ISO 13485 for Medical Devices: The US Regulatory Guide

ISO 13485 for medical devices is the international quality management system (QMS) standard that lets organizations across the medical device supply chain prove they consistently design, produce, and service devices that are safe, effective, and regulatory-ready. The current edition, ISO 13485:2016, is titled “Medical devices — Quality management systems — Requirements for regulatory purposes,” and it is certified to organizations rather than to individual products or people. If your company makes, supplies, sterilizes, distributes, or services medical devices for the US market, ISO 13485 has become more central than ever — because as of 2 February 2026 the US FDA formally incorporates it into federal law.

This overview explains what ISO 13485 is, who needs it across the supply chain, why it matters commercially and legally, and exactly how it now connects to the FDA’s Quality Management System Regulation (QMSR). For a clause-by-clause breakdown of the standard’s structure, see our companion guide to ISO 13485 requirements.

What Is ISO 13485?

ISO 13485 is the globally recognized standard for a quality management system specific to medical devices. It was developed by the International Organization for Standardization (ISO) to give manufacturers and their suppliers a single, consistent framework for meeting the demanding safety and quality expectations of the medical device sector.

Unlike a general business quality standard, ISO 13485 is written around risk management, regulatory obligations, and product traceability. It covers the full device life cycle, including:

  • Design and development controls
  • Document and record management
  • Risk management throughout production
  • Supplier and purchasing controls
  • Cleanliness, sterilization, and contamination control (where applicable)
  • Traceability, identification, and post-market feedback
  • Corrective and preventive action (CAPA)

The standard is deliberately built for “regulatory purposes.” That phrasing in the title is important: ISO 13485 is not just a best-practice badge. It is designed so that a certified QMS maps to the expectations of medical device regulators around the world.

ISO 13485:2016 — the Current Version

ISO 13485:2016 is the edition in force today. Compared with earlier versions, it places a stronger emphasis on risk-based thinking, on control over outsourced and supplier processes, and on aligning the QMS with applicable regulatory requirements in each market where a device is sold. Any organization pursuing certification today is audited against the 2016 edition.

Who Needs ISO 13485?

A common misconception is that ISO 13485 is only for finished-device manufacturers. In reality, it applies to organizations at every stage of the medical device supply chain. Certification is awarded to the organization based on the scope of activities it performs.

Organizations that typically implement and certify to ISO 13485 include:

  • Medical device manufacturers — from Class I to high-risk implantable and diagnostic devices
  • Component and raw-material suppliers feeding device production
  • Contract manufacturers and OEM partners
  • Sterilization service providers
  • Installation, servicing, and maintenance providers
  • Distributors, importers, and warehousing/logistics providers handling regulated devices
  • Providers of related services such as design consultancy, calibration, or software development for devices

Because manufacturers increasingly require their vendors to be certified, ISO 13485 frequently becomes a condition of doing business. A supplier that holds certification can win contracts that closed suppliers cannot even bid on.

What Counts as a Medical Device?

A medical device is broadly any instrument, apparatus, implant, in-vitro reagent, software, or related article intended for a medical purpose — diagnosis, prevention, monitoring, treatment, or alleviation of disease or injury. This spans everything from tongue depressors and surgical gloves to pacemakers, imaging systems, and Software as a Medical Device (SaMD). The regulatory burden generally scales with the risk class of the device.

Why ISO 13485 Matters

For most organizations, ISO 13485 is not optional in any practical sense — it is the price of entry into regulated medical device markets. The benefits fall into three categories.

Regulatory readiness. A certified QMS demonstrates that your organization has the controls regulators expect. It reduces friction in audits, market submissions, and supplier qualifications across multiple jurisdictions at once.

Market access and commercial advantage. Certification is widely recognized by manufacturers, hospitals, procurement teams, and regulators. It signals that you take safety and quality seriously, and it removes a common barrier in tenders and supply agreements.

Operational quality. The discipline of risk management, traceability, and CAPA reduces defects, recalls, and rework. That protects patients and protects your brand — a single serious quality failure in this sector can be catastrophic.

ISO 13485 and the FDA QMSR (Effective 2 February 2026)

For companies selling medical devices in the United States, the most important recent development is the FDA’s Quality Management System Regulation (QMSR), which took effect on 2 February 2026.

Here is what changed and why it matters:

  • The QMSR incorporates ISO 13485:2016 by reference as the basis for FDA’s medical device quality system requirements. It also references ISO 9000:2015 (clause 3) for terminology.
  • It replaces and amends the former 21 CFR Part 820 Quality System Regulation (QSR), the long-standing US framework often referred to as the “QSR.”
  • The move harmonizes the FDA’s framework with ISO 13485, aligning US expectations with the international standard that much of the rest of the world already uses.
  • Importantly, the FDA retains its own enforcement authority. Incorporating ISO 13485 does not hand oversight to a third party; the FDA continues to inspect, enforce, and impose additional US-specific requirements where its regulations call for them.

The practical takeaway is straightforward: aligning your quality management system with ISO 13485:2016 is now more directly connected to US regulatory compliance than at any point in the past. Organizations that already hold ISO 13485 certification are well positioned for the QMSR era, while those still operating to legacy QSR-only practices should be closing the gap.

