The Ultimate Guide to ISO 13485:2016

Created for the medical device industry, ISO 13485 is a global standard set by the International Organization for Standardization (ISO). It is designed to serve a wide range of organizations and is widely used globally, driven by EU and Canadian requirements. The standard isn’t just for manufacturers—it’s equally valuable for those involved in design, installation, servicing, and related service providers.

ISO 13485 is key to ensuring that organizations can consistently meet customer needs and regulatory requirements.

In 2024, the Food and Drug Administration (FDA)—the federal agency within the United States Department of Health and Human Services—incorporated ISO 13485 into its quality system requirements for medical devices, underscoring its status as a globally recognized standard for medical device quality management systems. This will go into effect for the FDA on February 2, 2026, allowing manufacturers time to align their processes.

According to the ISO survey of certifications to management system standards 2022, 29,741 certificates were issued in 2022, with 40,449 sites worldwide using ISO 13485:2016.

What Is ISO 13485:2016?

ISO 13485 is the internationally recognized standard that outlines the requirements for a Quality Management System (QMS) specifically for the medical devices industry.

This standard helps organizations consistently meet customer requirements and deliver safe, high-quality medical devices.

ISO 13485:2016 is the latest iteration of the standard and includes several changes that enhance its effectiveness and applicability. Compared with the previous version (2003), it places increased emphasis on risk management and risk-based decision-making, aligning with the sector’s focus on patient safety. It also extends the application of QMS requirements to the entire lifecycle of medical devices, from design and development to post-market reviewing.

It takes a broader view of the supply chain and outsourced processes, ensuring that the QMS addresses all stages of the production process. This iteration of the standard was designed to be more compatible with other regulatory requirements and global regulations.

Read our guide to understanding what a quality management system is.

Who Needs ISO 13485?

ISO 13485 certification is crucial for a wide array of organizations involved in the medical device industry. This includes businesses that design, develop, produce, install, and service medical devices.

Businesses that use this standard include those providing sterilization, calibration, or distribution services.

Manufacturers of raw materials or components used to make medical devices, contract service providers, and consultancies offering regulatory or quality management advice in this sector can also greatly benefit from this certification.

ISO 13485 is often a requirement for any organization doing business in the medical device sector, as it’s recognized and respected globally. It is a regulatory or legal requirement in many markets, including the EU, Canada, and Australia.

Achieving this certification demonstrates an organization’s commitment to quality, customer satisfaction, and regulatory compliance.

Read about ISO standards for medical devices.

ISO 9001 vs ISO 13485

ISO 9001 and ISO 13485 are both standards for Quality Management Systems, but they are designed for different purposes and are not interchangeable. If your organization is part of the medical device industry and you have ISO 9001, you may wish to also consider becoming certified in ISO 13485.

Although the two standards’ structure and content share some similarities, they also have key differences outlined in the table below.

	ISO 9001	ISO 13485:2016
Application	Broad, applicable to any organization in any industry seeking to implement a general QMS.	Specific to the medical devices industry.
Focus	Focuses on customer satisfaction, continual improvement, and the effectiveness and efficiency of the QMS.	As well as focusing on customer satisfaction and the effectiveness of the QMS, it specifically emphasizes meeting regulatory requirements and managing specific risks associated with medical devices to ensure patient safety.
Structure	Uses the high-level structure (HLS) and the ‘process approach.’	Has moved away from the HLS and the ‘process approach’ used in ISO 9001:2015, focusing instead on a ‘risk-based approach’.
Primary Goal	Emphasizes continual improvement and customer satisfaction.	Focuses more on ensuring the safety and effectiveness of a medical device.

 

If your business operates in the medical devices industry, ISO 13485 will be more appropriate, especially if you operate in regulated markets where this certification is often a legal requirement. However, if your organization supplies medical devices as part of a broader product or service portfolio, certification to both standards could be beneficial.

What’s the Difference Between ISO 13485 and EN ISO 13485?

ISO 13485 and EN ISO 13485 represent the same international standard for Quality Management Systems specific to the medical devices industry. The ‘EN’ means that it is a European standard.

EN ISO 13485 is the EU version of the global ISO 13485 standard and includes an additional annex known as the ‘Z annex.’ This annex compares the EN ISO 13485 standard’s requirements with the specific requirements of the European Union’s directives for medical devices.

Besides the Z annex, EN ISO 13485 and ISO 13485 are identical standards. Each aims to ensure consistent design, development, production, installation, and delivery of safe medical devices.

Is ISO 13485 a Mandatory Requirement?

ISO 13485 certification is not a mandatory requirement globally. It is a voluntary standard that organizations can choose to implement and certify for.

However, in some jurisdictions, such as the European Union, Canada and Australia, compliance with ISO 13485 (or its regional equivalent) is essentially mandatory, as it is a regulatory requirement for organizations handling certain types of medical devices.

