ISO 13485 vs ISO 9001: Key Differences, Which One You Need, and How to Move Between Them
Both are quality management standards, and both lead to an accredited certificate. Only one is built for medical devices. Here is how they differ clause by clause, which one your customers and regulators expect, and what changes if you move from one to the other.
A contract manufacturer with an ISO 9001 certificate wins its first order from a medical device company. Two weeks later, the supplier quality team sends a questionnaire: "Please provide your ISO 13485 certificate." The quality manager's first question is whether ISO 9001 already covers it.
It does not. ISO 9001 and ISO 13485 share the same roots, but they answer different questions. This guide explains the difference from the point of view of a certification body that audits both.
Quick answer: ISO 9001 is a general quality management standard for any organization, focused on customer satisfaction and continual improvement. ISO 13485:2016 is the quality management standard for medical devices, focused on meeting regulatory requirements and producing safe, effective devices. ISO 13485 adds product risk management, more documented procedures, a medical device file, design controls, process and software validation, traceability, complaint handling and reporting to regulators. If you design, make, supply or service medical devices or their components, ISO 13485 is the certificate your customers and regulators look for.
ISO 13485 vs ISO 9001: Side-by-Side Comparison
| Point | ISO 9001 | ISO 13485 |
|---|---|---|
| Who it is for | Any organization, any sector | Organizations in the medical device life cycle, including suppliers and service providers |
| Main aim | Customer satisfaction and continual improvement | Meeting regulatory requirements and producing safe, effective devices |
| Current edition | ISO 9001:2026, published 16 September 2026 | ISO 13485:2016 |
| Structure | Common structure, clauses 4 to 10 | ISO 9001:2008-style structure, clauses 4 to 8 |
| Improvement | Continual improvement | Maintaining the effectiveness of the QMS |
| Customer focus | Monitoring customer satisfaction | Gathering feedback, handling complaints and reporting to regulators |
| Risk | Risks and opportunities to the QMS | Product risk management across the device life cycle, usually using ISO 14971 |
| Documentation | Documented information as the organization decides | Many required procedures, plus a medical device file for each device type or family |
| Regulatory link | None specific | Basis of the FDA QMSR, and the usual QMS basis for EU MDR and MDSAP |
| Certificate | Three years, with yearly surveillance | Three years, with yearly surveillance |
Clause-by-Clause: What ISO 13485 Adds
Because ISO 13485:2016 keeps the older clause structure, the numbers do not line up one to one with ISO 9001. These are the requirements our auditors spend the most time on when a team moves from ISO 9001.
| ISO 13485 clause | What it requires | ISO 9001 equivalent |
|---|---|---|
| 4.1.6 | Validate software used in the QMS, such as complaint, CAPA or ERP systems | No direct requirement |
| 4.2.3 | Keep a medical device file for each device type or family | No direct requirement |
| 6.4 | Control the work environment and contamination where it affects the product | Environment for operation, in general terms |
| 7.1 | Document risk management for product realization | Risk-based thinking, without product risk files |
| 7.3 | Design and development controls, including verification, validation, transfer and design files | Design and development, with less detail |
| 7.5.6 to 7.5.7 | Validate special processes, including sterilization and sterile barrier systems | Validation of processes, in general terms |
| 7.5.8 to 7.5.9 | Identification and traceability, with extra rules for implantable devices | Identification and traceability, in general terms |
| 8.2.2 to 8.2.3 | Handle complaints and report to regulatory authorities | No direct requirement |
| 8.3 | Control nonconforming product, including after delivery, with advisory notices | Control of nonconforming outputs |
For the ISO 9001 side, see our guide to ISO 9001 cost, timeline and checklist, which includes an internal audit checklist by clause.
Which One Do You Need?
| Your situation | Usually needed |
|---|---|
| You design or make medical devices | ISO 13485 |
| You supply components, materials or contract manufacturing to device makers | ISO 13485, when your customer's supplier approval asks for it |
| You distribute, install or service medical devices | ISO 13485, scoped to those activities |
| You serve medical and non-medical markets | Both, often in one audit programme |
| You have no link to medical devices | ISO 9001 |
An ISO 9001 certificate does not meet a medical device customer's ISO 13485 requirement. If a buyer names ISO 13485, plan for ISO 13485. See how our audits work on the ISO 13485 certification page, or the sector view on ISO certification for medical devices.
Not sure which certificate your customer is asking for? A free scope review answers that before you commit.
See ISO 13485 certificationWhere ISO 13485 Fits With Regulators
- United States. The FDA's Quality Management System Regulation took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference. A certificate does not replace an FDA inspection, but a system built and audited to ISO 13485 is aligned with what inspectors check.
- European Union. Under EU MDR and IVDR, a notified body carries out its own QMS assessment for most device classes. ISO 13485 is the usual basis for that system.
- Canada, Australia, Brazil and Japan. MDSAP audits cover ISO 13485 plus each country's rules, and are carried out only by recognized MDSAP auditing organizations.
- OEMs, distributors and tenders. An accredited ISO 13485 certificate, from an accredited certification body buyers can verify, is often exactly what supplier approval and tender documents ask for.
ISO 9001 has no equivalent regulatory role for medical devices. ISO 9001:2026 adds requirements such as quality culture and ethical behaviour, but it does not add device requirements.
