Standard status
- Current published edition
- ISO 13485:2016 (third edition, published March 2016; reviewed and confirmed in 2025)
- Assessments conducted against
- The 2016 edition.
- Scheme type
- Management systems (medical devices)
ISO 13485 is the international standard for a quality management system for medical devices, the way an organization involved in the life cycle of a medical device demonstrates that it can consistently meet customer requirements and the regulatory requirements that apply to it. The system assists in ensuring that devices and related services are designed, made, stored, distributed, installed and serviced under controlled, documented conditions. An organization certified to ISO 13485 has had that system assessed against the standard by a certification body. The current edition is ISO 13485:2016. Reliance on an ISO 13485 certificate needs both parts: the standard supplying the requirements, and accreditation supplying the independent check on the certifier.
What an ISO 13485 quality management system is
An ISO 13485 quality management system is a quality management system that builds in regulatory requirements. Where a general quality standard asks an organization to meet customer requirements, ISO 13485 asks it to meet customer requirements and applicable regulatory requirements together, and it repeats that pairing throughout: in planning, in design, in records, in reporting. An organization running it has decided to demonstrate, not merely assert, that its handling of medical devices stands up to the regulatory expectations of the markets it serves.
The standard covers the whole device life cycle and the organizations around it: from design and development through production, storage, distribution, installation and servicing, together with the suppliers and service providers who support them. An organization can be certified for its own part in that chain; it does not have to do everything. Where the standard requires a process the organization has outsourced, the process remains the organization's responsibility, monitored and controlled inside its system.
Documentation carries more weight here than in the other widely held management system standards. The system must include a quality manual, documented procedures and records as the standard requires, a documented file for each medical device type or family, and whatever further documentation the applicable regulations demand. The discipline is deliberate: in this sector, what was done and why must be reconstructable.
A different structure from the other management system standards
Most of the widely held management system standards now share a common structure, clauses 4 to 10, so an integrated system can map them onto each other. ISO 13485 does not. Its 2016 edition keeps the earlier five-part arrangement, clauses 4 to 8, built on the structure of ISO 9001:2008, an edition of ISO 9001 that has itself since been superseded. The content is current; the shape is the older one.
This matters in practice in two ways. An organization running ISO 13485 alongside ISO 9001 or another harmonized standard is running two differently shaped systems, and the mapping between them has to be worked out rather than assumed. And familiar furniture from the harmonized standards, such as a clause called context of the organization or a standalone clause on risks and opportunities, is not where a reader expects it; risk in ISO 13485 is applied through risk-based control of the system's processes, and through risk management in design and realization, rather than through one planning clause.
What ISO 13485 requires
The requirements are arranged in five areas, clauses 4 to 8. The subject matter threaded through them is the device, its documentation, and the regulatory requirements that follow both.
Quality management system
The foundation clause: the processes of the system determined and controlled with a risk-based approach, outsourced processes kept under the organization's control, software used in the system validated in proportion to the risk of its use, and the documentation structure established, from the quality policy and quality manual through documented procedures to the medical device file and controlled records.
Management responsibility
Top management's duties: commitment to the system, a customer focus that includes regulatory requirements, the quality policy, planning, defined responsibilities and authorities including a management representative, internal communication, and management review at planned intervals with defined inputs and outputs.
Resource management
The resources the system needs: competent personnel on the basis of education, training, skills and experience, with the training the work requires; infrastructure; and a work environment controlled where it affects product, including the particular controls that contamination-sensitive and sterile devices demand.
Product realization
The largest clause, following the device through its life: planning of realization; customer-related processes including regulatory requirements for the device; design and development under staged controls with records at each stage; purchasing and the control of suppliers; production and service provision, including cleanliness, installation, servicing, and the particular requirements for sterile devices; identification and traceability; and the control of monitoring and measuring equipment.
Measurement, analysis and improvement
Feedback, including the handling of complaints; reporting to regulatory authorities where regulations require it; internal audit; monitoring and measurement of processes and product; control of nonconforming product before, during and after delivery, including the advisory notices an organization may need to issue; analysis of data; and improvement through corrective and preventive action.
Exclusions and non-applicability
Unlike some management system standards, ISO 13485 allows parts of itself to be set aside, in two defined ways. Design and development controls can be excluded where the applicable regulatory requirements permit it, and the regulations may put alternative arrangements in their place; the organization's claims of conformity must reflect any such exclusion. And requirements in clauses 6, 7 or 8 that do not apply, because of what the organization does or the nature of the devices its system covers, can be left out of the system, with the justification recorded.
For anyone reading a certificate, this is a reason to read the scope with care. Two ISO 13485 certificates can legitimately cover quite different systems: a distributor without design responsibility and a manufacturer designing sterile implantables are both certifiable, against the parts of the standard that apply to each. The certificate's scope statement says which organization you are looking at.
Certification is not the whole story
An ISO 13485 certificate records that a certification body assessed an organization's medical devices quality management system and found it to meet the standard, at the stated scope and as found when assessed. Every certificate has an issuing certifier, and the certificate itself cannot show how that certifier was checked.
Accreditation shows it. ASCB assesses the bodies certifying medical devices quality management systems against ISO/IEC 17021-1 together with the sector-specific requirements that apply to a given scope, and works to ISO/IEC 17011, the international standard for accreditation bodies.
