ISO 13485 Certification USA | Medical Device QMS

Standard status

Current ISO 13485 standard status

Checked against the ISO publication record in October 2026.

Current edition: ISO 13485:2016Medical devices — Quality management systems — Requirements for regulatory purposes.
Status: Confirmed in 2025ISO reviewed and confirmed the 2016 edition. There is no ISO 13485:2026 and no transition date.
Lifecycle coverage: Design to servicingFor organizations in one or more stages of the device lifecycle, and their suppliers.
US relevance: Part of FDA QMSRFDA’s QMSR incorporates ISO 13485:2016 by reference, with additional FDA requirements.

FDA regulation

ISO 13485 and the FDA Quality Management System Regulation

The QMSR, 21 CFR Part 820, became effective on February 2, 2026. It replaced the former Quality System regulation and incorporates ISO 13485:2016 by reference, together with additional FDA requirements.

Why FDA changed it: To align US device CGMP requirements with the international standard used by many regulators, while keeping FDA-specific requirements.
What is incorporated: ISO 13485:2016 and clause 3 of ISO 9000:2015 (terms and definitions). Where they conflict with FDA law or regulations, FDA requirements control.
Who is subject to it: Manufacturers of finished devices sold in the US, unless exempt. Some exempt manufacturers must still keep complaint files.
What it covers: QMS documentation, design and development, risk management, production controls, supplier controls, traceability, complaint handling and records, plus FDA requirements such as labeling, UDI and medical device reporting under their own regulations.
FDA inspections: FDA inspects manufacturers itself. It no longer uses the QSIT approach and now inspects under Compliance Program 7382.850.

What certification does not do

ISO 13485 certification does not by itself show full QMSR compliance.
FDA does not issue ISO 13485 certificates.
FDA can inspect any manufacturer, certified or not.
IAS certification does not satisfy FDA obligations on your behalf.

Read FDA’s QMSR page (opens in a new tab)

Understand ISO 13485 & QMSR requirements

The basics

Understanding medical device quality management system certification

Certification is about your management system within a defined scope.

ISO 13485 is the international QMS standard for the medical device sector. A medical device QMS covers management responsibility, regulatory requirements, risk-based decisions, design and production controls, process validation, traceability, documentation, complaint handling and corrective and preventive action.

Organizations use it to work consistently, meet customer and regulatory expectations, and keep the QMS suitable and effective as devices and regulations change.

Third-party certification means an accredited certification body audits the QMS and makes an independent decision on whether it conforms, for the scope on the certificate.

ISO 13485 certification is management system certification. It does not certify or approve individual devices, is not FDA clearance, approval or product authorization, and does not by itself allow a device to be sold in the United States.

Who it is for

ISO 13485 for organizations across the medical device lifecycle

Scope depends on what you actually do. Not every supplier or distributor is legally required to be certified, and regulatory requirements differ by role.

Manufacturers and designersDesign, production and regulatory responsibilities for finished devices.
Contract manufacturers and assemblersScope reflects the activities performed for customers.
Component suppliersOften asked by customers to show a medical device QMS.
Sterilization and packaging providersValidated services provided under quality agreements.
Installation and servicing organizationsInstallation and servicing requirements apply where relevant.
In vitro diagnostic manufacturersDesign, reagent production and labeling controls.
Medical device distributorsWhere distribution activities fall within ISO 13485.
Outsourced process providersMachining, molding, software or testing services for device makers.

Requirements

Understanding ISO 13485 requirements

ISO 13485:2016 uses its own clause structure, 4 to 8, not the structure of ISO 9001. Summaries are in our own words; they do not replace the standard.

Lifecycle

Quality management across the medical device lifecycle

Not every device goes through every stage. Sterilization, installation and specific validation activities apply only where relevant.

Risk management

Risk management within the medical device quality system

ISO 13485 requires a documented risk management process in product realization. ISO 14971 is the separate standard most organizations use for it. ISO 13485 certification does not make an organization “ISO 14971 certified”.

Illustrative device-development example only. It is not a safety conclusion for any product.

Design controls

Medical device design and development quality controls

ISO 13485 clause 7.3 sets design and development requirements. Under QMSR, FDA uses ISO 13485’s terms, such as the design and development file, rather than the former regulation’s terms like “design history file”.

Verification vs validation

Verification: did we design the device right? Outputs meet inputs.

Validation: did we design the right device? It meets user needs and intended use.