Moving From ISO 9001 to ISO 13485
In the ISO 13485 vs ISO 9001 move, an ISO 9001 system is a strong starting point. These usually carry over with little change:
- Document and record control
- Internal audit and management review
- Corrective action
- Supplier evaluation and purchasing controls
- Competence and training records
These usually need to be built or extended:
- Product risk management, usually using ISO 14971
- A medical device file for each device type or family
- Design and development controls, if design is in scope
- Validation of special processes and of QMS software
- Traceability, and work environment and contamination control
- Complaint handling, regulatory reporting and advisory notices
Audit time is set differently too. ISO 13485 audit time follows IAF MD 9, which accounts for device risk and processes such as sterilization, so the audit is usually longer than ISO 9001 for the same headcount. Our guide to ISO certification cost explains how audit days set the fee.
What Our Auditors Check When You Move to ISO 13485
- The scope names the devices and life-cycle stages covered, and any exclusions are justified.
- Each device type or family has a medical device file.
- Risk management files exist and feed design, production and post-market decisions.
- Validated processes have current validation records, including software used in the QMS.
- Complaints are assessed for regulatory reporting, and reports were made where required.
- Traceability works when the auditor picks a batch or serial number.
- The internal audit covered the new ISO 13485 requirements before Stage 2, run by trained auditors. See our ISO internal auditor training.
Parts of the audit, such as document review and some interviews, can run online. Production and sterilization usually need time on site. See our guide to remote ISO audits. Buyers can check any certificate we issue on our certificate verification page.
Building audit skills on the new ISO 9001 edition?
Learn to plan, lead and report quality management system audits against ISO 9001:2026.
ISO 13485 and ISO 9001 Certification with Accredify Global
Accredited
We are UAF-accredited under the IAF MLA framework, and certify both ISO 13485 and ISO 9001.
One audit programme
Certify both standards together, so shared processes are audited once. Add ISO 14001 for manufacturing sites or ISO 27001 for connected and software devices.
Senior auditor
A senior auditor leads your Stage 1 and Stage 2 audits from scope review to certificate.
Fixed fee
One fixed-fee proposal for your real device scope, with no hidden costs or scope creep added later.
Moving from ISO 9001 to ISO 13485?
Tell us your devices, sites and processes. We'll explain the audit, the days it needs, and send one fixed-fee proposal.
Book your free scope review →ISO 13485 vs ISO 9001 FAQ
What is the main difference between ISO 13485 and ISO 9001?
ISO 9001 is a general quality management standard built around customer satisfaction and continual improvement. ISO 13485 is a quality management standard for medical devices, built around meeting regulatory requirements and producing safe, effective devices. It adds product risk management across the life cycle, more documented procedures, process and software validation, traceability, complaint handling and reporting to regulators.
Is ISO 13485 harder than ISO 9001?
It is more prescriptive. ISO 13485 requires more documented procedures and records, a medical device file for each device type, design and development controls, and post-market activities such as complaint handling and regulatory reporting. Audits also tend to take longer for the same headcount, because the audit time rules for ISO 13485 account for device risk and processes such as sterilization.
Do I need ISO 9001 if I have ISO 13485?
Usually not. If your scope only covers medical devices, ISO 13485 is the standard your customers and regulators look for. Some companies hold both when part of the business makes non-medical products, or when a customer asks for ISO 9001 by name. Both can be audited together in one audit programme.
Can a company be certified to both ISO 13485 and ISO 9001?
Yes. Many manufacturers that serve medical and non-medical markets hold both. Shared processes such as document control, internal audit, management review and corrective action can be audited once, in a single audit programme, with the medical device requirements covered for the ISO 13485 scope.
Is ISO 13485 based on ISO 9001?
ISO 13485:2016 grew out of ISO 9001 and follows the clause structure of the older ISO 9001:2008 edition, with clauses 4 to 8. It does not use the newer common structure that ISO 9001:2015 and ISO 9001:2026 follow, with clauses 4 to 10. The quality management basics are similar, but the requirements are not the same.
Does ISO 9001:2026 change the comparison?
ISO 9001:2026 was published on 16 September 2026, with a transition period of about three years. It adds requirements such as quality culture and ethical behaviour, but it is still a general quality standard. It does not add medical device requirements, so it does not replace ISO 13485 for device companies. ISO 13485:2016 remains the current edition of ISO 13485.
Does the FDA accept ISO 13485 certification?
The FDA's Quality Management System Regulation, effective 2 February 2026, incorporates ISO 13485:2016 by reference. An ISO 13485 certificate shows your system was audited against the standard the QMSR is built on, but it does not replace an FDA inspection.
How do I move from ISO 9001 to ISO 13485?
Start with a gap assessment against ISO 13485. Most ISO 9001 processes carry over, such as document control, internal audit, management review and corrective action. You then add the medical device requirements: product risk management, medical device files, design and development controls, validation, traceability, complaint handling and regulatory reporting. An accredited certification body then audits the system in Stage 1 and Stage 2.
Does Accredify Global certify both ISO 13485 and ISO 9001?
Yes. Accredify Global is a UAF-accredited certification body that certifies ISO 13485 and ISO 9001, and can audit both in one audit programme. Every engagement is led by a senior auditor, with one fixed-fee proposal after a free scope review. Accredify Global is not an MDSAP auditing organization or an EU MDR notified body.