ISO 13485 is the international standard for a medical device company’s quality management system: the documented way it designs, makes, checks, sells and services its products, and proves it did so. Regulators in Europe, Canada, Australia and elsewhere expect it, and since February 2026 the US FDA’s own quality rule (the QMSR) is built on it. The current edition is ISO 13485:2016.
What it actually asks for
The standard doesn’t tell a company how to make a bone screw. It tells it to decide how, write it down, do it that way, keep the records, and fix things properly when they go wrong. Its main sections cover:
- The system and its documents: a quality manual, procedures, controlled documents and records, and a medical device file for each product type.
- Management responsibility: a quality policy and objectives, clear responsibilities, and regular management reviews of how the system is working.
- Resources: trained, competent people, suitable buildings and equipment, and a controlled work environment (such as a cleanroom) where the product needs one.
- Product realisation: planning, design and development controls, purchasing and supplier control, production, process validation, identification and traceability, sterile products, and control of measuring equipment.
- Measurement and improvement: feedback and complaints, reporting to regulators, internal audits, monitoring processes and product, handling nonconforming product, and corrective and preventive action (CAPA).
Risk runs through all of it: the standard expects decisions to be proportionate to the risk to patients, with ISO 14971 used for product risk management.
An example: one bone screw
Follow one 3.5 mm screw and you meet most of the standard. Its design was verified against measurable requirements. The titanium bar came from an approved supplier with a material certificate. The lathe program and the cleaning and sterilisation processes were validated. Every screw carries a lot number that links back to the bar, the machine and the inspections. If a surgeon reports one breaking, the complaint is investigated, reported to the regulator if required, and, if the cause is real, fixed through CAPA. Unit 1 follows exactly this screw →
Certification
A company is certified to ISO 13485 by an independent, accredited certification body (in Europe, often its notified body). The usual cycle:
- Stage 1 audit: a review of the documented system and readiness.
- Stage 2 audit: on site, checking that the system is actually followed, with records to prove it.
- Certificate: valid for three years, with surveillance audits at least yearly and a full recertification audit before it expires.
Findings are graded as major or minor nonconformities; majors must be fixed before a certificate is issued or kept.
How it fits with the regulations
- European Union: the Medical Device Regulation (MDR) requires a quality management system, and EN ISO 13485 is the harmonised standard most manufacturers use to show it.
- United States: the FDA’s Quality Management System Regulation (QMSR, 21 CFR Part 820), in force since 2 February 2026, incorporates ISO 13485:2016 by reference and adds some FDA-specific requirements. The FDA still inspects companies itself and doesn’t issue or require ISO certificates.
- MDSAP: the Medical Device Single Audit Program lets one audit by a recognised auditing organisation serve the regulators of Australia, Brazil, Canada, Japan and the US. Canada requires it.
Certification to ISO 13485 doesn’t by itself allow a product to be sold anywhere; each market still has its own approval route, such as the 510(k) in the US or CE marking in the EU. Unit 12 covers those routes →
ISO 13485 vs ISO 9001
ISO 9001 is the general quality standard for any business. ISO 13485 grew from it but is stricter and more prescriptive where patients are at risk: more required documents and records, explicit design controls, process validation, traceability and regulatory reporting. It puts less weight on customer satisfaction and continual improvement for their own sake, and more on staying effective and compliant.
Getting started
- Decide the scope: what the company does (design, manufacture, distribution, servicing) and for which products.
- Run a gap analysis against the standard and the regulations of the markets you’ll sell in.
- Write the procedures you actually need, train people on them, and start keeping records.
- Run the system for a few months, hold internal audits and a management review, then book the certification audit.
The commonest mistake is writing a perfect manual that nobody follows. Auditors look at the records, and the records show what really happens. Unit 11 is a hands-on tour of a quality system →
