About the Standard
Scope title: medical device quality management system
ISO 13485 is a standard published by International Organization for Standardization (ISO). The international standards organisation; it publishes the widest body of management system, test method and product standards.
See the other 310 codes from ISOCoverage areas
What Is ISO 13485?
requirements for regulatory purposes
It comes from the same root as ISO 9001 but has deliberately diverged from it. The emphasis of ISO 9001 on customer satisfaction and continual improvement is replaced here by a risk-based approach, traceability, the design file, record retention periods and obligations to notify the regulatory authority. For a device manufacturer the real question is not whether the customer is satisfied but whether it can be DEMONSTRATED that the device remains safe and compliant.
The standard covers the whole life cycle: design and development, supplier auditing, production and process validation, cleanliness and contamination control, sterilisation processes, traceability and UDI, post-market surveillance, complaint handling, corrective action and, where necessary, recall.
The 2016 edition markedly strengthened the requirements for process validation and SOFTWARE VALIDATION. Not only software inside the device but also software used in production and in the quality system (ERP, laboratory information systems, electronic record systems) falls within the scope of validation.
Why Does This Standard Exist?
The reason the medical device sector needs a separate quality system standard is the consequence of error. A quality defect in a consumer product produces dissatisfaction; in a medical device it produces patient harm, and that harm cannot be undone. Regulatory authorities therefore require the manufacturer to evidence not only the product but also THE PRODUCTION SYSTEM.
Traceability is the most concrete consequence of that logic. When a problem arises with a device, which lot it came from, which raw material it used, which operator produced it, with which equipment it was tested and to whom it was sold must all be recorded. A recall decision is made on the basis of those records; without them, a recall has to cover the entire product.
PROCESS VALIDATION is the second defining concept. The result of some processes cannot be verified by inspecting the finished product: it is not possible to show that a sterilisation cycle succeeded by testing every unit, because testing consumes the product. For such processes the solution is to validate the process itself — it is shown in advance that as long as the process runs with the correct parameters, the result will be correct.
The standard's relationship with legislation has tightened over time. In the EU, the MDR and IVDR set out the quality system obligation in detail. In the United States, the FDA rewrote its own quality system regulation as the QMSR, in force from 2 February 2026, so that it refers to ISO 13485:2016; this markedly reduced the difference between the two regimes.
The MDSAP programme introduced a mechanism reducing the audit burden: a single audit provides recognition for Canada, Brazil, Australia, Japan and the United States. In Canada, MDSAP is mandatory.
Which Products Require It
- Manufacturers of medical devices and in vitro diagnostic devices
- Contract manufacturers and sterile service providers
- Component and raw material suppliers (where contractually required)
- Distributors and importers (within their roles)
- Developers of software as a medical device (SaMD)
Related Legislation and Schemes
- It is used to meet the quality system obligation under MDR (EU) 2017/745 and IVDR (EU) 2017/746
- In the United States, from 2 February 2026 the QMSR (21 CFR Part 820) refers to ISO 13485:2016
- The MDSAP programme provides multiple recognition for Canada, Brazil, Australia, Japan and the United States through a single audit
- Risk management runs through ISO 14971, software through IEC 62304 and usability through IEC 62366
- In Canada, MDSAP is mandatory
How the Assessment Runs
- 1Determining the scope and roleThe organisation's role in the supply chain (manufacturer, contract manufacturer, distributor, importer) and the activities to be certified are defined.
- 2Establishing a risk-based systemProcesses are linked to risk management under ISO 14971; the level of risk determines the intensity of control.
- 3Design controlRecords of design inputs, outputs, verification, validation, design review and design transfer are established.
- 4Process validationProcesses whose results cannot be verified by inspection of the finished product (sterilisation, welding, cleaning, software) are validated.
- 5Post-marketComplaint handling, adverse event reporting, field safety corrective action and post-market surveillance systems are operated.
- 6Auditing and certificationThe system is verified through internal audit, management review and third-party audit.
Neighbouring Standards and the Differences
ISO 9001
It comes from the same root but its requirements differ; an ISO 9001 certificate does not take the place of ISO 13485.
ISO 14971
Risk management. ISO 13485 ties many of its requirements to this process; the two work together.
IEC 62304
Medical device software life cycle processes; applied in addition for devices containing software.
ISO/IEC 17021-1
The competence standard for certification bodies; the accreditation basis of your certificate.
