ISO 13485 is no longer just a standard. In the United States, it's the regulation.

What the QMSR actually changed

The shift is real but narrower than some of the consulting noise suggests. Four things are worth understanding before you spend money on anything.

What ISO 13485 asks of you

Stripped of the language, the standard asks you to establish how a device gets designed, made and serviced safely, do it that way every time, keep records that prove it, and act on problems in the field. Where it parts company with ISO 9001 is in how much of that has to be written down, and in who you answer to when it goes wrong.

Where it goes beyond ISO 9001

Regulatory obligation replaces customer satisfaction as the organizing idea

ISO 9001 is built around meeting customer requirements and improving continually. ISO 13485 is built around meeting regulatory requirements and maintaining process effectiveness. That is not a small rewording. It changes what your management review discusses, what your objectives measure, and it adds an obligation to report to regulatory authorities that has no equivalent in ISO 9001.

Risk management runs through the whole lifecycle, not just your planning

Risk-based thinking in ISO 9001 largely shapes how you plan. In ISO 13485 risk drives specific decisions: which processes need validation, how far verification has to go, what design controls apply, and what post-market surveillance you owe. In practice this means working to ISO 14971 alongside the QMS, and being able to show the reasoning behind each decision rather than asserting that you considered risk.

Documentation is heavier, and specific records are named

You need a medical device file for each device or family, design and development records that trace requirement to verification, and retention periods tied to device lifetime rather than to whatever your document control procedure happens to say. An auditor will pick a device and follow it from design input through to a shipped unit. Any break in that chain is a finding.

Sterile devices bring their own requirements

If you sterilize, the process has to be validated and the validation kept current — not run once and filed. Contamination control, sterile barrier integrity, and validation of the packaging process itself all apply. Records for each sterilization batch have to be traceable to the devices in it.

The building and the people in it become controlled

ISO 13485 sets explicit expectations that infrastructure prevents mix-up and contamination: separated areas, controlled environmental conditions where the product needs them, and documented requirements for personnel health, cleanliness and clothing. For a shop coming from commercial or aerospace work, this is usually the most unfamiliar part of the standard.

How the work goes

Four stages, the same shape as any QMS project, with more documentation at every step than an ISO 9001 build. How long it takes depends on how many devices you make, whether you design them, whether you sterilize, and how much of a system already exists. Anyone quoting you a fixed duration before seeing your operation is guessing.

1. Map what exists against what's required

   A clause-by-clause review of your current system against ISO 13485 and the QMSR additions, including whatever was built to the old Part 820 and needs reconciling.

2. Build the system

   Procedures, the medical device file structure, design controls where you design, risk management tied to ISO 14971, and the records to support all of it. Written for how your operation actually runs.

3. Run it and generate the evidence

   Training, a full internal audit cycle, and management review conducted properly. Registrars and investigators both want proof the system has been operating, not just that the documents exist.

4. Audit or inspection readiness

   Mock audit, preparation for Stage 1 and Stage 2 if you're certifying, FDA inspection readiness if you're not, and support closing whatever gets raised.

Common questions

Do I have to be certified to ISO 13485 to sell in the United States?

No. You have to comply with the QMSR, which incorporates ISO 13485:2016 by reference, but the FDA does not require a certificate and holding one does not exempt you from inspection. Certification matters for EU market access, for customers and distributors who require it, and for MDSAP participation. It is a commercial decision rather than a federal requirement.

Is ISO 13485 certification enough for the EU?

No, though it's a necessary piece. The Medical Device Regulation and the In Vitro Diagnostic Regulation both impose obligations beyond the standard — clinical evaluation, technical documentation, post-market surveillance and vigilance reporting among them — and conformity assessment runs through a notified body. Certification demonstrates the quality system element. It does not carry the rest.

Should I wait for a new edition of ISO 13485?

No. ISO reviewed the standard in 2025 and confirmed the 2016 edition as current with no revision underway, partly to keep it stable now that the FDA has written it into regulation. The next systematic review falls around 2030. Unlike ISO 9001, where the sixth edition just published, there's nothing coming that would change what you build.

Do we need ISO 9001 certification before we can get ISO 13485?

No. ISO 13485 is a standalone standard and you can certify to it without ever holding ISO 9001. No registrar or notified body will ask you for one as a prerequisite. What is true is that most of the work overlaps, which is why building the quality system properly comes first in practice — not as a certification step, but because the medical device requirements sit on top of foundations that have to exist before they mean anything.

We're ISO 9001 certified. How much of that carries over?

A useful amount, though less neatly than you might expect. Your document control, purchasing, competence, internal audit, management review and corrective action processes are a genuine foundation rather than a false start. The catch is the numbering: ISO 13485:2016 kept the older clause structure, so it runs to clause 8 with management responsibility at 5 and product realization at 7, and never adopted the layout ISO 9001 has used since 2015. Your processes transfer; your clause map doesn't. On top of that you'll add regulatory reporting, risk management to ISO 14971 across the lifecycle, the medical device file, design controls if you design, risk-based validation, and the infrastructure and personnel requirements.

We're a contract manufacturer. Does the whole standard apply to us?

Not all of it. If your customer holds the design and you build to their specification, design and development may be a legitimate exclusion — the standard permits exclusions where a requirement doesn't apply to your activities, provided you justify them in writing. What catches contract manufacturers out is the opposite direction: traceability, process validation and contamination control often apply more heavily than expected, and your customer's regulatory obligations flow down to you through the contract whether or not the clause names you.

What does certification cost?

The registrar's fee is separate from anything I charge and is higher than for ISO 9001, since audits take longer and the auditors are more specialized. Budget more if you sterilize or design. Get quotes from two or three accredited registrars early, and ask specifically whether they're accredited for your device class and whether they can perform an MDSAP audit if you're considering multiple markets.

Do you work remotely?

Yes, and most of this work is remote regardless of location. I'm based in Danville, California, so on-site work is straightforward in the Bay Area and possible elsewhere. Some parts of a medical device build — walking your production areas, reviewing contamination controls, a mock audit — genuinely benefit from being in the room, and I'll say so when that's the case.