ISO 13485 is the international standard for a quality management system in the medical device sector. Its full title is "Medical devices - Quality management systems - Requirements for regulatory purposes," and it is audited by an outside certification body that checks whether the company's system keeps devices safe, traceable and in line with regulation.
Last reviewed: 17 October 2026. Facts checked. We opened the ISO committee page for ISO 13485:2016 and the Wikipedia page on ISO 13485. We also searched for certification material. We did not read the standard, which is a paid document. We did not check Indian device rules, the EU Medical Device Regulation text or US FDA rules. We give no audit durations or fees.
What the standard is
The ISO committee page lists ISO 13485:2016 as the third edition, published in 2016, with a status of published. The page says the standard was last confirmed in 2025 and that this version remains current. The technical committee is ISO/TC 210.
Earlier editions came in 1996 and 2003, per Wikipedia.
The ISO page describes it as an internationally recognised standard for quality management systems in the design and manufacture of medical devices. It is meant for organisations involved in design, production, installation and servicing of devices and related services. Our search results also say it reaches suppliers and other external parties that provide product or services to such organisations.
How it differs from ISO 9001
ISO 13485 follows a similar idea to ISO 9001 but is a separate document, not an add-on. Wikipedia and the ISO page point to these differences.
| Area | ISO 9001 | ISO 13485 |
|---|---|---|
| Aim | Customer satisfaction and improvement | Regulatory and customer requirements, safe devices |
| Improvement | Must show continual improvement | Must show the system is effectively implemented and maintained |
| Customer satisfaction | Required | Not a requirement, per Wikipedia |
| Regulatory awareness | Not a headline duty | Emphasised as a management duty |
| Risk, design and process validation | Lighter | More emphasis, per the ISO page |
Wikipedia also lists extra emphasis on work-environment controls, design controls, traceability for implantable devices, validation of sterile processes, and product cleanliness. Read these as pointers, and check the standard for the exact wording.
If you hold ISO 9001, you do not automatically meet ISO 13485. Our ISO 9001 internal audit checklist is a useful starting point for the common ground.
Why companies use it
Wikipedia says EU directives do not mandate certification, but it is the preferred way to show compliance, and that EN ISO 13485:2016 is harmonised with the EU Medical Device Regulation. It also cites the US FDA's Quality System Regulation, 21 CFR 820. That page did not mention India. Check with your regulator or customer on what applies to you.
Who audits it
- Internal auditors check the system at planned intervals.
- Certification bodies audit and issue certificates. Per Wikipedia, some also act as notified bodies under EU rules.
- Customers and regulators may audit suppliers directly.
ISO does not issue certificates. For how certification audits run in general, see Stage 1, Stage 2, surveillance and recertification.
What auditors look for
These are typical areas for a device QMS audit. They come from the topics the sources list, not from the standard text.
- Regulatory knowledge. Does management know which regulations apply to each device and market?
- Design controls. Are design inputs, reviews, verification and changes recorded?
- Risk management. Is risk considered across the device life cycle?
- Process validation. Where a result cannot be fully checked afterwards, is the process validated?
- Traceability. Can you trace a device back through its components and batches?
- Supplier control. Are critical suppliers assessed and monitored?
- Complaints and corrective action. Are complaints recorded, investigated and fed back?
- Documents and records. Are they controlled and kept for the required period?
Findings follow the usual grades. See major vs minor nonconformities and our guide to running an internal audit.
Common weak spots
These are typical failure points for any regulated quality system. They are our own practical view, not findings from a source we opened.
- Design changes made on the shop floor without a recorded review.
- Supplier approvals that were done once and never repeated.
- Complaint records that stop at "customer informed" with no cause found.
- Training records that show attendance but not competence.
Getting ready
Start with a gap review against the standard. Our gap assessment guide shows how, and the ISO internal audit programme template helps you plan audits across the year.
Frequently Asked Questions
What is ISO 13485 used for?
It sets requirements for a quality management system in the medical device sector, for organisations that must show they meet customer and regulatory requirements.
Which edition is current?
ISO 13485:2016. The ISO page says it was last confirmed in 2025 and remains current.
Is ISO 13485 the same as ISO 9001?
No. They share ideas, but ISO 13485 stresses regulatory requirements and device-specific controls, and it is audited separately.
Is ISO 13485 mandatory in India?
We did not check this. Confirm with the regulator and your customers.
Who issues the certificate?
A certification body, not ISO.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error