Planning: Stages, reviews, responsibilities and methods to trace outputs to inputs.
Inputs: Functional, performance, usability and safety requirements, regulatory requirements and risk management outputs.
Outputs: Specifications, drawings and acceptance criteria that can be verified against inputs.
Review: Planned reviews with relevant functions and an independent reviewer where needed.
Verification and validation: Planned and documented, including clinical or performance evaluation where required.
Transfer: Outputs are verified as suitable for manufacturing before production.
Changes: Assessed for effect on the device, risk and devices already delivered, then verified, validated and approved.
Records: A design and development file for each device type or family.

Process validation

Process validation in medical device manufacturing

Processes whose output cannot be, or is not, fully verified by later monitoring or measurement must be validated. The approach depends on the process and its risk. A certification audit checks your validation system; it does not validate your product or process.

Sterilization
Aseptic processing
Heat sealing of sterile barrier packaging
Injection molding, welding, bonding or coating, where outputs are not fully verified
Software used in production or the QMS

Planning: Validation plan, responsibilities and criteria.
Equipment qualification: Installation and operational qualification of equipment.
Parameters and acceptance criteria: Defined process windows and how results are judged.
Monitoring: Ongoing monitoring of validated parameters.
Revalidation: After changes, deviations or at defined intervals.
Outsourced validation: Controlled through supplier agreements and review of the supplier’s validation evidence.

Traceability

Medical device traceability and record control

ISO 13485 requires identification and traceability to the extent your devices need, with more for implantables. FDA requirements such as UDI (21 CFR Part 830) and corrections and removals are separate legal obligations. Requirements differ by device.

Comparisons

ISO 13485 certification vs FDA QMSR compliance

Related, but assessed by different bodies with different outcomes.

ISO 13485 certification and FDA QMSR compliance compared
	ISO 13485 certification	FDA QMSR compliance
Governing organization	ISO publishes the standard; accredited certification bodies certify	US Food and Drug Administration
Nature	Voluntary, unless a customer or market requires it	Legal requirement for manufacturers subject to Part 820
Applies to	Any organization in the device lifecycle that chooses certification	Manufacturers of finished devices for the US market, unless exempt
Scope	The certified QMS scope	ISO 13485:2016 by reference plus FDA-specific requirements
Assessed by	Accredited certification body	FDA investigators
Method	Stage 1, Stage 2, surveillance and recertification audits	FDA inspections under Compliance Program 7382.850
Outcome	Certificate after an independent decision	Inspection observations; possible regulatory action
Market authorization	None	None by itself; 510(k), De Novo or PMA where required

ISO 13485 vs ISO 9001

ISO 13485 and ISO 9001 compared
	ISO 13485:2016	ISO 9001
Purpose	Medical device QMS for regulatory purposes	General QMS for any sector
Structure	Clauses 4–8	Harmonized structure, clauses 4–10
Regulatory focus	Built around meeting regulatory requirements	Customer satisfaction and continual improvement
Documentation	Quality manual, specific procedures, medical device files	Flexible documented information
Design controls	Detailed requirements, including transfer and files	General design and development requirements
Traceability and validation	Specific requirements, including implantables and sterilization	General requirements
Improvement	Maintaining QMS effectiveness; CAPA	Continual improvement
Equivalence	ISO 9001 certification does not satisfy ISO 13485.

ISO 13485 vs MDSAP

ISO 13485 certification and MDSAP compared
	ISO 13485 certification	MDSAP
What it is	Third-party certification to a standard	Regulatory audit program
Run by	Accredited certification bodies	Participating regulators; the founding members are Australia, Brazil, Canada, Japan and the US
Auditors	Certification body auditors	Recognized MDSAP Auditing Organizations only
Criteria	ISO 13485:2016	ISO 13485 plus the regulatory requirements of participating jurisdictions
Use by FDA	Not a substitute for inspection	FDA accepts MDSAP audit reports as a substitute for routine inspections
IAS	IAS offers ISO 13485 certification	IAS is not an MDSAP Auditing Organization

FDA information on MDSAP (opens in a new tab)

Market access

ISO 13485 and international market access

ISO 13485 is widely expected as the basis of a device QMS, but certification alone does not authorize a device for sale in any country. IAS is not an EU Notified Body and does not provide FDA clearance or approval.

