What is ISO 13485?
ISO 13485 is the international standard that specifies requirements for a quality management system intended for organizations involved in various stages of the life cycle of medical devices, from design and development, manufacturing and storage to distribution, installation and servicing (maintenance and repair).
The ISO 13485 quality management system focuses on process control, documentation, traceability, risk management and compliance with applicable regulatory requirements.
ISO 13485 – a quality management standard for medical devices focused on regulatory requirements
Unlike ISO 9001, ISO 13485 is specifically designed for the medical device sector and places particular emphasis on an organization’s ability to consistently meet applicable requirements and maintain the effectiveness of the quality management system for medical devices.
Documentation, traceability, process control and risk management play an important role in demonstrating system conformity, precisely because they relate to patient safety.
ISO 13485 and ISO 9001 – why are they different?
Although ISO 13485 originated from ISO 9001, the two standards have evolved differently. ISO 13485:2016 was not aligned with the High-Level Structure (Annex SL) used by ISO 9001, in order to facilitate direct alignment with the strict regulatory requirements of the global medical industry. Consequently, the two standards no longer have the same structure: ISO 13485 certification does not automatically imply conformity with ISO 9001, and ISO 9001 certification does not cover the requirements of ISO 13485. An organization may hold both certifications, but each has its own specific purpose and requirements.
ISO 13485 and regulations concerning medical devices (MDR, IVDR)
In the European Union, the Medical Devices Regulation (MDR – EU Regulation 2017/745) and the In Vitro Diagnostic Medical Devices Regulation (IVDR – EU Regulation 2017/746) require manufacturers to have a quality management system in place. Although the MDR/IVDR regulations do not explicitly require certification to the ISO 13485 standard, in practice, it is the harmonized standard at European level. Implementing a management system based on ISO 13485 provides manufacturers with the so-called “presumption of conformity” with the legal requirements set out in Article 10 of the MDR/IVDR.
The European amendment EN ISO 13485:2016+A11:2021 adds annexes that establish the link with these regulations as follows:
- Annex ZA: Provides a detailed correspondence between the clauses of ISO 13485 and the requirements of the MDR (EU Regulation 2017/745).
- Annex ZB: Provides a detailed correspondence between the clauses of the standard and the requirements of the IVDR (EU Regulation 2017/746).
It is important to note, however, that ISO 13485 certification does not replace the conformity assessment and CE marking required by the MDR or IVDR, which are carried out through a notified body. ISO 13485 certification issued by SRAC covers exclusively the voluntary scope and demonstrates the existence of a quality management system conforming to the standard. Certified organizations cannot use this certification to be exempted from their responsibilities under European and national legislation concerning medical devices. For manufacturers, it is essential to distinguish between the requirements relating to the quality management system and those relating to the product.
Risk management and ISO 13485-specific requirements
A central element of ISO 13485 is the risk-based approach, applied throughout the medical device life cycle. Risk management is generally carried out in conjunction with ISO 14971, dedicated to the application of risk management to medical devices. In addition, ISO 13485 includes sector-specific requirements: design and development control, product traceability, requirements concerning cleanliness and sterilization, process validation, management of complaints and feedback, as well as reporting to authorities. These requirements help prevent errors and maintain a high level of safety.
Current version and international context
The current edition is ISO 13485:2016, confirmed by ISO following its systematic review as still current; no new edition has been announced. At international level, the importance of the standard has increased: since February 2026, the US FDA has incorporated ISO 13485:2016 by reference into its Quality Management System Regulation (QMSR), aligning US requirements with the standard. ISO 13485 is also the reference standard within the MDSAP (Medical Device Single Audit Program), which allows a single audit to be recognized by multiple regulatory authorities. These developments make ISO 13485 a common reference point for access to international medical device markets.
Benefits of ISO 13485 certification
Certification of a quality management system for medical devices according to ISO 13485 provides concrete benefits:
- meeting the requirements of customers, business partners and applicable legal requirements;
- providing evidence to authorities that applicable laws and regulations are being complied with;
- minimizing and controlling risks within the organization’s processes;
- preventing errors in the provision of products and services;
- improved performance quality and transparent internal processes;
- saving time and costs;
- providing a solid foundation for access to international markets and for compliance with MDR, IVDR or the requirements of other jurisdictions.
..
How to obtain ISO 13485 certification with SRAC
The ISO 13485 certification process involves auditing the quality management system for medical devices against the requirements of the standard.
