Is ISO 13485 required by FDA?

Effective February 2, 2026, FDA's QMSR incorporates ISO 13485:2016 by reference for finished device manufacturers. This replaces the previous 21 CFR Part 820, though FDA retains additional US-specific requirements layered on top.

How long does ISO 13485 certification take?

Implementing a compliant QMS typically takes 6 to 12 months for a small manufacturer, followed by a Stage 1 documentation audit and a Stage 2 on-site audit by an accredited registrar. Certificates are valid for 3 years with annual surveillance audits.

What is MDSAP and how does it relate to ISO 13485?

The Medical Device Single Audit Program lets a single audit satisfy the QMS requirements of five regulators (US FDA, Health Canada, Brazil ANVISA, Australia TGA, Japan MHLW/PMDA). MDSAP audits are built on ISO 13485:2016 with country-specific supplements.

All terms

StandardsQuality System

ISO 13485

International standard for medical device quality management systems.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

Definition

ISO 13485:2016 specifies requirements for a quality management system where an organization needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements.

What this means in practice

ISO 13485 is referenced or required by regulators worldwide, including the EU (under MDR/IVDR) and Health Canada. FDA's Quality Management System Regulation (QMSR), effective February 2, 2026, explicitly incorporates ISO 13485:2016 by reference, replacing the previous 21 CFR Part 820 Quality System Regulation. Certification is issued by accredited third-party registrars and is renewed on a three-year cycle with annual surveillance audits.

Examples

A Class II diagnostic manufacturer maintaining a single ISO 13485 QMS used to satisfy FDA QMSR, EU MDR, and Health Canada requirements.
A contract manufacturer holding ISO 13485 certification to support MDSAP audits across five participating regulators.

Use cases

1 scenario

Contract manufacturer onboarding a new medical device customer

Quality Manager

A CMO holds an ISO 13485 certificate from a notified body. A new EU MDR customer audits the QMS, confirms design transfer, supplier control, and CAPA processes meet the standard, and adds the CMO to their approved supplier list.

OutcomeOnboarding takes 6 weeks instead of 6 months because the QMS is already evidence-based and audited.

Common pitfalls

•Treating ISO 13485 certification as proof of regulatory approval. Certification confirms QMS conformity; individual products still require the appropriate marketing authorization (510(k), PMA, CE mark, etc.).
•Copying an ISO 9001 QMS without adding medical-device-specific requirements (design controls, risk management, UDI, post-market surveillance, complaint handling).
•Weak supplier controls. ISO 13485 expects documented supplier evaluation, monitoring, and re-evaluation proportional to component risk.
•Under-scoping the QMS. Software design, cybersecurity, and contract-manufacturer activities all fall within scope when they affect the finished device.

Frequently asked questions

ISO 9001 is a general quality management standard focused on continual improvement and customer satisfaction. ISO 13485 is medical-device-specific and emphasizes regulatory compliance, risk management, design controls, and traceability. An ISO 13485 QMS is not a superset of ISO 9001; the two have diverged.

Cross-references

Used by

Things that build on this term.

Quality Management System Regulation(QMSR)

Contains

Sub-elements or required artefacts of this term.

Overlaps with

Covers some of the same ground; not interchangeable.

Quality System Regulation(QSR / 21 CFR 820)

Shared paths + category

Standards

ISO 14971

International standard for the application of risk management to medical devices.

Standards Stack for Medical Devices · adjacent

Quality & Risk

Design Controls

Structured process governing the design of medical devices.

QMS Foundations · adjacent

Quality & Risk

Quality Management System Regulation(QMSR)

FDA's harmonized successor to the QSR, incorporating ISO 13485:2016 by reference.

QMS Foundations · adjacent

Quality & Risk

Corrective and Preventive Action(CAPA)

Systematic process to investigate and resolve quality issues and prevent recurrence.

QMS Foundations

Quality & Risk

Quality System Regulation(QSR / 21 CFR 820)

FDA's current good manufacturing practice (cGMP) requirements for medical devices.

QMS Foundations

Quality & Risk

Medical Device Single Audit Program(MDSAP)

Single audit of a manufacturer's QMS satisfying multiple participating regulators.

Latest in MedTech

Primary references

3 sources

Link health: 2 verified 1 unchecked· last checked 2026-06-20

ISO·1FDA·2

Inline markers like [1] jump to the matching reference above.

On this term

Category: Standards
Sources: 3
Use cases: 1
Updated: 5/5/2026

Compare with another term

Learn in 60 seconds

International standard for medical device quality management systems.

·ISO 13485 is referenced or required by regulators worldwide, including the EU (under MDR/IVDR) and Health Canada.
·FDA's Quality Management System Regulation (QMSR), effective February 2, 2026, explicitly incorporates ISO 13485:2016 by reference, replacing the previous 21 CFR Part 820 Quality System Regulation.
·Certification is issued by accredited third-party registrars and is renewed on a three-year cycle with annual surveillance audits.

Remember this

Watch out: Treating ISO 13485 certification as proof of regulatory approval. Certification confirms QMS conformity; individual products still require the appropriate marketing authorization (510(k), PMA, CE mark, etc.).

Related terms

You may also need

Auto-suggested from Standards and shared keywords.

All Standards terms

From the Blue Goat network

Related resources and services on this topic.