What ISO 13485 is and why buyers ask for it
ISO 13485 is the international standard for a quality management system specific to medical devices. While it shares the structure of a general quality system, it is written for the realities of designing, manufacturing and servicing devices where safety and regulatory compliance are paramount. It is the recognised baseline that the medical device industry expects.
For medtech manufacturers, ISO 13485 is rarely optional in practice. Conformity assessment for CE marking under the EU Medical Device Regulation is closely aligned with it, and customers, distributors and notified bodies expect to see it. Without it, market access and supply relationships stall. An ISO 13485 certificate gives that assurance internationally and is among the higher-value certifications ABS supports for the healthcare and life-sciences sector.
In the United States, the FDA’s Quality Management System Regulation (QMSR), in force since 2 February 2026, incorporates ISO 13485:2016 by reference, making it the core of the quality system requirements for most device manufacturers; the FDA does not require ISO 13485 certification, and a certificate does not replace an FDA inspection.
What the certification audit covers
Certification is a two-stage assessment built around the demands of device quality, including:
- Design and development controls, where these apply to your scope
- Risk management across the product lifecycle
- Document and record control, with the traceability the sector requires
- Supplier and purchasing controls
- Production and process controls, including sterilisation and cleanliness where relevant
- Handling of complaints, corrective actions and regulatory reporting
Surveillance audits across the three-year cycle confirm the system stays effective as products and regulations evolve. The bar for evidence is deliberately high, which is also why a clean ISO 13485 certificate carries weight with buyers.
How ABS helps
We prepare you for the certification audit in five steps, tailored to ISO 13485:
- Scope and gap assessment — we agree the scope of your quality management system and assess what you already have against the standard, so you know exactly what to close.
- Implementation — we help you build the controls the standard demands: design and development where it applies, risk management across the product lifecycle, document and record control with full traceability, supplier controls, and complaint handling and regulatory reporting.
- Internal audit and management review — we help you run the internal audit and management review the standard requires, so the system has a record of operating before the audit.
- Readiness check — a pre-assessment, approached the way an auditor would approach it, highlights anything still to close.
- Audit support — we support you through the certification body’s Stage 1 and Stage 2 audits and help you close any findings.
Typical timeline
For most organisations, ISO 13485 certification takes around 12–16 weeks from kick-off, depending on the complexity of your products and processes and how mature your quality system already is. Design-active manufacturers typically sit at the longer end. Each engagement begins with a fixed-price scoping call and a proposal within 24 hours.
Common questions
What is the difference between ISO 13485 and ISO 9001?
Both are quality management standards, but ISO 13485 is purpose-built for medical devices, with far stronger emphasis on regulatory requirements, risk management, design controls and traceability. Organisations sometimes hold both — ISO 9001 for general quality and ISO 13485 for device-specific activities.
Is ISO 13485 required for CE marking of medical devices?
ISO 13485 is not legally mandatory, but it is the recognised way to demonstrate a compliant quality management system, and conformity assessment under the EU Medical Device Regulation is closely aligned with it. Most manufacturers seeking CE marking maintain ISO 13485 as the foundation.
Who needs ISO 13485?
Manufacturers of medical devices and the suppliers and service providers in their supply chain — design houses, contract manufacturers, sterilisation services and distributors — where customers or regulators expect a device-specific quality system. It is especially relevant across healthcare and life sciences.
How long does ISO 13485 certification take?
For most organisations, ISO 13485 certification takes around 12–16 weeks from kick-off, depending on the complexity of your products and processes and how mature your quality system already is. Design-active manufacturers typically sit at the longer end.
What does ABS do, and what does the certification body do?
ABS prepares you for certification: we agree the scope of your medical device quality management system, assess the gaps, help you implement it, support your internal audit and management review, check readiness and support you through the audits. The certification body, an independent, accredited organisation you choose, carries out the Stage 1, Stage 2 and surveillance audits, makes the certification decision and issues the certificate.
How long is an ISO 13485 certificate valid?
Three years. The certification body carries out surveillance audits in the first and second years, and a recertification audit before the three-year cycle ends.
Can ISO 13485 be combined with other standards?
Yes, although ISO 13485 keeps the older structure of ISO 9001:2008 rather than the harmonised structure used by most ISO management system standards. It can still run within one integrated management system alongside, for example, ISO 9001, ISO 14001 or ISO 27001, and certification bodies can often audit them together.
Which edition of ISO 13485 is current, and is there a transition?
The current edition is ISO 13485:2016, and there is no transition under way.