United States: QMSR applies to manufacturers; market entry depends on classification and premarket requirements.
European Union: The MDR and IVDR require a QMS; for most device classes, conformity assessment involves a Notified Body.
Canada: Health Canada requires an MDSAP certificate for many device licence classes.
United Kingdom: UKCA marking through a UK Approved Body, with current transitional arrangements for CE-marked devices.
Australia: Inclusion in the ARTG through the TGA; MDSAP and other evidence can support applications.
Other markets: Country-specific registration. Check each regulator’s requirements.

FDA pathways

Understanding FDA medical device regulatory requirements

A high-level overview. This page does not classify devices. Use FDA’s resources or a regulatory professional.

Intended use and classification: Classification depends on intended use and risk: Class I, II or III.
Premarket requirements: Depending on class and device type: exempt, 510(k) clearance, De Novo classification or Premarket Approval (PMA).
Registration and listing: Establishment registration and device listing are required for many firms. They are not FDA approval.
Labeling and UDI: Labeling requirements and Unique Device Identification (21 CFR Part 830).
Postmarket obligations: Medical Device Reporting (21 CFR Part 803), corrections and removals (Part 806) and complaint handling.
ISO 13485 certification: Does not replace a required 510(k), De Novo or PMA.

FDA: Classify your medical device (opens in a new tab)

Certification process

How to get ISO 13485 certified in the USA

Twelve stages. Certification is never automatic, IAS does not implement your QMS, and certification audits are separate from FDA inspections.

Stage 1 vs Stage 2

Stage 1 and Stage 2 audits compared
	Stage 1	Stage 2
Purpose	Confirm readiness and plan Stage 2	Evaluate implementation and effectiveness
Focus	Scope, QMS documentation, regulatory context, device activities, design responsibilities, validation planning, internal audit and management review readiness	Design controls, risk management interfaces, suppliers, production, process validation, traceability, complaints, nonconforming product, CAPA, records and effectiveness
Typical evidence	Quality manual, procedures, medical device files, audit and review records	Design files, validation reports, batch records, complaint files, CAPA records
People involved	Management representative, top management, regulatory lead	R&D, production, quality, purchasing, servicing and others in scope
Findings	Areas of concern	Major and minor nonconformities
Next step	Address concerns; Stage 2	Close nonconformities; certification decision

Documentation

ISO 13485 documentation and records checklist

Items marked required are documented information ISO 13485 asks for where the activity applies. Activities you do not perform, such as sterilization or servicing, do not need documents.

ISO 13485 documents and records
Document or record	Type	Related clause
QMS scope, with justified exclusions and non-applications	Required documented information	4.2.2
Quality manual	Required documented information	4.2.2
Quality policy and objectives	Required documented information	5.3, 5.4.1
Document control procedure	Required documented information	4.2.4
Record control procedure	Required documented information	4.2.5
Medical device file for each device type or family	Required documented information	4.2.3
Design and development files	Required documented information	7.3.10
Risk management records	Required documented information	7.1
Supplier evaluation and purchasing records	Required documented information	7.4
Production procedures and batch or device records	Required documented information	7.5.1
Process validation records	Required documented information	7.5.6
Sterilization and sterile barrier validation records, where applicable	Required documented information	7.5.7
Identification and traceability records	Required documented information	7.5.8, 7.5.9
Inspection and test records	Required documented information	8.2.6
Calibration records	Required documented information	7.6
Complaint records	Required documented information	8.2.2
Regulatory reporting records, where applicable	Required documented information	8.2.3
Nonconforming product records	Required documented information	8.3
Corrective and preventive action records	Required documented information	8.5.2, 8.5.3
Internal audit records	Required documented information	8.2.4
Management review records	Required documented information	5.6
Competence and training records	Required documented information	6.2
Work instructions, forms and checklists	Typical audit evidence	—
Supplier quality agreements	Typical audit evidence	4.1.5

Clause references are a guide; check them against the standard.

Industries

Industry-specific ISO 13485 applications

Typical QMS focus by device area. Whether a device area is within IAS’s technical scope is confirmed at application review.

Startups and small companies

ISO 13485 certification for startups and growing medical device businesses

Small organizations are not exempt from ISO or FDA requirements, and being a startup does not by itself shorten audits.

Scope Define it around what you actually do now.
Design and manufacturing Design controls apply if you design, even if you outsource manufacturing.
Outsourcing You remain responsible for outsourced processes and need quality agreements.
Regulatory expectations Identify requirements for each target market early.
Procedures and risk management Required procedures and a risk management process, scaled to your size.
Readiness The QMS must be operating and producing records, including an internal audit and management review, before Stage 2.

