR. Regulation (EU) 2023/607 extended the transitional period for devices certified under the previous directives: until 31 December 2027 for class III devices and most class IIb implantable devices, and until 31 December 2028 for the other classes concerned.

The extension is not automatic, however. Among the conditions is that the manufacturer has put in place a quality system compliant with Article 10 of the MDR and has applied to a notified body within the deadlines set by the regulation itself. In other words, even to benefit from the extension, the quality system had to be in place before the certificate.

The medical device regulatory framework is subject to change: in recent years the MDR has been amended several times, for example with the obligation to inform the authorities in advance when the supply of certain devices is interrupted. Before you plan, always check the current consolidated version on EUR-Lex and the deadlines that apply to your devices. A well-managed ISO 13485 system lets you absorb these changes as process updates, not emergencies.

What are the most common mistakes?

The first mistake is to think that ISO 13485 certification is equivalent to CE marking. We have seen companies approach a hospital customer with their ISO certificate, convinced they had "done the MDR". The certificate demonstrates a quality system, not the conformity of the device with the regulation.

The second mistake is to copy the ISO 9001 system and change the header. What is almost always missing is the medical device file, software validation, handling of reports to the authorities and risk management linked to market data. At audit these emerge as systemic nonconformities, which are hard to close quickly.

The third mistake concerns suppliers. Many SMEs in the sector outsource critical processes such as sterilization, moulding or packaging, but qualify the suppliers with a generic questionnaire. ISO 13485 requires controls proportionate to the risk of the product supplied, written quality agreements and performance monitoring over time.

The fourth mistake is to neglect post-market surveillance. Complaints filed without trend analysis, reports assessed late, corrective actions that do not get to the cause: an auditor immediately links all of these to a risk for the patient. A system that collects market data in an orderly way is also the one that stands up best to audits.

How to simplify the path with Complaion

An ISO 13485 system works when procedures, files, risk management, suppliers and complaints stay connected and up to date over time. Complaion helps you build it and keep it that way. We start from your needs and propose the path that suits you best: ISO 13485 certification, a system integrated with ISO 9001, or preparing the quality system required by the MDR. A dedicated Lead Auditor with experience in the medical device sector supports you at every stage and conducts the internal audit; the platform collects evidence, manages documents and files, keeps the schedule of validations, reviews and supplier audits, and prepares the audit with the certification body. The Complaion path helps you avoid nonconformities and brings you to the external audit with a 100% success rate. It is the method we have used with more than 1,000 clients. Find out about our ISO 13485 service or contact us for an initial analysis and a tailored quote.

Frequently asked questions about ISO 13485

What is ISO 13485 in simple terms?

ISO 13485 is the international standard that defines how the quality management system of a company working with medical devices must be organized. It covers design, production, distribution, installation and servicing, as well as the suppliers of these companies. Its aim is to demonstrate that devices consistently meet customer and regulatory requirements.

Is ISO 13485 certification mandatory?

No, certification is voluntary. However, the MDR requires every manufacturer to have a quality management system, and ISO 13485 is the most widely used harmonised standard for building one. For subcontractors and distributors, certification is often a contractual requirement set by manufacturer customers.

Does ISO 13485 replace CE marking?

No. ISO 13485 certification concerns the company's quality management system, while CE marking concerns the conformity of the individual device with the MDR. For most risk classes, CE marking requires an assessment by a notified body, which issues an EU certificate separate from the ISO certificate.

What is the difference between ISO 13485 and ISO 9001?

Both are quality management standards, but ISO 13485 is focused on regulatory compliance and product safety. It requires more documented procedures, a file for each type of device, risk management, software validation and handling of reports to the authorities. It also does not follow the common structure of ISO management system standards, and it includes a mapping annex to ISO 9001.

Can a medical device distributor get ISO 13485 certification?

Yes. The standard applies to anyone involved in a stage of the device life cycle, including storage and distribution. A distributor can declare the requirements related to design and production not applicable, with a justification, and focus on warehousing, traceability, complaint handling and recalls.

How long does ISO 13485 certification last?

The certificate has a three-year cycle. During this period the certification body carries out surveillance audits at least once a year and, at expiry, a recertification audit. To keep the certificate, the system must remain active and up to date, with evidence on complaints, corrective actions, suppliers and risk management.

How much does ISO 13485 certification cost?

There is no standard cost. It depends on the number and class of devices, the life-cycle stages covered, the number of sites and people, the processes outsourced and how structured the system already is. The most reliable way to find out is to start with an initial analysis and ask for a tailored quote.