Medical devices
ISO 13485: the quality management system for medical devices
In short
ISO 13485 is the international standard for a quality management system (QMS) specific to medical devices. Based on ISO 9001 but adapted for the sector’s regulatory demands, it covers design controls, risk management, traceability, sterilization, complaint handling and CAPA. Certification by an accredited body is widely expected for market access — it underpins CE marking under the EU MDR and is used in the MDSAP program.
Last reviewed: August 2026
Who it is for
ISO 13485 applies across the medical-device supply chain: manufacturers, designers, and organizations that provide services or components — including software as a medical device (SaMD). Notified bodies and regulators expect it as evidence of a controlled, regulation-aware quality system.
Structure and scope
Unlike newer ISO standards, ISO 13485:2016 deliberately keeps the older clause structure (clauses 4–8) rather than the Annex SL layout, to stay aligned with regulatory expectations. It emphasizes meeting applicable regulatory requirements throughout.
- Quality management system and documentation (including a medical device file)
- Management responsibility and quality policy
- Resource management, competence and infrastructure
- Product realization: design & development controls, purchasing, production, traceability, sterilization and validation
- Measurement, analysis and improvement: complaints, adverse-event reporting, CAPA and internal audit
Typical compliance challenges
- Maintaining design and development files (DHF/technical documentation)
- Integrating risk management (ISO 14971) throughout the lifecycle
- Traceability and unique device identification across production
- Controlling suppliers and outsourced processes
- Running complaint handling, vigilance and CAPA to closure
What can reasonably be automated
- Document and record control with versioning
- CAPA and complaint tracking with owners and due dates
- A supplier register with evaluations and monitoring
- The audit and management-review calendar
- Training and competence records, and shared evidence with ISO 9001
Evidence auditors expect
- Quality manual, quality policy and scope
- Design and development files and design controls
- Risk management file (ISO 14971)
- CAPA, complaint and vigilance records
- Supplier evaluations and controls of outsourced processes
- Internal audit reports and management review minutes
Relationship to ISO 9001 and regulation
ISO 13485 shares much of its foundation with ISO 9001, so organizations running both can integrate the common elements. It is often paired with ISO 14971 for risk management and underpins regulatory routes such as CE marking under the EU MDR and MDSAP — but certification to ISO 13485 is not itself regulatory clearance to market a device.
How Isodora supports ISO 13485
Isodora runs the medical-device QMS as a live operation, integrated with your other standards.
Integrated management system
CAPA, complaints, risks, suppliers and the audit calendar in one place — shareable with management and auditors.
CAPA to closure
Track corrective and preventive actions and complaints to closure with clear ownership.
Supplier registry
Evaluate and monitor suppliers and outsourced processes across the chain.
One-click reports
Management-review and audit-ready reports generated from live data.
Isodora helps you build and maintain a medical-device QMS. ISO 13485 certification is issued by an independent accredited body, and it is not regulatory clearance to place a device on the market.
Frequently asked questions
- What is ISO 13485 used for?
- ISO 13485 gives medical-device organizations a quality management system tailored to the sector’s regulatory demands, covering design controls, risk, traceability and CAPA. It is widely expected for market access and underpins CE marking under the EU MDR.
- What is the difference between ISO 13485 and ISO 9001?
- ISO 13485 is built on ISO 9001’s foundation but adds medical-device-specific and regulatory requirements, and keeps the older clause structure. ISO 13485 focuses on maintaining an effective, regulation-aware QMS rather than on continual improvement as an objective in itself.
- Is ISO 13485 a regulatory approval?
- No. It certifies your quality management system. Placing a device on the market still requires the applicable regulatory route (for example CE marking under the EU MDR), for which ISO 13485 is a supporting foundation.