ISO 13485 alignment also supports FDA-related activities such as premarket submissions. If your route to market involves a clearance pathway, our resources on the 510(k) submission process and FDA certification support explain how quality systems fit alongside device submissions. For production-quality expectations, see our cGMP certification guidance.

Global Market Access

ISO 13485 is valuable well beyond the United States. Because it is an international standard, a certified QMS provides a common foundation that regulators and partners recognize across many regions.

  • In the European Union, ISO 13485 is widely used to support conformity work under the EU Medical Device Regulation (MDR), though it is not by itself a substitute for MDR compliance.
  • In Canada, ISO 13485 underpins the Medical Device Single Audit Program (MDSAP), which several regulators use to coordinate audits.
  • Many other national regulators reference or accept ISO 13485 as evidence of a robust device QMS.

Rather than maintaining separate quality systems for each market, organizations can build one ISO 13485-based QMS and adapt it to the specific regulatory overlay of each region they sell into. This is far more efficient than reinventing quality controls country by country.

ISO 13485 vs ISO 9001

Because both are ISO management system standards, ISO 13485 and ISO 9001 are often compared. The distinction matters:

  • ISO 9001 is a general quality management standard for any industry, built around customer satisfaction and continual improvement.
  • ISO 13485 is purpose-built for medical devices, prioritizing regulatory compliance, risk management, and safety over broad continual-improvement objectives.

While ISO 13485 shares structural roots with ISO 9001, it is a stand-alone standard with device-specific requirements. An organization can hold both, but a certified medical device QMS should be built on ISO 13485. If you are weighing your options across standards, our ISO certification hub provides an overview of the wider ISO landscape.

Getting Certified with IAS

Integrated Assessment Services (IAS) supports organizations across the medical device supply chain in achieving and maintaining ISO 13485 certification. The certification journey generally follows a structured, two-stage audit path:

  1. Stage 1 — Documentation review. Auditors evaluate your QMS documentation to confirm it is designed to meet ISO 13485:2016.
  2. Stage 2 — Implementation audit. Auditors verify that your documented system is genuinely implemented and effective in practice.

Before certification, organizations typically complete internal audits, a management review, and corrective actions to close any gaps. After certification, the QMS is maintained through surveillance audits and periodic recertification.

To learn the full end-to-end path, review our ISO 13485 certification service and our general certification process overview. You may also find our blog on the ISO certification process helpful for understanding what to expect. If you are still deciding who should audit you, our guide to ISO certification bodies explains what to look for in an accredited partner.

Building internal competence is just as important as certification itself. Our ISO 13485 lead auditor training equips your team to plan and conduct audits, and you can view upcoming dates on our training schedule. You can also browse the full range of ISO 13485 training courses available for your team.

Ready to begin? Contact us to discuss the right scope for your organization and get a certification roadmap tailored to your role in the supply chain.

IAS provides certification services under its applicable UQAS accreditation scope. EAS is IAS’s group company with its own applicable accreditation arrangements, and the two organizations may work together where the relevant service is within their respective scopes.

Frequently Asked Questions

Is ISO 13485 the same as FDA approval?
No. ISO 13485 certifies that your organization operates a compliant quality management system for medical devices. FDA approval or clearance relates to specific devices being placed on the US market. However, with the FDA’s QMSR now incorporating ISO 13485:2016, an ISO 13485-aligned QMS is directly relevant to meeting US quality system requirements.
What is the FDA QMSR and how does it relate to ISO 13485?
The Quality Management System Regulation (QMSR) took effect on 2 February 2026. It incorporates ISO 13485:2016 by reference (along with ISO 9000:2015 clause 3 for terminology) and replaces the former 21 CFR Part 820 Quality System Regulation. This harmonizes the FDA framework with ISO 13485 while the FDA retains full enforcement authority. In short, ISO 13485 alignment now supports US regulatory compliance more directly than before.
Who can be certified to ISO 13485?
Any organization involved in the medical device life cycle can be certified, including manufacturers, component suppliers, contract manufacturers, sterilization and servicing providers, and distributors. Certification is awarded to the organization based on the scope of activities it performs — not to individual products or people.
Which version of ISO 13485 is current?
ISO 13485:2016 is the current edition and the version organizations are audited against today. It strengthens risk-based thinking, supplier controls, and alignment with applicable regulatory requirements compared with earlier editions.
How is ISO 13485 different from ISO 9001?
ISO 9001 is a general quality standard for any industry, while ISO 13485 is designed specifically for medical devices and emphasizes regulatory compliance, risk management, and product safety. Although the two share common structural roots, ISO 13485 is a stand-alone standard tailored to the device sector.
Does ISO 13485 help with markets outside the US?
Yes. ISO 13485 is an internationally recognized standard that supports market access in multiple regions. It is widely used to support work under the EU Medical Device Regulation and underpins Canada’s MDSAP program, among other frameworks, letting organizations build one QMS foundation and adapt it to each market’s regulatory requirements.