What is ISO 13485?

The Quality Management Standard for Medical Devices

ISO 13485 is the international standard for quality management systems (QMS) for the medical device industry.

It specifies the requirements organizations must meet to consistently design, manufacture, and deliver safe, effective medical devices that comply with applicable regulatory requirements.

The current version, ISO 13485:2016, applies to organizations involved at any stage of the medical device life cycle, including design and development, manufacturing, storage and distribution, installation, and servicing. It also applies to suppliers whose products or services can affect the quality or safety of medical devices.

The standard has become significantly more important for manufacturers selling into the United States.

As of February 2, 2026, the FDA’s updated Quality Management System Regulation (QMSR) incorporates ISO 13485:2016 by reference into 21 CFR Part 820. For many medical device manufacturers, compliance with ISO 13485 is now effectively a federal regulatory requirement.

On this page:

What ISO 13485 actually requires
ISO 13485 vs. ISO 9001: key differences
The FDA QMSR: what changed in February 2026
Global regulatory recognition
Common compliance challenges
How isoTracker helps
What our customers say
Useful resources
Frequently asked questions

What ISO 13485 actually requires

ISO 13485 defines the requirements for a quality management system covering the entire medical device life cycle.

Although it shares common roots with ISO 9001, it is a standalone standard with its own requirements. Its primary focus is regulatory compliance, patient safety, and product quality, rather than the broader quality management principles that underpin ISO 9001.

ISO 13485 is organized into a number of clauses covering different aspects of a medical device quality management system.

In practice, organizations implementing the standard will typically need to address the following areas:

Establish and maintain a quality management system. Document the QMS and ensure it is implemented, maintained, and kept up to date. Unlike ISO 9001, the emphasis is on demonstrating an effective quality management system rather than continual improvement beyond what regulatory requirements demand.

Demonstrate management commitment. Top management must establish a quality policy, define quality objectives, and provide the resources needed to meet both ISO 13485 and applicable regulatory requirements.

Plan and control the QMS. Identify the processes needed for the QMS, define how they interact, and ensure they are appropriately resourced, monitored, and controlled.

Manage resources. Ensure personnel performing quality-related activities are competent and appropriately trained, with records maintained as evidence. Infrastructure and work environments must also be suitable for producing safe, compliant medical devices, including cleanliness controls where required.

Control product realization. Plan and document every stage of bringing a medical device to market, including design and development, purchasing, production, installation, and servicing. Design controls, Design History Files (DHFs), and Device Master Records (DMRs) are key elements of this process.

Control suppliers and purchased products. Evaluate, qualify, and monitor suppliers based on their ability to meet quality and regulatory requirements. Organizations must maintain supplier qualification records and actively manage supplier-related risks.

Control nonconforming product. Identify, segregate, evaluate, and appropriately disposition products that fail to meet specified requirements. Where necessary, organizations must investigate nonconformities and determine whether regulators, customers, or other external parties need to be notified.

Monitor, measure, and analyze performance. Collect and analyze data on product quality, process performance, customer feedback, and complaint trends to verify that the QMS is operating effectively.

Implement Corrective and Preventive Action (CAPA). Investigate the root causes of actual and potential nonconformities, implement appropriate actions, and verify that those actions are effective. CAPA activities must meet regulatory requirements without compromising product safety or performance.

Manage complaints. Establish documented procedures for recording, investigating, and resolving complaints, and determine whether they constitute reportable events under applicable regulatory requirements.

ISO 13485 vs. ISO 9001: key differences

Contrary to a common misconception, ISO 13485 is not simply “ISO 9001 plus extra medical device requirements.” It is a separate standard with its own structure, terminology, and regulatory focus.

Choosing the right standard will depend on your industry, regulatory obligations, and business objectives.

	ISO 13485:2016	ISO 9001:2015
Primary purpose	Medical device regulatory compliance and patient safety	General quality management and customer satisfaction
Structure	Based on ISO 9001:2008 structure – does not share the High Level Structure of ISO 9001:2015	High Level Structure (HLS) shared with ISO 14001, ISO 45001, and others
Continual improvement	Requires that the QMS is effectively implemented and maintained	Requires demonstrable continual improvement
Customer satisfaction	Not an explicit requirement (although meeting customer and regulatory requirements remains central)	A core requirement
Regulatory focus	Explicitly designed to meet regulatory requirements for medical devices	General standard; not sector-specific
Preventive action	Explicit preventive action requirement retained	Replaced by risk-based thinking in the 2015 version
Documentation	More prescriptive – specific documented procedures and records are required	More flexible – organizations determine what documented information is needed
Risk management	References ISO 14971 for product risk management throughout	General risk-based thinking throughout the system

In practice, the choice is usually straightforward. Organizations that design, manufacture, or service medical devices typically implement ISO 13485 because it aligns with regulatory requirements. Organizations outside the medical device sector will usually implement ISO 9001 instead.

