ISO 13485

Who has to comply

Voluntary as a standard, but effectively required for medical device manufacturers and many of their critical suppliers. Regulators in Canada (MDSAP mandatory), the EU (via notified body assessment), Australia, Japan, Brazil, and now the US (QMSR) rely on it. Contract manufacturers, sterilizers, and component suppliers are usually asked for certification by their customers.

What the assessor asks to see

Quality manual, scope, and role of the organization (manufacturer, importer, distributor, contract manufacturer); regulatory requirements register by market; medical device files; design and development planning, inputs, outputs, verification, validation, transfer, and change records; risk management files per ISO 14971; usability and software life cycle records where applicable; supplier evaluation and agreements; purchasing and incoming inspection; production records, process validation (including sterilization, packaging, software), and equipment maintenance; cleanliness and contamination control; identification, traceability, and UDI; labeling; storage and distribution; installation and servicing; complaint handling and vigilance decisions; advisory notices and recalls; CAPA; internal audits; management review; training and competence.

Where the requirement sits: 4.2.4 control of documents; 4.2.5 control of records; 6.2 competence/training; 4.1.1 documented QMS

ISO 13485 and the FDA QMSR

FDA's QMSR (21 CFR Part 820, effective February 2, 2026) incorporates ISO 13485:2016 by reference with FDA-specific additions. An ISO 13485 certificate is not required for FDA compliance and does not by itself satisfy it, but a well-run ISO 13485 system now maps almost one-to-one to what FDA investigators check.

MDSAP audits, which are built on ISO 13485, can be accepted by FDA in place of routine surveillance inspections.