Medical devices
ISO 13485: the system without which there is no CE marking
For medical device manufacturers ISO 13485 is not a competitive advantage but an entry ticket. The notified body starts its assessment with the quality management system, and Regulation (EU) 2017/745 requires one in substance. We build it to stand up to both the auditor and the regulator.
6–12 mo.typical implementation
ISO 14971risk management applied
MDRRegulation (EU) 2017/745
3 yearscertificate validity
In short
What ISO 13485 is
Short answer
ISO 13485 is the international standard for a quality management system specific to medical devices. It is built on ISO 9001 but retuned to one purpose: demonstrating the ability to consistently supply devices that meet customer requirements and applicable regulatory requirements.
The difference from ISO 9001 is one of principle. ISO 9001 promotes continual improvement and customer satisfaction. ISO 13485 puts regulatory compliance and risk management first — and therefore demands considerably more documented information, strict traceability and formal records where ISO 9001 allows discretion.
| Aspect | ISO 9001 | ISO 13485 |
|---|---|---|
| Primary focus | Customer satisfaction and improvement | Regulatory compliance and patient safety |
| Documentation | Minimal, at your discretion | Extended and mandatory, including a device file |
| Risk management | Risk-based thinking | A formal process across the whole life cycle, per ISO 14971 |
| Traceability | Based on impact on the product | Mandatory, with a stricter regime for implantable devices |
| Post-market | Customer feedback | Surveillance system and vigilance reporting |
Regulatory context
The link with MDR and the notified body
Regulation (EU) 2017/745 does not literally require an ISO 13485 certificate, but it does require a quality management system. In practice ISO 13485 is the accepted way to demonstrate one.
Device class
The class determines whether a notified body is needed. For class I without sterility or a measuring function the manufacturer self-declares; for the rest the assessment is external.
Technical documentation
Required by the annexes of the regulation — description, risk assessment, preclinical and clinical evaluation, labelling, post-market surveillance plan.
Post-market surveillance
The surveillance plan, periodic reports and incident reporting are part of the system, not a separate activity.
A detailed walk-through of both regimes together — classes, notified body, EUDAMED and the deadlines — is in ISO 13485 and MDR: the complete guide.
Applicability
Who the standard is for
The standard covers the whole life cycle, so it applies to considerably more organisations than manufacturers alone.
Manufacturers
Of devices, accessories and software as a medical device, whatever the class.
Importers and distributors
Storage, transport under controlled conditions, batch traceability and complaint handling.
Subcontractors
Sterilisation, processing, packaging, calibration — your customers will require a certified system.
Developers
Device and software designers, including development to a client specification.
What the standard contains
What ISO 13485 adds over ISO 9001
| Area | The specific requirement |
|---|---|
| Medical device file | For each type or model, a file holding specifications, manufacturing requirements, measurement methods and installation and servicing requirements |
| Risk management | Applied across the whole life cycle with maintained records; in practice ISO 14971 is used |
| Design and development | Planning, inputs, outputs, review, verification, validation, transfer to production and change control — with records at each step |
| Cleanliness and contamination | Requirements for the working environment, clothing and contamination control, intensified for sterile devices |
| Process validation | Processes whose output cannot be fully verified by subsequent inspection must be validated — including software used in production |
| Traceability | Mandatory, with extended requirements and distribution records for implantable devices |
| Feedback and vigilance | Collection of post-market data, complaint handling and reporting of incidents to the competent authorities |
Where companies most often fail: validation of processes and software. If welding, sterilisation, bonding or automated inspection cannot be fully verified on the finished product, they must be validated with a protocol, acceptance criteria and revalidation on change. Missing records here is a major nonconformity.
How we work
The route to the certificate
Timelines for medical devices run longer than usual because of design documentation and validations.
- 1
Regulatory classification and gap analysis
We determine the device class, the applicable route and what is missing against the standard and the regulation.
1–2 weeks - 2
Risk management to ISO 14971
We build the process and the risk management file — from analysis through to evaluation of residual risk.
3–5 weeks - 3
Design, device file and technical documentation
We organise the design records and compile the device file and technical documentation per the regulation’s annexes.
6–12 weeks - 4
Production, validation and traceability
Instructions, environmental control, validation of special processes and a batch identification and traceability system.
4–8 weeks - 5
Post-market surveillance and training
Surveillance plan, complaint handling, incident reporting, training of the team and of the internal auditors.
2–4 weeks - 6
Internal audit and certification audit
A full internal audit, management review and preparation for the audit by the certification or notified body.
6–10 weeks to certificate
Further reading
More on the topic
Questions and answers
Frequently asked questions
What is ISO 13485?
ISO 13485 is the international quality management system standard specific to medical devices. It sets requirements for organisations involved in one or more stages of the device life cycle — design, production, storage, distribution, installation, servicing and final decommissioning. Its purpose is consistent conformity with customer and applicable regulatory requirements.
What is the difference between ISO 9001 and ISO 13485?
ISO 13485 builds on the ISO 9001 structure but shifts the focus from customer satisfaction and continual improvement to regulatory compliance and patient safety. It requires considerably more documented information, formal life-cycle risk management, a medical device file, validation of special processes and strict traceability.
Is ISO 13485 mandatory for selling in the EU?
Regulation (EU) 2017/745 does not literally require an ISO 13485 certificate, but it does require the manufacturer to maintain a quality management system. In practice ISO 13485 is the accepted way to demonstrate this, and notified bodies assess the system against it. For most device classes certification is effectively unavoidable.
Do I need a notified body?
It depends on the device class. For class I devices that are non-sterile, without a measuring function and non-reusable surgical, the manufacturer draws up the declaration itself. For class I with those features and for classes IIa, IIb and III, a notified body must be involved in conformity assessment.
How long does certification take?
For a manufacturer starting from scratch the realistic timeline is six to twelve months. The longest parts are design documentation, the risk management file and validation of special processes. For distributors and subcontractors without design activities the timeline is considerably shorter.
What is ISO 14971 and is it mandatory?
ISO 14971 is the standard for applying risk management to medical devices. ISO 13485 requires risk management across the life cycle without prescribing a method, but ISO 14971 is the accepted framework in practice and notified bodies expect a risk management file prepared in line with it.
Can we combine ISO 13485 with ISO 9001?
Yes. Many manufacturers maintain both, because customers outside the medical sector require ISO 9001. The shared structure allows a single documentation set with additional requirements where ISO 13485 is stricter. A combined audit is shorter than two separate ones.
Is the certificate valid for the US market?
ISO 13485 is internationally recognised and serves as the basis for the quality system in other jurisdictions too, but it does not replace registration and the requirements of the relevant regulator. The US operates a separate regime, while the MDSAP programme allows a single audit to cover the requirements of several participating countries.
Start with regulatory classification
The device class determines the whole path ahead — documentation, notified body, timeline and budget. That conversation usually takes an hour and saves months in the wrong direction.