Multiple facilities

ISO 13485 certification for multiple facilities

Each site that performs activities in scope is normally audited. Whether site sampling is allowed is decided under the applicable certification and accreditation rules; it is often restricted for medical devices.

Manufacturing sites Each one’s processes are in scope.
Design centers Design activities at separate locations.
Warehousing and distribution Where included in scope.
Central quality functions Head office QMS processes.
Contract sites and outsourced sterilization Controlled as outsourced processes, not certified under your certificate.

Timeline

How long does ISO 13485 certification take?

Your preparation and the certification audits are separate timelines. We do not promise a fixed turnaround. Tick what is already in place.

Already in place

QMS scope and regulatory requirements reviewedDocumentation in placeQMS implemented and producing recordsInternal audit completedManagement review completed

Certification cycle

The three-year certification cycle

Certification stays valid only while surveillance is successful and the scope remains accurate.

1
Initial certification
Stage 1, Stage 2 and an independent decision.
2
Surveillance
At least once a calendar year; the first within 12 months of the decision.
3
Surveillance
Checks the QMS remains effective and reviews changes.
4
Recertification
Audit and decision before expiry.

Significant changes to devices, processes, sites or ownership must be reported and can lead to extra audits or scope changes. Certificates can be suspended or withdrawn.

Accreditation

Understanding IAS ISO 13485 accreditation

Accreditation is granted by an accreditation body for a defined scope. It does not transfer between organizations.

Verify an IAS certificate

IAS accreditation details

Certificate issuer: ISO 13485 certificates are issued by Integrated Assessment Services LLC under its UQAS accreditation. Your proposal confirms the issuer and scope.
Scope: Accreditation covers specific technical areas. We confirm your device area is within scope before quoting.
Requirements: Certification bodies for medical device QMS work to ISO/IEC 17021-1 and the applicable accreditation requirements.
What IAS is not: IAS is not an MDSAP Auditing Organization, not an EU Notified Body and not recognized by FDA. Recognition arrangements apply between accreditation bodies; ask us which apply to your certificate. No certificate is guaranteed to be accepted by every customer or regulator.
Verification: Check any IAS certificate on the IAS certificate search.

Impartiality

Independent medical device quality management system certification

A certification body must stay independent of what it certifies.

ImpartialityRisks are identified, managed and reviewed independently.
No consultancyIAS does not design or implement QMS for organizations it certifies.
Technical competenceAuditors are assigned by device technical area.
Conflicts of interestAuditors do not audit organizations they have advised.
ConfidentialityClient information is protected.
Independent decisionsMade by people not involved in the audit.
Complaints and appealsHandled through a documented process.
Training is separateISO 13485 training through EAS is not consultancy and does not lead to certification.

Working with IAS USA

Why medical device companies consider IAS USA

What you can expect, without claims we cannot prove.

Technical scope review Your devices and activities reviewed before quoting.
Defined process Each stage explained in advance.
Auditor competence Auditors assigned by technical area.
Transparent proposal Audit time, travel and inclusions stated.
US coordination Scheduling and questions handled by our US coordination team.
Ongoing coordination Surveillance and recertification planned ahead.

FAQ

ISO 13485 certification questions

40 answers for medical device organizations.

What is ISO 13485 certification?

Independent confirmation by an accredited certification body that an organization’s medical device quality management system meets ISO 13485:2016 for a defined scope.

What is the current ISO 13485 edition?

ISO 13485:2016, Medical devices — Quality management systems — Requirements for regulatory purposes. ISO reviewed and confirmed it in 2025.

Is ISO 13485:2026 published?

No. There is no 2026 edition. ISO 13485:2016 remains current.

Who needs ISO 13485 certification?

Organizations involved in the medical device lifecycle often seek it because customers, regulators or market access routes expect it. Whether you need it depends on your activities, customers and target markets.

Is ISO 13485 mandatory in the USA?

Certification is not required by FDA. However, FDA’s QMSR incorporates ISO 13485:2016 by reference, so manufacturers subject to Part 820 must meet its requirements, whether or not they are certified.

What is the FDA QMSR?

The Quality Management System Regulation, 21 CFR Part 820, which sets current good manufacturing practice requirements for medical devices. It replaced the former Quality System regulation.

When did QMSR become effective?

February 2, 2026.

Does QMSR incorporate ISO 13485?

Yes. It incorporates ISO 13485:2016 and clause 3 of ISO 9000:2015 by reference, with additional FDA requirements. Where they conflict, FDA law and regulations control.