What the Report Must Contain
To be usable, a report must carry the information below. An incomplete report may not be accepted in the supply chain or in an inspection even when its result is correct.
- The scope of the certificate: activities, sites and any excluded clauses
- Justifications for exclusions (particularly design control)
- Audit dates, the audit team and the processes audited
- Findings, their classification and closure status
- The edition of the standard applied and any MDSAP scope
Commonly Confused Points
- An ISO 13485 certificate does not confer the CE marking. Classification under the MDR, the technical file and the notified body process run separately.
- An ISO 9001 certificate does not take the place of ISO 13485; despite the shared structure the requirements differ.
- The scope of the certificate matters: a certificate excluding design activity is not sufficient for a manufacturer responsible for design.
- Exclusions must be justified; an unjustified exclusion produces a non-conformity in an audit.
- Process validation is not a one-off exercise; a change of parameters and periodic revalidation are required.
- Supplier control is not deemed transferred by contract; the manufacturer is obliged to monitor its supplier's performance.
Structure of the Code
- Published by
- ISO
- Serial number
- 13485
- Part
- without partition
Codes in the library without release year is kept. The current version changes over time; If the year is specified in your specification, that version is taken as basis, if not specified, the most current version is applied.
Scope
- Certification
Related Tests and Services
Of the 1 pieces of content this code is referenced in, the 1 with their own published page are listed below.
Certification · 1
Technical Requirements
Standard texts are copyright of the relevant organization; test condition, sample and acceptance criteria cannot be fitted here.
Basis: The ISO 13485:2016 scope statement and its emphasis on regulatory purposes; the MDR/IVDR, QMSR (21 CFR Part 820) and MDSAP references; the relationships with ISO 14971 and IEC 62304.
Technical requirements specific to your product, once we clarify the scope At offer stage shared in writing.
Relevant Product Groups and Legislation
This code is included in the standard tag of the product pages below.
These product pages carry notes for the following markets: European Union, United Kingdom, USA. Whether the standard is mandatory in the relevant market varies depending on the product group and the applicable legislation.
Regulations published with this code on the same product pages:
- (EU) 2017/745MDRThe Medical Device Regulation. Classification (I, IIa, IIb, III), clinical evaluation, technical documentation and post-market surveillance obligations; the notified body's role grows as the class rises.
- (EU) 2017/746IVDRThe In Vitro Diagnostic Medical Devices Regulation. In vitro diagnostic devices fall under this regulation instead of the MDR.
- (AB) 2017/745 art. 33EUDAMEDThe European medical device database. From 28 May 2026, the actor registration, UDI/device, certificate and market surveillance modules are mandatory; placing on the market is not possible without a valid SRN.
- 2006/42/ATMachinery Directive (overlap)Relevant essential requirements also apply to medical devices that also qualify as machinery.
- 2011/65/EURoHSRestriction of hazardous substances in electrical and electronic equipment.
- (EC) 1907/2006REACHRegistration, evaluation, authorisation and restriction of chemicals; SVHC notification.
Related Standards
Frequently Asked Questions About ISO 13485
We have an ISO 9001 certificate — how much additional work does ISO 13485 require?
The shared structure helps, but design control, traceability, process validation, record retention and notification obligations require additional work.
We do not carry out design — can we exclude it?
You can, but you must justify it. If you are responsible for design, an exclusion creates problems in audits and before regulators.
What does MDSAP gain us?
It provides recognition in five countries through a single audit and reduces the audit burden. It is mandatory for the Canadian market.
Does the QMSR transition affect us?
If you ship products to the United States, yes. The QMSR reduces the difference between the two regimes by referring to ISO 13485:2016, but US-specific additional requirements remain.
Frequently Asked Questions
Is this standard mandatory for my product?
Whether it is mandatory depends on the product group, the target market and the applicable legislation. Once you tell us your product and market, we clarify in writing whether this standard is required.
How long does the test process take?
Duration depends on the scope of the standard, the number of specimens and current capacity. The exact duration is shared, together with the specimen and scope details, at the quote stage.
Do you issue certification against this standard?
Which activity is carried out under which accreditation scope is separately confirmed at the application stage. Up-to-date scope information is published on our corporate page.
What happens if the standard I need is not here?
The library is based on a continuously growing inventory. If you cannot find the code you are looking for, you can send it through the quote form; we will assess the relevant scope and get back to you.