ISO Certification for Medical Devices: Accredited ISO 13485 Audits
ISO certification for medical devices starts with ISO 13485, the quality standard regulators and buyers expect. Accredify Global audits device manufacturers, contract manufacturers, component suppliers, and software teams against it. We check your design files, supplier controls, complaints, and CAPA records. You get a tailored proposal after a free scoping review.
What ISO Certification for Medical Devices Covers
ISO certification for medical devices is independent proof that your quality management system meets ISO 13485:2016. An accredited certification body audits it in two stages. If it conforms, the body issues a certificate for the products, processes, and sites in your scope.
ISO 13485 is written for regulated device work. It asks for risk-based decisions across the whole product lifecycle, from design to post-market feedback. It also asks you to meet the regulatory requirements of the markets you sell into. That is why regulators, notified bodies, and hospital buyers treat it as the baseline.
Accredify Global is a UAF-accredited certification body under the IAF MLA framework, with ISO 13485 in its accreditation scope. The full standard-level details are on our ISO 13485 certification page. This page explains how certification works for device companies and which other standards often sit alongside it.
Medical Device ISO Certification in 2026: FDA QMSR and a Confirmed ISO 13485
The FDA now uses ISO 13485 as its quality system rule. The Quality Management System Regulation (QMSR) took effect on 2 February 2026. It incorporates ISO 13485:2016 by reference, together with clause 3 of ISO 9000:2015. FDA still inspects manufacturers under its own compliance program, so a certificate does not replace an FDA inspection. It does mean your certified system and your FDA obligations now rest on the same standard.
ISO 13485:2016 remains the current edition. ISO reviewed and confirmed it in 2025, so there is no new version to move to. In the EU, higher-risk devices still need a notified body under the Medical Device Regulation. MDSAP audits are run only by recognized auditing organizations. An accredited ISO 13485 certificate supports both routes but is a separate thing.
Sources: FDA, Quality Management System Regulation · ISO 13485:2016 (ISO)
Who Needs ISO Certification in the Medical Device Supply Chain?
Most projects start with a regulator, a distributor, or an OEM customer asking for proof of a controlled quality system.
Legal manufacturers placing devices on the market, from single-use products to capital equipment.
CMOs building, assembling, or sterilizing devices for brand owners who must control their suppliers.
Moulders, machinists, electronics and packaging suppliers whose OEM customers ask for ISO 13485. See our electronics industry page.
Teams building software as a medical device or connected products, often alongside ISO 27001.
Sterilization, calibration, servicing, and repair organizations that support device makers.
Firms storing and distributing devices, where traceability and complaint handling matter most.
Serving hospitals and clinics as well? Our healthcare industry page covers providers, and our pharmaceutical industry page covers drug and combination-product supply chains.
ISO Standards for Medical Device Companies, and What We Provide
ISO 13485 is the anchor. The others depend on your products, sites, and customers.
| Standard | What it covers | When device companies need it | What Accredify Global provides |
|---|---|---|---|
| ISO 13485 | Quality management for medical devices | Almost always: regulators, notified bodies, and OEMs expect it | Accredited certification |
| ISO 9001 | General quality management | Non-device product lines, or suppliers whose customers ask only for ISO 9001 | Certification |
| ISO 14001 | Environmental management | Sites with chemicals, sterilants, or hospital buyers scoring sustainability | Certification |
| ISO 45001 | Occupational health and safety | Manufacturing sites with cleanroom, machining, or sterilization risks | Certification |
| ISO 27001 | Information security management | Connected devices, device software, and patient data platforms | Certification |
| ISO 14971 | Risk management for medical devices | Used inside your ISO 13485 system | Checked within ISO 13485 audits, not a separate certificate |
| HIPAA / GDPR | Health data privacy laws | Devices and apps handling patient data in the US or EU | Readiness assessment, not certification |
What an ISO 13485 Auditor Checks at a Medical Device Company
These are the areas where device audits most often find gaps. Each one maps to a clause of ISO 13485:2016.
| Area | ISO 13485 clause | What the auditor looks for |
|---|---|---|
| Medical device file | 4.2.3 | A file for each device type or family, with specifications and regulatory records |
| Software validation | 4.1.6, 7.5.6 | Validation of software used in the quality system and in production |
| Design and development | 7.3 | Design inputs, reviews, verification, validation, and design transfer records |
| Supplier control | 7.4 | Supplier selection by risk, quality agreements, and incoming checks |
| Process and sterilization validation | 7.5.6, 7.5.7 | Validated special processes, sterile barrier, and revalidation triggers |
| Traceability | 7.5.8, 7.5.9 | Lot or serial traceability, stronger still for implantable devices |
| Complaints and reporting | 8.2.2, 8.2.3 | Complaints logged and assessed, with reportable events sent to regulators |
| CAPA | 8.5.2, 8.5.3 | Root cause, action, and proof the action worked |
Design and development can be left out of scope only where regulations allow it, for example at a contract manufacturer with no design role. The exclusion must be justified in your quality manual.