Does ISO 13485 certification satisfy FDA requirements?

Not by itself. Certification shows conformity with ISO 13485 for the certified scope. It does not demonstrate full QMSR compliance, which includes FDA-specific requirements and is judged by FDA.

Does FDA issue ISO 13485 certificates?

No. FDA inspects manufacturers; accredited certification bodies issue ISO 13485 certificates.

Can FDA inspect an ISO 13485-certified manufacturer?

Yes. Certification does not exempt a manufacturer from FDA inspection.

What is the difference between ISO 13485 and ISO 9001?

ISO 13485 is a medical device QMS standard for regulatory purposes, with specific requirements for design controls, process validation, traceability, complaint handling and regulatory reporting. ISO 9001 is a general QMS standard with a different structure and a focus on customer satisfaction and continual improvement.

What is the difference between ISO 13485 and MDSAP?

ISO 13485 certification is a voluntary third-party certification. MDSAP is a regulatory audit program in which recognized Auditing Organizations audit against ISO 13485 plus the requirements of participating regulators.

What does ISO 14971 cover?

Risk management for medical devices: identifying hazards, estimating and evaluating risks, controlling them, and monitoring effectiveness through production and post-production.

What are design controls?

Planned, documented controls over design and development: inputs, outputs, reviews, verification, validation, transfer and changes.

What is design verification?

Confirming that design outputs meet design inputs, for example through tests, inspections or analyses.

What is design validation?

Confirming that the device meets user needs and intended use, under defined conditions.

What is process validation?

Establishing by objective evidence that a process consistently produces a result meeting requirements, where the output cannot be fully verified afterwards.

What is medical device traceability?

Being able to trace components, production records and distribution of devices, to the extent required. Implantable devices have additional requirements.

What documentation is required?

ISO 13485 requires a quality manual, specific documented procedures, medical device files and records. What you need depends on your activities.

Can contract manufacturers obtain certification?

Yes. The scope reflects their actual activities.

Can medical device distributors obtain certification?

Yes, where their activities fall within ISO 13485. The scope states the distribution activities covered.

Can startup manufacturers obtain certification?

Yes. The same requirements apply, scaled to the organization, and the QMS must be operating before Stage 2.

Can multiple facilities be certified?

Yes. Whether sampling of sites is allowed depends on accreditation rules; it is often restricted for medical devices.

What is a Stage 1 audit?

A readiness review of documentation, scope and planning.

What is a Stage 2 audit?

An audit of implementation and effectiveness, normally on site.

What happens if nonconformities are found?

You correct them and take corrective action. Major nonconformities must be closed before a positive certification decision.

How much does ISO 13485 certification cost?

It depends on audit time and travel. Audit time depends on personnel, sites, devices, processes and complexity. We quote after reviewing your application.

How long does certification take?

It depends on how long your QMS has been operating and how quickly findings are closed. We do not promise a fixed timeline.

How long is certification valid?

Usually three years, subject to successful surveillance.

What is a surveillance audit?

An audit at least once a calendar year between initial certification and recertification.

Does ISO 13485 certification provide CE Marking?

No. CE marking of medical devices under the EU MDR or IVDR generally requires a Notified Body for all but the lowest-risk devices. IAS is not a Notified Body.

Does it guarantee FDA 510(k) clearance?

No. A 510(k), De Novo or PMA is a separate FDA process. Certification does not guarantee or replace it.

Can IAS provide MDSAP certification?

No. MDSAP audits are performed only by recognized MDSAP Auditing Organizations. IAS is not one.

How can IAS accreditation be verified?

Check the accreditation scope with the accreditation body and verify certificates on the IAS certificate search.

Can an existing certificate be transferred?

Transfers are possible subject to eligibility checks under accreditation rules, including a review of the current certificate and audit reports.

Can ISO 13485 be integrated with other standards?

Yes, for example with ISO 9001 or ISO 14001, where audits can be planned together. Any reduction in audit time depends on how integrated the systems are.

Can audits be performed remotely?

Some activities may use remote techniques where accreditation rules allow. Observing production normally requires a site visit.

Who issues the certificate?

Integrated Assessment Services LLC under its UQAS accreditation, as confirmed in your proposal.

How do I request an ISO 13485 quotation?

Use the quotation form on this page. A certification coordinator and a technical reviewer review your scope before a proposal is issued.

Related certification and training

Training is delivered by EAS and is separate from certification.