The accredited certificate carries an independent check at each level, the organization's system and the certifier that issued it; an unaccredited certificate carries only the first.
Accreditation is a periodic, risk-based assessment of a certification body against the requirements of the relevant standard, carried out by sampling and reflecting what was found at the time of assessment. It is not a continuous or exhaustive check, and it is not a guarantee of any individual certification decision or of any certified organization's products, services or outcomes. What it provides is independent, repeated assessment of the body issuing certificates against the requirements of ISO/IEC 17021-1, including its impartiality and the consistency of its decisions.
Why an accredited ISO 13485 certificate carries more weight
Medical devices are bought and regulated on evidence, and an ISO 13485 certificate is often the first piece of evidence a buyer, a procurement panel or a business partner asks for. One point of precision matters here: ISO 13485 certification is certification of the organization's quality management system. It is not itself a regulatory approval of any device, and the regulatory routes of each market remain whatever they are. What the certificate attests is the system behind the devices, which is exactly why the credibility of the certifier matters.
With accreditation, the answer to that credibility question can be checked rather than assumed: the certificate’s current status sits on IRQAO, the independent register and validation service recording certificates issued by ASCB-accredited bodies, and the certifier’s accreditation, with its scope, on ASCB’s verify page.
Regulators, procurement panels and partners reading an ISO 13485 certificate from an ASCB-accredited body are reading a credential they can confirm independently, at both levels. Specifying accredited certification is what keeps it that way.
Is ISO 13485 certification the same as accreditation?
No, and the two words are often used as if they mean the same thing. Certification applies to the organization: a certification body certifies that an organization's medical devices quality management system meets ISO 13485. Accreditation applies to the certification body: an accreditation body assesses the certification body against ISO/IEC 17021-1. An organization is certified to ISO 13485. A certification body is accredited against ISO/IEC 17021-1. Accreditation is the level above certification: accreditation bodies are not themselves accredited by a higher body, and what stands behind an accreditation body is the standard it works to. ASCB works to ISO/IEC 17011, the international standard setting the requirements for accreditation bodies.
How to check an ISO 13485 certificate
There are three things to check:
• To confirm a specific certificate, verify it on the register on which the issuing body records its certificates; for ISO 13485 certificates issued by ASCB-accredited bodies, that is IRQAO.
• To confirm that the certification body itself is accredited, and for what, use
ASCB's verify page.
• Read the scope statement on the certificate with particular care, because ISO 13485 permits defined exclusions and non-applicability, so the scope says which activities and which parts of the standard the certified system actually covers.
The checks together confirm that the certificate is current, that the body that issued it was independently assessed, and that the certificate covers the activity you care about.
Where ISO 13485 sits among the standards
ISO 13485 is the certifiable quality management system standard for medical devices:
• ISO/IEC 17021-1: the standard a certification body is assessed against to certify ISO 13485, and the accreditation behind an accredited ISO 13485 certificate.
• ISO 9001: the general quality management system standard whose 2008 edition gave ISO 13485 its structure; the two have since diverged in shape, and certification to one is not certification to the other.
• ISO 14971: the standard for the application of risk management to medical devices, which ISO 13485 points to for its risk management work.
• The regulatory frameworks of each market, which ISO 13485 is designed to support but does not replace: a certificate is not a device approval.
Common questions
What is ISO 13485?
ISO 13485 is the international standard for a quality management system for medical devices. It sets out what the system of an organization involved in the device life cycle must address to demonstrate it can consistently meet customer and applicable regulatory requirements.
What does ISO 13485 certification mean?
It means a certification body has assessed an organization's medical devices quality management system and judged it to meet the requirements of ISO 13485, at the scope stated on the certificate and at the time of assessment.
What is the latest version of ISO 13485?
ISO 13485:2016, the third edition, published in March 2016 and reviewed and confirmed in 2025, so the 2016 edition remains current.
Why does ISO 13485 not look like ISO 9001 or the other management system standards?
Because it keeps the earlier five-part structure, clauses 4 to 8, built on ISO 9001:2008, rather than the harmonized clauses 4 to 10 the other widely held standards now share. The content is current; the shape is the older one, and an integrated system has to map between the two shapes rather than assume them.
Is ISO 13485 certification a regulatory approval of a device?
No. Certification attests the organization's quality management system, not any individual device. Regulatory routes to market remain whatever each market's rules require.
Can parts of ISO 13485 be excluded?
Yes, in two defined ways: design and development controls where the applicable regulations permit, and requirements in clauses 6 to 8 that do not apply because of what the organization does or the nature of its devices, with the justification recorded. The certificate's scope reflects this, which is why it deserves a careful read.
What is the difference between ISO 13485 certification and accreditation?
Certification is of the organization against ISO 13485. Accreditation is of the certification body against ISO/IEC 17021-1. Accreditation is the independent check on the certifier behind the certificate.
How do I check an ISO 13485 certificate is genuine?
Verify the certificate on the register on which the issuing body records it, confirm on
ASCB's verify page that the certification body is accredited and for what scope, and read the scope statement on the certificate itself.
How to apply
How to apply for accreditation to certify other organizations against ISO 13485, under ISO/IEC 17021-1, including the process, the fees and the application documents, is set out on Become Accredited.