ISO 13485 certification, explained
ISO 13485 is a sector-specific quality management standard for organizations involved in the lifecycle of medical devices, including design, manufacture, installation, servicing and related services, and for suppliers to them. It is built on a quality system approach but adds controls that regulators in the sector care about, such as risk management, traceability and complaint handling. It does not by itself grant regulatory approval or market access for any device.
Updated 5 November 2026
Info. Showing a standard does not mean a partner holds scope for it. How matching works.
Who it may be relevant for
- Manufacturers of medical devices and components
- Distributors, importers and service providers working with devices
- Suppliers of materials, sterilization, calibration or contract manufacturing to device makers
- Companies preparing documentation that regulators or buyers expect from device suppliers
What it covers
- A quality system tailored to regulatory needs, including documented procedures and records
- Risk management applied across product realization
- Design and development controls, verification and validation for devices
- Purchasing, supplier control, production control and traceability, including sterile product where relevant
- Complaint handling, feedback, corrective action and reporting to authorities as required
What it can help with
- Documented controls over design, production, traceability and servicing that regulators expect to see
- A single quality system that can support regulatory submissions in markets that refer to the standard
- Clearer supplier control and evidence for device customers who audit their suppliers
- A recognised foundation for sector quality work, with extra requirements still to be met per market
What the pathway means
ISO 13485 is a specialist management-system certification. An independent certification body audits your quality system through Stage 1, Stage 2, a decision, surveillance audits and recertification, and needs auditors with medical device competence. Certification is not device approval. Market access depends on the rules of each regulator, which may require device registration, technical documentation, local representation or their own audit programmes. Check requirements with the regulator or buyer. MIYAAR CONNECT does not audit or certify. We connect your inquiry with independent certification bodies.
Edition. ISO 13485:2016 is the current edition. Sources reported that ISO reconfirmed it after its latest review, with no new edition expected soon. Check with the certification body if anything changes.
The typical process
Steps and timing vary by body and scope. This is the usual shape, not a promise.
- You and us
Your inquiry
You describe your needs and share the basics.
- Certification body
Application and contract review
The body reviews your scope, sites and size, then quotes.
- Certification body
Stage 1 audit
A readiness review of your management system documentation.
- Certification body
Stage 2 audit
An evaluation of how the system works in practice.
- This part is theirs
Certification decision
Made by the certification body, never by MIYAAR CONNECT.
- Certification body
Surveillance and recertification
Periodic surveillance audits, then recertification at the end of the cycle.
Where it is typically used
- A device maker organizing design history records, risk files and change control
- A contract manufacturer showing device customers how it controls processes and traceability
- A distributor documenting storage, handling, complaint and recall procedures
What affects cost
- Number of employees
- Number of sites
- Complexity of what you do and its risks
- The type and risk class of devices, and whether they are sterile, implantable or software-based
- The extent of design, production, sterilization and servicing activities in the scope
- Dependence on outsourced processes and critical suppliers
- Whether audits must meet requirements of a particular regulator or audit programme
What affects timing
- Time to complete design and risk files and to verify and validate processes
- Records needed to show traceability and complaint handling in operation
- Scheduling auditors with the right device and process knowledge
- Corrective actions raised at Stage 1 or Stage 2 that must be closed first
What to have ready
- A description of the devices or services, their intended use and where they are sold
- The activities in scope: design, manufacture, distribution, servicing, sterilization
- The target markets and the regulators or buyers that will review the certificate
- Existing quality system documents or certificates, described not uploaded
- Key suppliers and outsourced processes
Accreditation and recognition
Certification bodies are assessed by accreditation bodies for defined scopes, and medical device scopes need specific competence, so verify for your case. Ask for the certificate number and scope, confirm accreditation with the accreditation body or through the Global Accreditation Cooperation Incorporated (Global ACI) arrangement, which took over from the IAF and ILAC on 1 January 2026, and ask the regulator whether certificates from a given body are accepted. Some regulators run their own audit programmes and may not accept a general certificate in place of them. Never assume.
Common questions
Does ISO 13485 let us sell devices in a country?
How is it different from ISO 9001?
Does it apply to suppliers and not only manufacturers?
Is software covered?
Related standards
Relevant industries
Useful reading
Sources
- ISO: ISO 13485:2016 medical devices quality management systems (checked 5 November 2026)
Ask about availability for ISO 13485
We review availability for each inquiry. If no verified certification body fits your request, we will tell you plainly.