What is ISO 13485 for Medical Equipment Buyers

ISO 13485 is the international standard for quality management systems specific to medical devices. It is not a product standard — it does not certify that a particular device is safe. Instead, it certifies that the processes a manufacturer uses to design, produce, test and service their devices are consistently controlled and documented. That distinction matters for buyers: ISO 13485 certification tells you a lot about how a manufacturer works, but it must be read alongside the device-specific approvals.

This guide explains what ISO 13485 covers, what certification means in practice, how it connects to regulatory approval, and what medical equipment buyers should check when reviewing supplier qualifications.

ISO 13485 in three points

Understanding three things about ISO 13485 covers most of what buyers need to know.

• It is a QMS standard, not a product standard. ISO 13485 certifies the manufacturer's quality management system — their processes, controls and documentation — not the safety or performance of any specific device. Product safety comes from device-specific approvals such as CE marking or FDA clearance.

• It is the route to most market approvals, CE marking under EU MDR, UKCA marking, and FDA quality system requirements, all of which align with or rely on ISO 13485. In practice, a manufacturer without it cannot obtain market approval for most regulated markets.

• Scope matters as much as the certification; the ISO 13485 certificate applies to a defined scope. Confirm the scope covers the specific products you are buying — a manufacturer may hold the standard for one product line but not another.

What ISO 13485 requires of manufacturers

1. A quality management system is a documented QMS covering all processes relevant to device design, manufacture, testing, storage, distribution, and servicing, with management review and continual improvement.

2. Risk management must be incorporated throughout the QMS, typically using ISO 14971, covering design, production, and post-market risks.

3. Design controls defined and documented processes for device design and development, including design inputs and outputs, verification and validation, and design change control.

4. Production and process controls ensured manufacturing processes were validated and that production records were documented, ensuring devices are consistently produced to specification.

5. Incoming inspection and supplier controls verification of purchased materials and components, with documented supplier qualification and purchasing controls.

6. Complaints and corrective actions processes for handling customer complaints, investigating non-conformances and taking corrective and preventive actions — the CAPA system.

7. Post-market surveillance collection and analysis of post-market data, feeding back into risk management, design and QMS improvement.

8. Internal auditing regularly performs internal audits of all QMS processes, with documented findings and follow-up, as the primary mechanism for QMS self-assessment.

ISO 13485 versus ISO 9001

Buyers sometimes ask about the difference between ISO 9001 — the general quality standard — and ISO 13485. They are related but distinct.

ISO 9001 alone is not sufficient for medical device regulatory compliance. For medical equipment buyers, ISO 13485 is the standard that matters.

Checking a manufacturer's ISO 13485 certification?

We hold current ISO 13485 certification across our supply chain. Tell us the device and we will provide the certificate, confirm the scope and answer any questions about the quality management processes behind it.

No pressure, no obligation. → Talk to the team

How ISO 13485 connects to market approval

ISO 13485 sits at the centre of the global medical device regulatory framework.

• Conformity assessment under the EU MDR and CE marking requires the manufacturer to have a quality management system that meets the requirements of Annex IX, which closely aligns with ISO 13485. Notified bodies verify QMS compliance as part of CE certification.

• UK UKCA marking the UK MDR 2002 requires manufacturers to have a QMS meeting equivalent requirements, in practice aligned with ISO 13485. UK Approved Bodies assess QMS compliance.

• FDA QMSR, the FDA's Quality Management System Regulation (21 CFR Part 820), updated in February 2026, now explicitly incorporates ISO 13485 requirements, making the two substantially harmonised for the US market. The 

• Gulf and South Africa SFDA and SAHPRA both require manufacturers to demonstrate compliance with a quality management system in practice, accepting ISO 13485 certification as primary evidence.

ISO 13485 certification does not replace market-specific device approval — it is a prerequisite for obtaining it. A device sold on the strength of ISO 13485 alone, without CE, UKCA, or FDA clearance, is not compliant and approved for the market.

What buyers should check

When reviewing ISO 13485 as part of supplier qualification, check these points in order.

1. Request the current ISO 13485 certificate. Ask for a copy of the manufacturer's current ISO 13485 certificate, not just a self-declaration that they hold it.

2. Check that the certificate is in order, and confirm the issue date, expiry date,  and surveillance audit status. A lapsed certificate is not valid.

3. Verify that the certifying body issuing the certificate is accredited. In the UK, check that UKAS or an equivalent body accredits the body. Unaccredited certificates carry limited weight.

4. Read the scope statement carefully. The scope defines exactly what products and processes the QMS covers. Confirm it includes the device type, category and manufacturing activities relevant to what you are buying.

5. Check for major non-conformance and ask whether the manufacturer has any open major non-conformance items from their last surveillance audit. A certificate can remain in place with conditions attached.

6. Confirm the site's ISO 13485 certificates cover the named facilities. Confirm the certificate covers the manufacturing site for the devices you are buying, not a different facility in the company.

7. Cross-reference with the market approval check to confirm that the market approval certificate (CE, UKCA, FDA) was also recently reviewed — ISO 13485 and device approval should be current simultaneously.

For critical or high-value procurement, consider requesting a copy of the manufacturer's most recent audit summary or asking to review the certification body's certificate of conformity with the scope letter, which provides more detail than the headline certificate.

Common mistakes when assessing ISO 13485

These are the most frequent errors buyers make when evaluating ISO 13485 certification.

• Accepting an expired certificate is subject to defined validity periods. An expired ISO 13485 certificate means the QMS has not been assessed recently — do not accept it as current.

• Not checking the scope, a manufacturer may hold ISO 13485 for surgical instruments but not for imaging equipment. Never assume the scope is broader than what the certificate states.

• Treating ISO 13485 as a substitute for approval,l ISO 13485 demonstrates quality system competence. It does not replace UKCA, CE or FDA approval. Both must be in place for a device to be legally compliant for a regulated market.

• Not verifying the certification or accreditation on a certificate from an unaccredited body carries no regulatory weight. Always confirm the certifying body is itself accredited by a recognised national accreditation body.

• Ignoring the manufacturing site, the  ISO 13485 certificates name specific facilities. A manufacturer with multiple sites may hold the certificate for their head office but not for a subcontracted factory.

ISO 13485 recognition by region

ISO 13485 is internationally recognised, but its role in each market's regulatory framework differs slightly.

ISO 13485 is the closest thing to a universal baseline for medical device quality. Regardless of the destination market, the quality credential matters most in supplier qualification.

More from Business

• Buyers — source medical equipment from ISO 13485-certified manufacturers with a verified scope.

• Suppliers — list your ISO 13485-certified devices and make your quality credentials visible to buyers.

• Advertise — promote your products and services to a clinical audience.

• Business overview — explore everything MediGear offers healthcare organisations.

Disclaimer

This article is for general information only and does not constitute legal, regulatory, procurement or clinical advice. ISO 13485 requirements, regulatory frameworks and market approval processes change over time. Always refer to the current published version of the standard, verify certification status with the certifying body, and consult a qualified regulatory affairs or procurement professional for advice specific to your organisation. medigear.UK accepts no liability for actions taken based on this content.