ISO 13485
ISO 13485 is the international standard for a medical device quality management system (QMS): the documented processes that keep devices safe from design through production to complaints. It is voluntary and certifiable, but device regulators in the EU, the UK, the US and elsewhere rely on it, so manufacturers and their critical suppliers treat it as the price of entry.
What it is and who it applies to
The current edition is ISO 13485:2016, whose full title says it is a quality system standard “for regulatory purposes”. ISO reviewed it in 2025 and confirmed it unchanged, so no new edition is in force. It carries no ISO amendment. The European version, EN ISO 13485:2016, has a corrigendum (AC:2018) and a European annex amendment (A11:2021) that map it to EU MDR. With them it is a harmonised standard, and meeting it presumes conformity with the parts of the law it covers (EU MDR Article 8).
Unlike ISO 27001 or ISO 9001:2015, it does not follow the Annex SL layout shared by most modern ISO management system standards. It keeps the older eight-clause shape of ISO 9001:2008, with its requirements in clauses 4 to 8, and an annex maps them to ISO 9001:2015.
It applies to any organisation involved in a device’s life: designers, manufacturers, sterilisers, distributors, installers and servicers, and suppliers of components or services. The commercial trigger is regulation. EU MDR Article 10(9) requires every manufacturer to run a quality management system, and lists what it must cover. Notified bodies audit that system against ISO 13485. The US Food and Drug Administration incorporated ISO 13485:2016 into its device quality rule from 2 February 2026, and the Medical Device Single Audit Program lets one audit serve regulators in Australia, Brazil, Canada, Japan and the United States.
You record your role up front. ISO 13485:2016 4.1 asks you to document whether you act as manufacturer, importer, distributor or something else, because the rest of the standard bends to it.
This is guidance to help you understand the requirement, not legal advice.
Structure
Clauses 1 to 3 set the scope and terms. Clauses 4 to 8 hold the requirements. Clause 1 also allows two kinds of narrowing: design and development (7.3) may be excluded where the regulations you work under permit it, and any other requirement of clauses 6, 7 or 8 that cannot apply to your activities or device may be left out. Each needs a justification in the quality manual (ISO 13485:2016 4.2.2).
| Clause | What it asks for, in plain English | Covered in |
|---|---|---|
| 4 | Document the QMS and your regulatory role, control outsourced work and QMS software, keep a quality manual, a file per device type, and controlled documents and records | Quality management system |
| 5 | Top management commits, sets the quality policy and objectives, appoints a management representative and reviews the system under a documented procedure | Management responsibility |
| 6 | Provide competent people, maintained infrastructure and a controlled work environment, with contamination control where it matters | Resource management |
| 7.1, 7.2, 7.4–7.6 | Plan realisation with risk management, agree requirements, control suppliers, production, process validation, traceability and measuring equipment | Product realisation |
| 7.3 | Control design from plan to transfer, manage design changes and keep a design file per device | Design and development |
| 8.1, 8.2, 8.4 | Gather feedback, handle complaints, report to regulators, audit yourself, monitor processes and product, and analyse the data | Measurement and analysis |
| 8.3, 8.5 | Control nonconforming product, and run corrective and preventive action | Improvement |
Three habits run through every clause. The standard asks for many more documented procedures than ISO 9001 does. It asks you to scale controls to risk, from supplier checks to software validation. And it keeps asking whether a change affects regulatory requirements or the safety and performance of the device.
Certification and enforcement
Certification to ISO 13485 itself is voluntary. Accredited certification bodies issue certificates; in the UK, look for one accredited by UKAS for medical devices. The audit runs in two stages: stage 1 checks the system is designed, documented and ready, and stage 2 samples records and interviews people to check it runs. A certificate lasts three years, with surveillance audits in between and a recertification audit before it expires.
For most device manufacturers the certificate is only half of it. Under EU MDR, a notified body assesses your quality system as part of the device’s conformity assessment (EU MDR Annex IX for most devices above the lowest class), and in Great Britain an approved body does the same under UK MDR 2002. Many of those bodies issue an ISO 13485 certificate from the same audit. Under the law, a competent authority or the MHRA can act on a quality system that fails, through findings, suspended certificates or market action against the device; ISO itself enforces nothing.
What the certificate scope tells a buyer
The scope names the activities certified, such as design, manufacture or distribution, and the device categories. A certificate that excludes design says the holder builds to someone else’s design. Hospitals and distributors read the scope, and so do notified bodies auditing your suppliers.
How long the first certificate takes depends on how far the device is from market, how many device families and sites are in scope, how much is outsourced, and whether design records already exist. The certification body will want to see records of the system running, including an internal audit and a management review, before stage 2.