Even in markets where it isn’t mandatory, ISO 13485 certification is widely recognized and beneficial. It demonstrates a commitment to quality and regulatory compliance.

Benefits of ISO 13485:2016

There are several benefits to becoming ISO 13485 certified:

1. Enhanced Product Quality – ISO 13485 can help your organization improve its product quality, increasing customer trust and satisfaction by standardizing processes and implementing rigorous quality checks.
2. Operational Efficiency – The standard promotes an efficient and effective QMS. Following its guidelines and processes can help identify inefficiencies and streamline operations, reducing costs and improving profitability.
3. Regulatory Compliance – This standard is aligned with many regulatory requirements in the global medical device industry. Compliance with ISO 13485 can help meet these requirements, allowing for broader market access and risk reduction.
4. Risk Management – ISO 13485 places significant emphasis on risk management throughout the product production process, helping organizations identify, analyze, and mitigate potential risks to patient safety and device functionality.
5. Customer Confidence – Certification demonstrates an organization’s commitment to quality and safety, building trust and confidence among customers and other stakeholders.
6. Increased Market Access – This standard is recognized globally and is a requirement in several markets for specific device classes. Becoming certified could open up doors to new market opportunities.
7. Competitive Advantage – ISO 13485 certification provides a competitive advantage as it demonstrates a commitment to quality and safety—this could help your organization stand out within a highly competitive market.
8. Continuous Improvement – The standard promotes a culture of continuous improvement, ensuring the QMS remains effective and adjusts to changes in business needs and industry regulations.

Read more about the benefits of ISO 13485 for medical device manufacturing.

The Key Requirements of ISO 13485

ISO 13485 sets out specific requirements that a business must meet to become certified:

• Quality Management System – The organization must have a robust QMS that includes documented information, risk-based approaches and a focus on customer satisfaction and product safety.
• Management Responsibility – Management must demonstrate commitment to the QMS, setting quality objectives, ensuring customer focus, and making internal communication easy and clear. They should also review the QMS regularly to ensure its continuing suitability and effectiveness.
• Resource Management – The organization must have adequate resources, including trained personnel and a suitable infrastructure and environment. It also needs to control contamination and ensure the cleanliness of products.
• Product Realization – The organization must plan and control the processes needed to produce the medical device. This includes requirements for product quality, design and development, purchasing, production and service provision, and control of monitoring and measuring equipment.
• Measurement, Analysis and Improvement – Monitoring and measuring the characteristics of the product to verify that product requirements are met is essential. This includes gathering feedback, handling complaints, internal audits, monitoring and controlling products, and processing non-conformities. It also covers data analysis, corrective action, preventive action, and continuous improvement.
• Regulatory Requirements – The organization must identify and keep up to date with regulatory requirements and ensure its processes meet them. It also needs to maintain a technical file and undergo a regulatory review.

How Much Does ISO 13485:2016 Certification Cost?

The cost of ISO 13485 certification can vary depending on several factors, including your organization’s size and complexity, the current state of your management systems and the certification body you choose.

Typical costs can include the initial assessment, the certification audit and surveillance audits for the duration of the certification cycle. Other costs might include consulting services, staff training, or process adjustments.

Before going ahead with an ANAB (ANSI National Accreditation Board)-accredited certification body, request a detailed quotation to understand the potential costs.

The benefits of ISO 13485 certification often outweigh the costs, particularly in the competitive medical device industry, making it worth the investment.

How Long Does It Take to Get ISO 13485 Certification?

If your organization is starting from scratch, it could take anywhere from six months to over a year to achieve ISO 13485 certification.

This includes time for gap analysis, developing and implementing processes, staff training, internal audits and the certification audit by an ANAB-accredited certification body such as Orion Registrar, Inc.

However, every journey to certification is unique, and if you already have a well-established QMS like ISO 9001, the process could be quicker.

Several factors can affect the time it takes to become certified, including the size of your organization, the current state of your management system and the available resources.

The ISO 13485 Certification Process

The process of securing an ISO 13485 certification involves several steps.

First, you need to understand the standard’s requirements and develop or update your pre-existing QMS accordingly. This often involves conducting a gap analysis to identify areas for improvement.

Once your QMS is ready, the certification process begins with a Stage 1 audit. This is when your chosen certification body reviews your documented QMS to assess whether it complies with ISO 13485 requirements. If any non-conformities are found, changes must be made and reassessed before proceeding to the next step.

Once you have successfully completed the Stage 1 audit, the certification body will then perform a Stage 2 audit. This is a more thorough assessment of your QMS, including its implementation and effectiveness.

If the Stage 2 audit is successful, your organization will then be granted ISO 13485 certification. This certification is valid for three years and subject to satisfactory ongoing audits.

Get started on your journey to ISO 13485 certification—Get a quote today or contact our team to discuss your needs.