Certification stages
- Submission of a request for quotation and establishment of the contractual details.
- A two-stage certification audit: documentation review and on-site assessment of how the management system operates.
- Resolution of any nonconformities and implementation of corrective actions.
- Issuance of the ISO 13485 certificate, valid for 3 years, subject to the completion of annual surveillance audits.
- Recertification audit (renewal of certification), extending the validity of the certificate for a new 3-year cycle.
Cost of ISO 13485 certification
The cost of ISO 13485 certification depends on the size of the organization, the complexity of the medical devices and processes, the number of sites and the scope of certification. To determine the exact cost of ISO 13485 certification, the best solution is to request a personalized quotation.
Why SRAC
SRAC is accredited by RENAR – the national accreditation body (certificate no. SM 004) – for the certification of quality management systems for medical devices, in accordance with the reference standard ISO 13485. The SRAC certificate is internationally recognized through RENAR accreditation – signatory of the IAF-MLA international agreement – and through its partnership with IQNET (The International Certification Network).
Organizations certified by SRAC receive, at no additional cost, both the SRAC certificate and the IQNET certificate and are entitled to use the SRAC and IQNET conformity marks for promotional purposes. They are also kept informed about developments in the field of certification.
Join some of the most important companies and institutions in Romania that have chosen the SRAC brand: over 10,000 certified organizations / over 25,000 certificates awarded in 30 years. From leading brands to major public institutions, major companies have chosen our services.
Who is ISO 13485 intended for?
ISO 13485 is intended for all organizations involved in the medical device manufacturing and supply chain, regardless of size. These include: medical device manufacturers, distributors and suppliers, organizations providing installation, maintenance or servicing, medical device training services, as well as companies manufacturing subassemblies or components intended for medical devices. In practice, any organization that wishes to demonstrate quality management in accordance with the requirements of the medical device sector can obtain ISO 13485 certification.
Frequently asked questions
What does ISO 13485 certification mean?
ISO 13485 certification is confirmation, by a certification body, that the quality management system of an organization in the medical device sector complies with the requirements of the ISO 13485 standard. It demonstrates the organization’s ability to consistently provide medical devices that comply with regulatory and customer requirements.
Does ISO 13485 certification replace CE marking or MDR conformity assessment?
No. ISO 13485 certification demonstrates the existence of a quality management system, but it does not replace the conformity assessment and CE marking required by the MDR or IVDR, which are carried out through a notified body. ISO 13485 certification supports conformity but does not exempt the organization from its legal obligations concerning medical devices.
What is the difference between ISO 13485 and ISO 9001?
ISO 9001 is the quality management standard, while ISO 13485 is specific to medical devices and focused on regulatory requirements. Unlike ISO 9001, ISO 13485 does not use the High-Level Structure (Annex SL) and places emphasis on maintaining effectiveness and safety. Certification to one standard does not cover the requirements of the other.
Is ISO 13485 harmonized with the MDR and IVDR?
Yes. The harmonized European version, EN ISO 13485:2016+A11:2021, establishes the link with the MDR and IVDR and is used by most manufacturers as the basis for their quality management system for conformity assessment. However, the EU may also impose additional requirements beyond the standard.
What is the relationship between ISO 13485 and ISO 14971 (risk management for medical devices)?
ISO 14971 is the international reference standard for risk management applied to medical devices.
Unlike ISO 13485, which governs the company’s entire quality management system, ISO 14971 focuses exclusively on product safety, providing manufacturers with a structured process for identifying, analyzing, evaluating and controlling risks associated with a medical device throughout its entire life cycle (from concept through decommissioning).
ISO 13485 explicitly requires design and production decisions to be based on a risk management process. Companies use ISO 14971 to meet this requirement.
How long is an ISO 13485 certificate valid?
An ISO 13485 certificate is valid for 3 years, subject to successful completion of annual surveillance audits. At the end of this period, a recertification audit is required to extend the validity of the certificate for a new 3-year cycle.
How much does ISO 13485 certification cost?
The cost varies depending on the size of the organization, the complexity of the devices and processes, the number of sites and the scope of certification. For an exact price, we recommend requesting a personalized quotation.
What do I need to do to get started?
The first step is to submit a request for quotation to SRAC. Based on information about the organization, its activities and the requested scope, you will receive a personalized quotation and the information required to start the ISO 13485 certification process.