ISO 13485 is the international quality management system standard for medical devices, current edition ISO 13485:2016, titled Requirements for regulatory purposes. It specifies QMS requirements for organizations that need to demonstrate they consistently provide medical devices meeting customer and regulatory requirements, and it applies across the lifecycle and the supply chain, including suppliers and service providers.

What is the difference between ISO 13485 and ISO 9001?

They share the ISO 9001 QMS skeleton, but ISO 13485 is prescriptive rather than flexible, anchored to regulatory requirements, and organized around risk management across the device lifecycle. It keeps the quality manual and management representative that ISO 9001:2015 dropped, demands detailed design controls, and asks you to maintain QMS effectiveness rather than make continual improvement the headline goal.

Is ISO 13485 required by the FDA?

Effectively yes as of February 2, 2026. The FDA's Quality Management System Regulation (QMSR) incorporates ISO 13485:2016 by reference into 21 CFR Part 820, replacing much of the former Quality System Regulation. So while certification remains voluntary, meeting ISO 13485:2016 is now the basis for US medical-device quality regulation, with additional FDA-specific requirements layered on.

What are design controls in ISO 13485?

Design controls are the documented, staged process for developing a device: planning, inputs, outputs, review, verification, validation, transfer to production, and change control, all captured in a design and development file. Verification confirms outputs meet inputs; validation confirms the device works for real users in real conditions. ISO 13485 is far more prescriptive about these stages than ISO 9001.

How does ISO 13485 relate to ISO 14971?

ISO 13485 requires risk management throughout product realization but does not specify how to do it. ISO 14971 provides the method, covering terminology, principles, and a process for identifying hazards, estimating and evaluating risk, controlling it, and monitoring across the device lifecycle. In practice manufacturers implement both: ISO 13485 says you must manage risk, and ISO 14971 tells you how.

Does ISO 13485 require continual improvement like ISO 9001?

Not in the same way. ISO 9001 makes continual improvement a central obligation. ISO 13485 asks you to maintain the effectiveness of the quality management system. The difference reflects the regulated device context, where an uncontrolled change to a validated process is a risk, so stability and control are prioritized over open-ended optimization.

Who needs ISO 13485 certification?

Medical device manufacturers and organizations in the device supply chain, including component suppliers, contract manufacturers, sterilization providers, and service organizations. It is expected for CE marking under EU medical device regulations, recognized under MDSAP, and now the reference standard under the US QMSR, so companies selling devices in major markets build an ISO 13485 system whether or not they pursue the certificate.

ISO 13485: QMS for Medical Devices

The quality standard that turns ISO 9001's flexibility into a regulator's prescription.

ISO 13485 is the international quality management system standard written specifically for medical devices. It takes the general QMS framework of ISO 9001 and makes it prescriptive and regulation-driven, with hard requirements for design controls, risk management across the product lifecycle, and documentation and traceability that satisfy regulators.

The current edition is ISO 13485:2016. On its surface it looks like a cousin of ISO 9001, and it shares much of the same skeleton, but the intent is different in a way that changes everything a manufacturer does. ISO 9001 is about customer satisfaction and continual improvement. ISO 13485 is about consistently meeting customer and regulatory requirements so that safe, effective devices reach patients. Where ISO 9001 gives you room to decide, ISO 13485 tends to tell you.

That difference just got more consequential in the United States. As of February 2, 2026, the FDA's Quality Management System Regulation (QMSR) incorporates ISO 13485:2016 by reference into 21 CFR Part 820, so the standard is no longer just a certification choice; it is the backbone of US medical-device quality regulation. This guide covers what ISO 13485 requires, how it differs from ISO 9001, and how it links to QMS software medical device manufacturing and other regulated frameworks like IATF 16949.

What is ISO 13485?

ISO 13485:2016 is the standard titled "Medical devices, Quality management systems, Requirements for regulatory purposes." That last phrase is the whole point. It specifies requirements for a QMS where an organization needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements. It applies across the lifecycle: design, production, storage, distribution, installation, servicing, and final decommissioning, and it applies not just to device makers but to suppliers and service providers in the medical-device supply chain.

Certification to ISO 13485 is voluntary in the strict sense, but in practice it is the price of entry. It is required or expected for CE marking under the EU medical device regulations, recognized in the Medical Device Single Audit Program (MDSAP) used by several national regulators, and now the reference standard under the US QMSR. A company that wants to sell devices in the major markets ends up building an ISO 13485 system whether or not it seeks the certificate.

How does ISO 13485 differ from ISO 9001?

They share the plan-do-check-act spine and much of the same clause language, but ISO 13485 diverges hard on four fronts: it is prescriptive rather than flexible, it is regulation-anchored, it treats risk as the organizing principle, and it demands far deeper documentation. A notable structural difference: ISO 9001:2015 dropped the requirement for a documented quality manual and management representative, while ISO 13485:2016 kept both, because regulators want a defined structure they can inspect.

Area	ISO 9001:2015	ISO 13485:2016
Primary aim	Customer satisfaction, continual improvement	Safe, effective devices meeting regulatory requirements
Style	Flexible, outcome-focused	Prescriptive, requirement-focused
Risk	Risk-based thinking, general	Risk management across lifecycle, tied to ISO 14971
Design controls	General design and development clause	Detailed: design files, transfer, verification, validation
Documentation	Reduced; no mandated quality manual	Extensive; quality manual and device files required
Continual improvement	Central requirement	Maintain effectiveness; improvement not the headline

ISO 13485 keeps the ISO 9001 skeleton but replaces flexibility with prescription wherever patient safety and regulatory evidence are at stake.