The Medical Device ISO Certification Process, Step by Step
Six stages from first call to a certificate that stays valid for three years. Our ISO certification process guide has more detail.
Not sure your device quality system is ready for Stage 1? A free scoping review tells you before the auditor does.
Book a free scoping reviewWhat Drives the Cost of ISO Certification for Medical Devices
There is no list price. The cost follows the audit man-days your scope needs. A free scoping review gives you a tailored proposal.
What sets the audit man-days
- People — staff whose work affects device quality
- Devices — product families and their risk classes
- Design role — whether design and development are in scope
- Special processes — sterilization, cleanrooms, and software
- Sites — manufacturing, warehouse, and design locations
- Outsourcing — critical suppliers and contract manufacturers
Ways to keep audit time efficient
- Run a full internal audit and management review before Stage 1
- Keep device files and design history easy to retrieve
- Close open CAPAs, or show a plan with dates
- Combine standards in one integrated certification audit
- Group similar devices into families where the rules allow
Questions to Ask a Medical Device Certification Body
Worth asking before you sign, with Accredify Global's answers.
| Question to ask | Accredify Global's answer |
|---|---|
| Are you accredited for ISO 13485? | Yes. ISO 13485 is in our UAF accreditation scope, under the IAF MLA framework. |
| Does your certificate replace a notified body or MDSAP audit? | No. Those are separate regulatory routes. Our certificate supports them but does not replace them. |
| Will you also build our quality system? | No. A certification body must stay impartial, so we audit and certify but do not consult. See our impartiality commitments. |
| Can you audit several sites and suppliers? | Yes. We plan audit time across sites and check how you control outsourced processes. |
| How is it priced? | A tailored proposal based on audit man-days, after a free scoping review. |
| Can customers verify the certificate? | Yes, on our certificate verification page. |
FAQ: ISO Certification for Medical Devices
Straight answers on ISO 13485, FDA QMSR, EU MDR, cost, and timelines.
What is ISO certification for medical devices?
It is independent confirmation that a device company's quality management system meets ISO 13485:2016. An accredited certification body audits the system in two stages and, if it conforms, issues a certificate for the products, processes, and sites in scope.
Which ISO standard applies to medical devices?
ISO 13485 is the main quality standard for medical devices. Companies often add ISO 14001, ISO 45001, or ISO 27001 depending on their sites and products. ISO 14971 on risk management is applied inside the ISO 13485 system rather than certified on its own.
Is Accredify Global accredited for ISO 13485?
Yes. Accredify Global is a UAF-accredited certification body under the IAF MLA framework, with ISO 13485 in its accreditation scope. You can check our accreditation in the UAF directory.
Does ISO 13485 certification replace an FDA inspection?
No. Since 2 February 2026, the FDA Quality Management System Regulation incorporates ISO 13485:2016 by reference, but FDA still inspects manufacturers under its own program. Certification shows your system meets the same standard FDA now uses.
Is ISO 13485 enough for CE marking under the EU MDR?
Not on its own. Most devices above the lowest risk class need a notified body to assess them under the EU Medical Device Regulation. An ISO 13485 certificate supports that work but does not replace the notified body's conformity assessment.
Do component suppliers need ISO 13485?
It is not a legal requirement for most suppliers, but many device makers ask for it in supplier agreements. Some suppliers start with ISO 9001 and move to ISO 13485 when OEM customers require it.
How much does ISO certification for medical devices cost?
The cost depends on audit man-days. These are set by headcount, device families and risk classes, whether design is in scope, special processes such as sterilization, sites, and outsourced work. Accredify Global reviews your scope for free and sends a tailored proposal.
Can Accredify Global help us write our quality system?
No. As a certification body we must stay impartial, so we do not design or write your quality system. We audit it, report findings with evidence, and make an independent certification decision.
Get an Accredited ISO 13485 Certificate Your Regulators and Customers Trust
Tell us about your devices, sites, and target markets. We'll confirm your scope, suggest audit dates, and send a tailored proposal.
Book your free scoping review →