Because the standards use different structures and have different objectives, developing a fully integrated management system that satisfies both can be challenging.

For most medical device manufacturers, ISO 13485 is the primary quality management standard because it aligns directly with regulatory expectations.

Organizations that also need ISO 9001 certification – for example, to meet requirements from non-medical customers – typically maintain them as separate but coordinated systems.

The FDA QMSR: what changed in February 2026

The FDA’s Quality Management System Regulation (QMSR), which came into force on February 2, 2026, represents the biggest change to US medical device quality regulation in almost three decades.

What changed?

For many years, medical device manufacturers selling in the United States were required to comply with the FDA’s Quality System Regulation (QSR) in 21 CFR Part 820.

Although the QSR and ISO 13485 shared many similarities, they were not identical, meaning manufacturers often had to maintain systems that satisfied both sets of requirements.

That changed when the FDA published its final QMSR rule on January 31, 2024. The regulation, which became effective on February 2, 2026, incorporates ISO 13485:2016 (by reference) into 21 CFR Part 820, replacing the previous QSR framework.

What does this mean for manufacturers?

For manufacturers selling medical devices in the United States, ISO 13485:2016 is now the foundation of the FDA’s quality management requirements.

The QMSR doesn’t simply replace FDA oversight with ISO certification, however. Manufacturers must still comply with a small number of FDA-specific requirements that sit alongside ISO 13485, including FDA Medical Device Reporting (MDR) obligations under 21 CFR Part 803 and other applicable FDA regulations.

Why is this important?

For organizations already certified to ISO 13485:2016, the transition to the QMSR should be relatively straightforward.

The core quality management requirements are largely the same, although manufacturers should review the FDA-specific provisions and understand how FDA inspections are conducted under the updated regulation.

Organizations that previously relied on compliance with the old QSR without implementing ISO 13485 face a much larger task.

They will need to align their quality management systems with ISO 13485 while also addressing the FDA-specific requirements retained within the QMSR.

Stability for manufacturers

The FDA has confirmed that ISO 13485:2016 will remain the required version of the standard until at least April 2030, providing manufacturers with a stable planning horizon.

While future revisions to ISO 13485 may eventually be adopted, the FDA has not announced any timetable for doing so.

For more information, see the FDA’s QMSR page and its QMSR frequently asked questions.

Global regulatory recognition

One of ISO 13485’s greatest strengths is its broad international recognition.

Beyond the United States, ISO 13485 is recognized or referenced by regulators in many major markets, including:

European Union – ISO 13485 is listed as a harmonized standard supporting conformity with the EU Medical Device Regulation (MDR 2017/745) and In Vitro Diagnostic Regulation (IVDR 2017/746).
United Kingdom – the MHRA accepts ISO 13485 as the primary standard for demonstrating an effective quality management system under the UK Medical Devices Regulations 2002.
Canada – Health Canada’s Medical Device Regulations reference ISO 13485 as the basis for quality system requirements.
Australia – the Therapeutic Goods Administration (TGA) recognizes ISO 13485 certification.
Japan – the PMDA recognizes ISO 13485 within its quality management system requirements.
MDSAP members – the Medical Device Single Audit Program (MDSAP) uses ISO 13485 as its foundation, allowing a single audit to satisfy regulatory requirements in multiple participating jurisdictions including the US, Canada, Australia, Brazil, and Japan.

For manufacturers selling into multiple markets, ISO 13485 provides a common quality management framework that helps satisfy regulatory expectations across much of the global medical device industry.

Common compliance challenges

ISO 13485 is more prescriptive than ISO 9001, and the stakes of noncompliance are higher – both in terms of patient safety and regulatory consequences. These are the challenges that cause the most difficulty in practice.

Document control

Medical device manufacturers are required to maintain extensive controlled documentation, including Design History Files (DHFs), Device Master Records (DMRs), purchasing records, complaint records, and CAPA records.

Managing these documents accurately throughout the product lifecycle is one of the most resource-intensive aspects of ISO 13485 compliance, and document control deficiencies remain among the most common findings during FDA inspections.

Design controls

ISO 13485 places far greater emphasis on design controls than ISO 9001, requiring documented design inputs, outputs, reviews, verification, validation, and transfer activities.

Smaller manufacturers often underestimate the amount of evidence needed, making design controls a common source of audit findings.

CAPA

CAPA is one of the most closely scrutinized areas of any ISO 13485 quality management system. Organizations don’t struggle with identifying problems so much as with performing robust root cause analysis, implementing effective corrective actions, and demonstrating that those actions prevented recurrence.

Complaint handling and adverse event reporting

Complaint handling extends beyond responding to customer issues. Organizations must investigate all complaints, maintain appropriate records, and determine whether an incident is reportable under applicable regulations.

Under the FDA’s QMSR, US manufacturers must also comply with Medical Device Reporting (MDR) requirements.

