Who needs ISO 13485?

ISO 13485 certification is typically sought by medical device manufacturers themselves, as well as by organisations across their supply chain — component suppliers, contract manufacturers, sterilisation providers, distributors and service providers whose work can affect a device's safety or performance. In most major medical device markets, including the EU (under the Medical Device Regulation, MDR) and the United States (where the FDA has been aligning its Quality System Regulation with ISO 13485), a certified QMS built on this standard is either a direct requirement or the practical route regulators and notified bodies expect manufacturers to take. Exact regulatory cross-references vary by market and change over time, so any organisation should confirm the current requirements for its specific device class and target markets with a qualified regulatory professional or notified body rather than relying on general guidance.

ISO 13485 and ISO 9001: related, but not the same

A common misconception is that ISO 13485 is simply "ISO 9001 plus some medical device requirements." That is not accurate. ISO 13485:2016 is a standalone, independently certifiable standard — an organisation does not need to be ISO 9001 certified to obtain ISO 13485 certification, and the two are audited and certified separately.

That said, the two standards share a similar overall structure and much of the same underlying quality-management logic, which is by design: ISO 13485 was developed with ISO 9001 as a reference point, and the official ISO 13485:2016 text includes an annex with a cross-reference table mapping the two standards against each other. This is useful for organisations transitioning from one to the other or maintaining both. We don't reproduce that mapping here, since getting it right clause-by-clause deserves its own careful treatment — it's covered in full in our dedicated article on the ISO 13485 / ISO 9001 correspondence table.

The certification process, in general terms

While exact timelines and costs vary considerably by organisation size, device complexity, existing QMS maturity and the certification body chosen, ISO 13485 certification generally follows a recognisable path:

1. Gap analysis: comparing the organisation's current processes and documentation against the requirements of clauses 4–8 to identify what needs to be built or strengthened.
2. Documentation: developing or updating the quality manual, mandatory procedures, work instructions and records the standard requires.
3. Implementation: putting the documented QMS into practice across the organisation, including training staff on their responsibilities.
4. Internal audit: auditing the QMS against the standard's requirements before the external audit, to catch and correct nonconformities early.
5. Management review: a formal review by top management of the QMS's performance, as required by Clause 5.
6. Certification audit: conducted by an accredited certification body, usually in two stages — a documentation review followed by an on-site assessment of implementation.

Following certification, organisations undergo periodic surveillance audits to maintain their certificate. Specific durations, audit frequencies and costs depend on the accredited certification body and the scope of certification, so they should be confirmed directly with the body in question rather than assumed from general benchmarks.

Where ISO 13485 causes the most practical friction

In our experience working with manufacturers and their compliance documentation, the practical pain rarely comes from understanding what the standard says — it comes from proving, on demand, that a specific requirement is met. During an audit, or when a regulator asks a targeted question, someone needs to locate the exact procedure, the exact version, and the exact record that demonstrates compliance — quickly and accurately. When that documentation is scattered across shared drives, outdated file versions and disconnected systems, teams lose hours searching, and worse, sometimes answer from memory rather than from the current controlled document.

This is precisely the gap IgeraIndustria is built to close. It is AI that answers directly from an organisation's own QMS documents — procedures, work instructions, records — and cites the exact source for every answer, rather than generating a plausible-sounding response. For a standard as documentation-heavy as ISO 13485, having a tool that can instantly surface "which procedure covers this, and what does it say" turns audit preparation from a scramble into a lookup.

Common mistakes organisations make

• Treating it as "ISO 9001 with extra steps." Because the standards share structure, teams sometimes copy an ISO 9001 QMS wholesale and bolt on medical device language, missing requirements — like specific design control and risk management expectations — that have no direct equivalent in ISO 9001.
• Writing documentation that doesn't match practice. A quality manual and procedures that describe an idealised process, rather than what actually happens on the floor, will not survive an audit and undermines the point of having a QMS at all.
• Under-resourcing Clause 8. Organisations often invest heavily in getting certified (clauses 4–7) but treat ongoing monitoring, internal audits and CAPA (Clause 8) as a lesser priority — even though this is exactly what keeps a QMS effective, and what surveillance audits scrutinise most closely.
• Losing document control discipline over time. Initial certification often comes with tight document version control; a year or two later, outdated copies of procedures are still circulating because updates weren't properly communicated or superseded versions weren't withdrawn.
• Assuming certification is a one-off project. ISO 13485 compliance is maintained through surveillance audits and continuous QMS operation, not achieved once and forgotten.

Frequently asked questions