ISO 13485 Certification: Requirements and Steps

ISO 13485 is the international standard for quality management systems in the medical device industry. ISO 13485 certification means an accredited third party has audited your quality management system and confirmed that it meets the standard. Whether you need that certificate, though, depends on where you sell, and in the United States the answer changed in 2026.

This guide explains what ISO 13485 requires, who needs certification in the US, Canada and the EU, how the standard compares with ISO 9001, and the steps to get certified.

What is ISO 13485?

ISO 13485:2016, "Medical devices — Quality management systems — Requirements for regulatory purposes," sets out what a quality management system (QMS) must do for an organization involved in any stage of a medical device's life cycle: design and development, production, storage and distribution, installation, servicing, and the supply of related services or components.

It is written for regulators as much as for quality teams. The standard's priority is that devices are safe and effective and that the organization meets the regulatory requirements that apply to it, which is why it asks for more documentation and control than a general quality standard.

The 2016 edition is still the current one. ISO reconfirmed it after its scheduled review in 2025, so there is no new edition to transition to right now.

Do you need ISO 13485 certification?

It depends on your markets. The three that matter most to North American manufacturers handle it differently:

The US change is the one that catches people out. Under the FDA's QMSR, conformity to ISO 13485:2016 is now part of US law for device manufacturers, but the FDA inspects against the regulation itself. A certificate doesn't replace an inspection, and the QMSR adds FDA-specific requirements that ISO 13485 alone doesn't cover. So a certified QMS is a strong starting point for the US, not proof of compliance.

In Canada, Health Canada requires manufacturers of Class II, III and IV devices to hold an ISO 13485 certificate issued under the Medical Device Single Audit Program (MDSAP). A certificate from a non-MDSAP audit isn't enough for a licence. See our guide to preparing for MDSAP audits.

Even where certification isn't legally required, many customers, distributors and contract manufacturing partners ask for it before they will work with you.

What ISO 13485 requires: the main clauses

The requirements sit in clauses 4 to 8. Clauses 1 to 3 cover scope, normative references and definitions.

A few requirements tend to need the most work for companies coming from a general QMS:

• The medical device file. For each device type or family, you maintain a file that describes the device, its intended use, labeling, specifications and the procedures for making, storing, installing and servicing it.
• Risk management. Risk-based decisions are expected across the QMS, and risk management is required throughout product realization. Most manufacturers use ISO 14971 as their risk management process.
• Design controls. Design and development planning, inputs, outputs, review, verification, validation, transfer and changes all need to be documented.
• Complaint handling and regulatory reporting. You need a documented process for complaints and for reporting to regulators where required. Our ISO 13485 complaint handling guide covers this in detail.
• Software validation. Software used in the QMS and in production must be validated for its intended use. See how to do QMS validation.

ISO 13485 vs. ISO 9001

ISO 13485 began as a medical device version of ISO 9001, but the two have grown apart:

Being ISO 9001 certified doesn't make you ISO 13485 compliant, though a working ISO 9001 system gives you a head start on document control, internal audits and corrective action. For more on ISO 9001, see our ISO 9001 guide.

How to get ISO 13485 certified

1. Define your scope and markets. Decide which sites, device types and activities the QMS covers, and which markets you are certifying for. If Canada is on the list, you'll need an MDSAP auditing organization from the start.
2. Run a gap analysis. Compare your current processes and records with each clause of ISO 13485 and with the regulations in your target markets.
3. Build or update the QMS. Write the quality manual and required procedures, set up the medical device files, and put risk management, design controls, supplier controls and complaint handling in place.
4. Train people and run the system. Train staff on the procedures that apply to them and generate real records. Auditors want to see the system working, not just documented.
5. Hold internal audits and a management review. Audit every part of the QMS, fix what you find through CAPA, and complete at least one management review before the certification audit. See mastering the internal quality audit.
6. Choose an accredited certification body. Pick an accredited registrar, an EU notified body, or an MDSAP auditing organization, depending on your markets.
7. Complete the certification audit. This is normally done in two stages: a review of your documentation and readiness, then an on-site audit of how the QMS works in practice. Any nonconformities must be closed before the certificate is issued.
8. Maintain it. Certificates are typically valid for three years, with surveillance audits in between and a recertification audit at the end of the cycle.

How long this takes depends on your starting point, the size of your scope and how many of your processes already produce records.

Common ISO 13485 certification mistakes

• Treating certification as US compliance. Since the QMSR, a certificate helps, but the FDA still inspects against Part 820 and its FDA-specific requirements.
• Choosing the wrong audit program. A standard ISO 13485 certificate won't support a Canadian licence for Class II–IV devices. That needs MDSAP.
• Documenting without operating. Procedures with no records behind them are one of the most common audit findings.
• Leaving risk management to the design team. Risk needs to flow into purchasing, production, complaints and CAPA, not just design.
• Uncontrolled software and spreadsheets. Tools used to run the QMS need validation and change control too.

Managing an ISO 13485 QMS in an eQMS

ISO 13485 is a records-heavy standard. Document control, training, complaints, nonconformances and CAPA all have to connect, and auditors will follow a single issue across all of them. Keeping those records in shared drives and spreadsheets makes that trail hard to show.

An eQMS such as the Isolocity platform keeps document control, training records, nonconformances and CAPA in one place, so the evidence an auditor asks for is linked and easy to retrieve. For a wider view of life sciences quality, see our life sciences quality management guide.

ISO 13485 FAQs

What is ISO 13485 certification?

It is confirmation from an accredited certification body that your quality management system meets ISO 13485:2016, issued after a successful certification audit and maintained through surveillance audits.

Is ISO 13485 mandatory?

The standard itself is voluntary, but regulators make it effectively mandatory in many markets. In the US, the QMSR incorporates ISO 13485:2016 into 21 CFR Part 820. In Canada, Class II–IV device licences require MDSAP certification to ISO 13485.

Does the FDA require ISO 13485 certification?

No. The FDA requires conformity to the QMSR, which incorporates ISO 13485:2016, but it doesn't require or issue certificates, and a certificate doesn't exempt a manufacturer from FDA inspection.

What is the current version of ISO 13485?

ISO 13485:2016. ISO reconfirmed it after its 2025 systematic review.

Who needs ISO 13485?

Organizations involved in any stage of a medical device's life cycle, including manufacturers, contract manufacturers, component and service suppliers, and distributors, especially those selling into regulated markets.

Conclusion

ISO 13485 is the backbone of medical device quality management in most major markets. The certificate matters most in Canada and for EU notified body routes, while in the US it is now the content of the standard, through the QMSR, that carries the legal weight. Either way, certification is only as strong as the records behind it.

To see how the Isolocity platform connects documents, training, nonconformances and CAPA for medical device teams, book a demo.