How the pieces fit
Risk is the thread. You record your regulatory role and requirements (ISO 13485:2016 4.1), then risk management runs through product realisation (ISO 13485:2016 7.1), using ISO 14971 for the method. Risk feeds design inputs (ISO 13485:2016 7.3), which become specifications for purchasing and production. Once the device is on the market, feedback and complaints (ISO 13485:2016 8.2.2) flow back into risk management, corrective and preventive action fix causes (ISO 13485:2016 8.5.2), and management review (ISO 13485:2016 5.6) decides what changes.
The pairing with ISO 14971:2019 matters at audit. ISO 13485 requires risk management but does not say how to do it; ISO 14971 supplies the method and the risk management file. Auditors trace one thread: a hazard in the risk file, the design input that controls it, the verification that proves it, and the complaint trend that would show it failing.
Software has its own pair. Device software follows IEC 62304 for its life cycle, and user interfaces follow IEC 62366-1 for usability; both slot into clause 7.3. For the law that sits above all of this, read the EU MDR and UK MDR 2002 hubs. If you already run ISO 9001, most of your system carries over.
In this section
- Quality management system and documentation: what goes in the quality manual and the medical device file, and how long you keep documents and records?
- Management responsibility: what must top management and the management representative do, and what does the review cover?
- Resource management: how do you prove competence, maintain infrastructure and control the work environment?
- Product realisation: how do planning, purchasing, production, process validation and traceability work?
- Design and development: what are design controls, and what goes in the design and development file?
- Measurement, analysis and feedback: how do feedback, complaints, regulatory reporting and internal audit fit together?
- Nonconforming product, corrective and preventive action: what happens when a product or process goes wrong?
How Sted maps it
ISO 13485 is one of the standards, regulations and schemes in Sted’s catalogue.
Sted treats it as mandatory when a device regulation applies to you in a role that carries a full quality-system duty, such as manufacturer under EU MDR or UK MDR 2002. It is committed when you hold MDSAP certification, hold or pursue the certificate, or a customer requires it, and recommended when your role carries only a narrower quality duty or Sted’s benefit assessment suggests it. While a device’s qualification is still open, the answer is pending rather than no. Those rules work from your recorded onboarding answers; the AI model does not decide them.
Sted recommends it with its reasons, and you select it or leave it. Administrators and Policy and Process Owners make that choice. Choosing it and pressing Update and generate framework builds the documents it needs.
For ISO 13485 Sted’s knowledge base carries 23 policies and procedures and 60 record templates tagged to its clauses, including the post-market surveillance, sterility, software, traceability and design records a device maker needs, over a 29-row clause catalogue. They are drafted for your organisation for you to review and approve. Your scope, interested parties and compliance obligations sit in management-system registers drafted from your answers.
Because the catalogue is made of clauses rather than annex controls, the Statement of Applicability card for ISO 13485 lists clauses. That is where you record a clause of 6, 7 or 8 that does not apply to you, with its reason.
Sted does not certify you, audit your quality system or act as your notified body. It prepares the documents and records an auditor samples, and shows how much of that work is done.
- Sted keeps a Statement of Applicability for each adopted standard with a control catalogue.
- Only standards with a control catalogue get a Statement of Applicability card.
- You can exclude a control with a coded reason and justification and record its implementation status.
- Only evidence from the last 12 months counts towards readiness.
Sted does not certify you, assess your device’s conformity or report to a regulator. A certification body or notified body audits; Sted prepares the evidence.
Frequently asked questions
Is ISO 13485 mandatory for medical device manufacturers?
Not as a standard. The law requires the quality management system: EU MDR Article 10(9) for the EU and Northern Ireland, and the conformity assessment routes of UK MDR 2002 for Great Britain. ISO 13485 is the accepted way to meet that requirement, and a manufacturer of anything riskier than a self-declared device will almost always certify to it.
Do we need ISO 13485 as a medical device startup?
Yes, once you intend to be the legal manufacturer of a device that needs a notified body or approved body, because that body audits your quality system. Start with the parts that bite first: design controls, risk management and document control. Production, servicing and supplier controls can grow as the device moves from prototype to market.
Can we leave design and development out of our ISO 13485 scope?
Only if the regulations you work under allow it, which usually means you do not design devices yourself, for example a contract manufacturer building to a customer’s design. A legal manufacturer under EU MDR carries design responsibility, so it cannot exclude it. Any exclusion is justified in the quality manual and appears on the certificate’s scope.
Does an ISO 13485 certificate let us CE or UKCA mark our device?
No. The certificate shows your quality system meets the standard. A CE or UKCA mark also needs the device’s own conformity assessment: technical documentation, clinical evidence and, above the lowest class, a notified body or approved body certificate.
What is the difference between ISO 13485 and ISO 9001?
ISO 13485 is built for regulators, ISO 9001 for customers. ISO 13485 asks for more documented procedures, a medical device file, risk management in product realisation, complaint handling with regulatory reporting and a separate preventive action process. It puts less weight on customer satisfaction and continual improvement, so one certificate does not stand in for the other.