The single most quoted difference is about continual improvement. ISO 9001 makes it a core obligation: get better over time. ISO 13485 asks you to maintain the effectiveness of the QMS. That is not laziness; it reflects that in a regulated device world, an uncontrolled change to a validated process is a risk, not automatically an improvement. Stability and control outrank optimization.

ISO 13485 is not a different building from ISO 9001; it is the same foundation with medical-device pillars bolted on where patient safety demands them.

What are design controls under ISO 13485?

Design controls are the disciplined, documented process for taking a device from requirement to validated production, and ISO 13485 is far more prescriptive about them than ISO 9001. The standard breaks design and development into distinct, evidenced stages: planning, inputs (user needs and intended use turned into measurable requirements), outputs, review, verification (did we build the device right, against the inputs), validation (did we build the right device, for the user and use environment), transfer to production, and change control. All of it is captured in a design and development file, the auditable record that the device was designed on purpose, not discovered.

The distinction between verification and validation trips up newcomers. Verification confirms outputs meet inputs, the specification was met. Validation confirms the device works for real users in real conditions, often requiring clinical evaluation. A device can pass verification and fail validation if the requirements themselves were wrong, which is exactly why the standard demands both.

Design controls form a V: each build stage on the left has a matching check on the right, with the whole file kept as auditable evidence.

How does risk management fit into ISO 13485?

Risk management is the organizing principle of the whole standard, not a single clause. ISO 13485 requires a risk-based approach to the QMS and requires risk management throughout product realization, but it does not tell you how to do risk management. For that it points to ISO 14971 the standard for the application of risk management to medical devices. In practice you need both: ISO 13485 says you must manage risk; ISO 14971 tells you how, through hazard identification, risk estimation and evaluation, risk control, and monitoring across the device lifecycle.

The contrast with ISO 9001 is stark and easy to measure. ISO 9001 uses general risk-based thinking. In ISO 13485 the word risk appears throughout the standard and drives decisions everywhere, from supplier controls to process validation to how much verification a change requires. Under the new US QMSR this deepens further, because the old Quality System Regulation mentioned risk in essentially one place, while ISO 13485 threads it through the entire system.

How to move toward ISO 13485 compliance in 7 steps

Confirm scope and regulatory targets. Decide which markets you serve, because that sets which regulations layer on top of ISO 13485: EU MDR, US QMSR, MDSAP, and others. The standard is the base; the markets set the additions.
Do a gap assessment against ISO 13485:2016. If you already run ISO 9001, map what carries over and, more importantly, where the standard is stricter: quality manual, design files, risk management, documentation retention, and traceability.
Build the risk management system to ISO 14971. Stand up the risk process first, because it feeds everything else, design decisions, supplier controls, validation depth, and post-market surveillance.
Establish design controls with a real design file. Define the stages, the reviews, and the verification and validation evidence, and keep the design and development file as the single auditable record.
Control documents, records, and traceability. Set up controlled procedures, device master records, and lot or unit traceability deep enough to support a field action. Align electronic records and signatures with 21 CFR Part 11 where they apply.
Validate processes and qualify suppliers. Validate any process whose output cannot be fully verified, sterilization and welding are classic cases, and tighten supplier quality management with risk-based controls and agreements.
Run the QMS, then certify. Operate internal audits, management review, corrective action and nonconformance handling long enough to generate records, then bring in a certification body for the audit.

ISO 13485 facts worth knowing

A few reference points, straight from the standards bodies and the regulator:

ISO 13485:2016 is the current edition of the medical-device QMS standard, titled "Requirements for regulatory purposes," and applies across the device lifecycle and supply chain (ISO 13485:2016).
The US FDA's Quality Management System Regulation (QMSR) became effective February 2, 2026, incorporating ISO 13485:2016 by reference into 21 CFR Part 820 to harmonize with international requirements (FDA QMSR).
ISO 13485 requires risk management but references ISO 14971:2019 for the method, which specifies terminology, principles, and a process for medical-device risk management across the lifecycle (ISO 14971:2019).

Where ISO 13485 fits with the rest of quality

ISO 13485 is the sector-specific member of a family. It is the medical-device analog of IATF 16949 in automotive: both take the ISO 9001 base and add industry-specific, customer- and regulator-driven requirements. It is the QMS layer that sits under regulated medical device manufacturing and it depends on the same building blocks as any serious quality system, controlled procedures corrective action and disciplined supplier management just held to a higher evidentiary bar.

The cost of ISO 13485 is rarely the concepts; it is the documentation load. Design files, risk files, device master records, traceability, and audit trails all have to be complete, current, and retrievable on demand, and that is exactly where paper-and-spreadsheet systems buckle under a regulator's questions. Harmony captures records at the point of work and keeps them searchable and linked on top of your existing QMS no rip-and-replace, so the evidence a QMSR or MDSAP audit asks for is already assembled. See it on a real floor in our CLS case study or explore the capture and search features that turn regulatory documentation from a scramble into a lookup.