MedTech Terms
    The authoritative reference
    Back to Standards Stack for Medical Devices
    StandardsQuality System

    ISO 13485

    International standard for medical device quality management systems.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed September 19, 2026

    Definition

    ISO 13485:2016 specifies requirements for a quality management system where an organization needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements. The standard is structured around QMS documentation, management responsibility, resource management, product realization (including design, purchasing and production) and measurement, analysis and improvement. Unlike ISO 9001, it emphasizes regulatory compliance and documented, risk-based processes over continual improvement. It is the basis for MDSAP audits, is a harmonised standard under the EU MDR and IVDR, and since February 2, 2026 has been incorporated by reference into FDA's QMSR.
    What the regulation says
    ISO 13485:2016 is an international QMS standard, not itself legislation; its legal role depends on the jurisdiction. FDA’s QMSR final rule, published February 2, 2024 and effective February 2, 2026, amended 21 CFR Part 820 rather than replacing that part. Section 820.7 incorporates ISO 13485:2016 by reference, and section 820.10 requires covered manufacturers to maintain a QMS complying with applicable standard requirements and additional FDA requirements. ISO certification does not replace FDA oversight or establish compliance with all U.S. medical device requirements. In the EU, Regulation (EU) 2017/745 (MDR), applicable from May 26, 2021, and Regulation (EU) 2017/746 (IVDR), applicable from May 26, 2022, require manufacturers to establish and maintain a QMS under Articles 10(9) and 10(8), respectively. Under Article 8 of each regulation, conformity with harmonised standards whose references appear in the Official Journal provides a presumption of conformity only with the regulatory requirements those standards cover. Accordingly, the harmonised European version of ISO 13485:2016 supports MedTech manufacturers’ regulatory compliance but does not establish conformity with every MDR or IVDR obligation. Use of harmonised standards remains voluntary; manufacturers must still demonstrate that their QMS meets applicable legal requirements.

    What this means in practice

    ISO 13485 is referenced or required by regulators worldwide, including the EU (under MDR/IVDR) and Health Canada. FDA's Quality Management System Regulation (QMSR), effective February 2, 2026, explicitly incorporates ISO 13485:2016 by reference, replacing the previous 21 CFR Part 820 Quality System Regulation. Certification is issued by accredited third-party registrars and is renewed on a three-year cycle with annual surveillance audits.

    Examples

    • A Class II diagnostic manufacturer maintaining a single ISO 13485 QMS used to satisfy FDA QMSR, EU MDR, and Health Canada requirements.
    • A contract manufacturer holding ISO 13485 certification to support MDSAP audits across five participating regulators.

    Use cases

    1 scenario
    1

    Contract manufacturer onboarding a new medical device customer

    Quality Manager

    A CMO holds an ISO 13485 certificate from a notified body. A new EU MDR customer audits the QMS, confirms design transfer, supplier control, and CAPA processes meet the standard, and adds the CMO to their approved supplier list.

    OutcomeOnboarding takes 6 weeks instead of 6 months because the QMS is already evidence-based and audited.
    Common pitfalls
    • •Treating ISO 13485 certification as proof of regulatory approval. Certification confirms QMS conformity; individual products still require the appropriate marketing authorization (510(k), PMA, CE mark, etc.).
    • •Copying an ISO 9001 QMS without adding medical-device-specific requirements (design controls, risk management, UDI, post-market surveillance, complaint handling).
    • •Weak supplier controls. ISO 13485 expects documented supplier evaluation, monitoring, and re-evaluation proportional to component risk.
    • •Under-scoping the QMS. Software design, cybersecurity, and contract-manufacturer activities all fall within scope when they affect the finished device.

    Frequently asked questions

    ISO 9001 is a general quality management standard focused on continual improvement and customer satisfaction. ISO 13485 is medical-device-specific and emphasizes regulatory compliance, risk management, design controls, and traceability. An ISO 13485 QMS is not a superset of ISO 9001; the two have diverged.

    Cross-references

    Used by

    Overlaps with

    Related terms

    Grouped by theme
    Cited by

    Where this term appears across MedTech Terms.

    Learning paths (2)
    Ecosystems (1)
    Comparisons (1)

    Latest in MedTech

    Sources

    3 sources

    Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

    Tier 1Binding law and standards· 2Tier 2Regulator guidance and consensus· 1
    Link health: 2 verified 1 unchecked· last checked 2026-06-20
    ISO·1FDA·2
    1. 1
      ISO 13485:2016
      Tier 1 Verified
      ISOiso.org
    2. 2
      FDA Quality Management System Regulation (QMSR)
      Tier 1 Unchecked
      FDAfederalregister.gov
    3. 3
      FDA Recognized Consensus Standards
      Tier 2 Verified
      FDAaccessdata.fda.gov

    Inline markers like [1] jump to the matching reference above.