ISO 13485:2016
ISO 13485 certification for medical device quality management
Independent certification of a quality management system built around medical device safety, performance and regulatory requirements.
- Valid for
- 3 years
- Surveillance
- Years 1 and 2
- Verification
- Public register
Accredited and empanelled
What is ISO 13485?
ISO 13485 specifies quality management system requirements for organisations involved in any stage of a medical device's life cycle: design and development, production, storage and distribution, installation, servicing, and related activities such as sterilisation. Its emphasis is on device safety and performance and on meeting regulatory requirements.
The current edition is ISO 13485:2016. Unlike ISO 9001, it does not follow the harmonised structure and is more prescriptive, requiring documented procedures, risk management through product realisation, design transfer, validation of processes and of software used in the system, traceability, complaint handling and reporting to regulatory authorities.
Regulators rely heavily on the standard; the US FDA's Quality Management System Regulation incorporates ISO 13485:2016 by reference. An ISO 13485 certificate is not CE marking or market authorisation, which come from notified bodies and regulators, but it is often a prerequisite for them and for supplier approval by device manufacturers.
Who it is for
- Medical device manufacturers
- Contract manufacturers and sterilisation providers
- Component and material suppliers to device makers
- Distributors and importers of medical devices
- Developers of software as a medical device
- Servicing and repair providers
What sets audit time and cost
Application to certification decision typically takes twelve to sixteen weeks; manufacturers with design responsibility or sterile devices should expect the longer end.
- Number of personnel, with audit time set under IAF MD 9
- Device types, risk classes and technical areas in scope
- Design and development responsibility
- Sterile devices and other special processes
- Outsourced processes and number of sites
Why it matters
What ISO 13485 gives you
- 01
Regulatory alignment
A system built to ISO 13485 matches what device regulators in many markets expect to see.
- 02
Supplier approval
Device manufacturers commonly require ISO 13485 from contract manufacturers and critical suppliers.
- 03
Risk managed through the life cycle
Risk management links design, production and post-market information, so issues found in the field reach design decisions.
- 04
Traceable product history
Device history and traceability records support complaint investigation, advisory notices and recalls.
The audit
What our auditors examine
- 01
Regulatory requirements and roles
Which regulatory requirements apply to you, the role you hold, such as manufacturer, importer or distributor, and how they are built into the system.
- 02
Risk management
Risk management through product realisation, commonly following ISO 14971, and its links to design and post-market data.
- 03
Design and development
Design planning, inputs, outputs, review, verification, validation, transfer, changes and the design and development file.
- 04
Process and software validation
Validation of special processes such as sterilisation, sealing and moulding, and of software used in production and the quality system.
- 05
Complaints and reporting
Complaint handling, regulatory reporting, advisory notices and the feedback process.
- 06
CAPA
Corrective and preventive action with investigation, verification of effectiveness and records.
How certification works
Every accredited certificate follows the same three-year cycle, with each step recorded and the result published in our register.
01
Application and quote
Tell us your scope, sites and headcount. We calculate audit time under the accreditation rules and send a fixed quote and audit plan.
02
Stage 1 audit
We review your documented management system, scope and readiness, and agree the Stage 2 plan. Any gaps are reported so you can close them first.
03
Stage 2 audit
Auditors check that the system works in practice: interviews, records and observation across the scope. Nonconformities are raised in writing.
04
Certification decision
Once corrective actions are accepted, a reviewer who did not take part in the audit makes the decision. Your certificate is issued and listed in the public register.
05
Surveillance audits
Shorter audits in the first and second years after certification confirm the system is maintained and improving. The register shows your current status throughout.
06
Recertification
Before the three-year certificate expires, a recertification audit reviews the whole system and renews the certificate for another cycle.
Related standards and audits
Often certified or audited alongside this one, sometimes in a single combined audit.
ISO certification
ISO 9001
Independent assessment of your quality management system against ISO 9001:2015, by an accredited certification body.
ISO certification
ISO 27001
Independent certification of your information security management system against ISO/IEC 27001:2022.
ISO certification
ISO 14001
Independent certification of how your organisation identifies, controls and reduces its environmental impact.
ISO certification
Product certification
Independent confirmation that specified products and models conform to the standards or specifications named on the certificate.
ISO 13485 questions
We audit; we do not consult.
To keep certification independent, we never design, build or fix the systems we audit, and decisions are made by people who did not take part in the audit. Read our impartiality policy.
Plan your ISO 13485 certification
Tell us your scope, sites and timeline. We reply with an audit plan and a fixed quote.