Supplier qualification and ongoing monitoring

ISO 13485 requires organizations to qualify, monitor, and periodically re-evaluate suppliers.

For manufacturers with complex supply chains, maintaining current supplier records and responding promptly to declining supplier performance can become a significant ongoing challenge.

Maintaining a living QMS

An ISO 13485 quality management system is never static. Changes to products, processes, equipment, software, suppliers, or personnel may all require formal change control and, in some cases, revalidation.

Organizations that fail to keep their QMS aligned with operational changes often develop compliance gaps over time.

How isoTracker helps with ISO 13485 compliance

ISO 13485 requires organizations to manage a wide range of quality processes, from document control and audits to CAPAs, complaints, training, supplier management, and risk. isoTracker brings these activities together in a single, modular platform, reducing administrative effort while improving traceability and audit readiness.

The platform also supports FDA 21 CFR Part 11 compliance for electronic records and signatures – a critical requirement for regulated manufacturers.

All modules work together on a single integrated platform, or can be used stand-alone. Pricing is subscription-based – you pay only for the modules and users you need.

Module	How it supports ISO 13485
Document Control	Controls documents with versioning, approvals, review reminders, and audit trails.
Audit Management	Plans audits, records findings, and links them directly to CAPAs.
CAPA Management	Tracks corrective and preventive actions from root cause through effectiveness verification.
Nonconformance Management	Records, investigates, and monitors nonconforming products and quality issues.
Complaints Management	Manages complaint investigations and links complaints to CAPAs where appropriate.
Training Management	Tracks competence, automates reminders, and links training to document revisions.
Risk Management	Supports risk management activities alongside ISO 14971.

Organizations can implement individual modules or a fully integrated QMS, expanding the system as their needs evolve. A free 60-day trial provides access to every module, together with complimentary email support.

What our customers say

“We really like how user-friendly the isoTracker interface is, and if any questions arise for how to execute a task, the isoTracker tutorial and help videos are very resourceful. Overall, we are very pleased with the system, and its ability to handle our document control and editing process.”
– Ethan Flint, Healthcare Consultant, USA

“Important to maintain tight control over policies in a dynamic and intense clinical environment… becomes simple when documents are managed by reliable, very easy-to-use and well supported software, such as isoTracker.”
– John Pitchers, Mortuary Manager, Flax Bourton Public Mortuary, Bristol, UK

Useful resources

Authoritative sources:

ISO 13485:2016 standard page – International Organization for Standardization
FDA QMSR page – US Food and Drug Administration
FDA QMSR frequently asked questions – FDA guidance on the February 2026 changes
MDSAP information – FDA overview of the Medical Device Single Audit Program
EU MDR and harmonized standards – European Commission

Related isoTracker pages:

What is ISO 14971? – the product risk management standard that ISO 13485 references throughout
What is ISO 9001? – for organizations considering both quality management standards

Frequently asked questions

Yes. Since February 2, 2026, the FDA’s updated Quality Management System Regulation (QMSR) has incorporated ISO 13485:2016 by reference into 21 CFR Part 820. Medical device manufacturers selling in the US must comply with ISO 13485, together with a small number of additional FDA-specific requirements.

Usually not. For most medical device manufacturers, ISO 13485 is the appropriate standard because it’s specifically designed for the industry and regulatory compliance. Some organizations choose to maintain both certifications, but for many, ISO 13485 alone is sufficient.

The old FDA Quality System Regulation (QSR) was a separate US quality framework. The new QMSR aligns FDA requirements with ISO 13485:2016, while adding certain FDA-specific requirements. As a result, manufacturers no longer have to manage two substantially different quality system frameworks.

The Medical Device Single Audit Program (MDSAP) allows a single audit to satisfy the quality management requirements of multiple participating regulators. ISO 13485 forms the foundation of the MDSAP audit model, making it easier for manufacturers selling into multiple markets.

ISO 13485 requires documented records covering areas such as design, manufacturing, purchasing, training, complaints, CAPA and internal audits.

Records should generally be retained for at least the device’s expected lifetime, and never less than two years from release, unless longer periods apply under local regulations.

Yes. isoTracker supports FDA 21 CFR Part 11 requirements for electronic records and electronic signatures, including electronic signatures, audit trails and access controls.

The easiest way is to make compliance part of everyday operations, rather than something that’s rushed before an audit.

Good practices include:

Keeping documentation up to date as processes change.
Automating repetitive tasks such as document control, CAPA tracking and training records.
Running internal audits throughout the year.
Assigning clear ownership for every QMS process.

The right quality management software can make these activities far easier by reducing manual work, improving visibility and helping teams stay audit-ready.

The timeframe depends on the size and complexity of the organization, but many businesses take between three and twelve months to implement a compliant quality management system and achieve certification. Organisations with an existing ISO 9001-based QMS can often complete the process more quickly.

The Quality Management Standard for Medical Devices

What ISO 13485 actually requires

ISO 13485 vs. ISO 9001: key differences