What ISO 13485 is
ISO 13485 is the international standard for quality management systems in the medical device industry. It sets requirements for organizations that design, produce, install or service medical devices, and for suppliers that support them, such as contract manufacturers, sterilizers and component makers. Where ISO 9001 aims at customer satisfaction and continual improvement, ISO 13485 focuses on consistently meeting regulatory requirements and keeping devices safe and effective.
The current edition is ISO 13485:2016. Search interest in it is high and stable in the US, and 2026 has given US manufacturers a new reason to care: the standard is now part of federal law.
ISO 13485 in 2026: what is new
The 2016 edition remains current. ISO’s catalogue states: “This publication was last reviewed and confirmed in 2025. Therefore this version remains current,” with the standard confirmed on October 31, 2025 (ISO). As of September 2026, certification body Nemko reported that no public information shows a new revision project for ISO 13485 itself; a guidance document, ISO/TS 23485, is in development and does not change the standard’s requirements (Nemko).
FDA now enforces it through the QMSR. FDA’s Quality Management System Regulation took effect on February 2, 2026. FDA states that “The QMSR incorporates by reference the international standard, ISO 13485:2016,” and that this “harmonizes the FDA’s CGMP regulatory framework with that used by other regulatory authorities” (FDA). The regulation requires manufacturers to “Document a quality management system that complies with the applicable requirements of ISO 13485” (eCFR, 21 CFR 820.10).
FDA is already citing ISO 13485 clauses. Law firm Hyman, Phelps & McNamara reported that the first QMSR-era warning letters, issued in May and July 2026, cited ISO 13485 clause 7.1 on risk management and clause 7.3.9 on design changes (FDA Law Blog).
Certification is widespread. A summary of the ISO Survey 2024 lists 31,215 ISO 13485:2016 certificates covering 43,957 sites (GlobalSTD summary of ISO Survey 2024).
How ISO 13485 is structured
Like ISO 9001:2008, ISO 13485:2016 uses a clause structure with requirements in clauses 4 to 8.
| Clause | Topic | Key requirements |
|---|---|---|
| 4 | Quality management system | QMS documentation, quality manual, medical device file, control of documents and records, software validation for QMS use, outsourced processes |
| 5 | Management responsibility | Quality policy and objectives, responsibilities, management representative, management review |
| 6 | Resource management | Competence and training, infrastructure, work environment and contamination control |
| 7 | Product realization | Planning, risk management, customer requirements, design and development, purchasing, production and service, validation of processes, identification and traceability, monitoring and measuring equipment |
| 8 | Measurement, analysis and improvement | Feedback, complaint handling, regulatory reporting, internal audit, monitoring, nonconforming product, data analysis, corrective and preventive action |
Compared with ISO 9001, ISO 13485 expects more documentation (including a quality manual and a medical device file for each device type or family), applies a risk-based approach throughout the QMS, and connects quality processes to regulatory duties such as complaint reporting and advisory notices.
What ISO 13485 compliance means in different markets
| Market | How ISO 13485 applies |
|---|---|
| United States | Incorporated by reference in 21 CFR 820 (QMSR) since February 2, 2026, with additional FDA requirements on records, labeling and UDI. Certification is not required; FDA inspects |
| European Union | Used as the harmonized standard for QMS requirements under the MDR; notified bodies audit the QMS during conformity assessment |
| Canada, Australia, Brazil, Japan | Accepted through the Medical Device Single Audit Program (MDSAP), which covers ISO 13485 plus each country’s requirements |
| Many other markets | Certification commonly expected by regulators, distributors and customers |
MDSAP members are the regulators of Australia, Brazil, Canada, Japan and the United States (FDA). One MDSAP audit on a three-year cycle can satisfy several of them.
In the US, two points are easy to miss. First, ISO 13485 certification does not replace an FDA inspection: FDA inspects against the QMSR, not against a certificate. Second, records that used to be shielded are now visible. FDA states that “The exceptions that existed in the QS regulation at § 820.180(c) are not maintained in the QMSR” (FDA QMSR FAQ), so investigators can review management review, internal audit and supplier audit records.
Where ISO 13485 compliance breaks down
Certification body Perry Johnson Registrars lists software validation, risk-based supplier control, identification and traceability, preservation of product and document control among the most common ISO 13485 nonconformities (PJR). FDA’s early QMSR experience points the same way. In May 2026, a CDRH official said risk management was “the top observation” in roughly 100 QMSR inspections, followed by purchasing, complaint handling, UDI and corrective action (RAPS).
The common thread is that procedures exist but do not fully address the clause, or records do not show the procedure was followed. A risk management procedure that says risk is managed per ISO 14971 without defining how activities are performed and documented is the kind of gap the first QMSR warning letters described.
How to build and maintain ISO 13485 compliance
- Define scope and applicable requirements. List the device types, sites, outsourced processes and markets, and the regulations that apply in each (QMSR, EU MDR, MDSAP countries).
- Map each clause to your procedures and records. Build a clause-by-clause matrix showing which procedure meets each requirement and which records prove it.
- Embed risk management across the QMS. Apply ISO 14971 to product risk, and a documented risk-based approach to processes such as supplier control and software validation.
- Validate QMS software. Clause 4.1.6 requires validation of software used in the QMS; FDA’s Computer Software Assurance guidance describes a risk-based approach for US manufacturers.
- Control suppliers by risk. Define criteria for evaluation, selection and monitoring proportionate to the effect on the device.
- Close the feedback loop. Connect complaints, nonconformities, audits and trends to CAPA with verified effectiveness.
- Write records for an inspector. Management review and audit reports are now inspectable by FDA, so they should be factual, complete and specific.
- Audit internally and certify. Run internal audits against every clause before stage 1 and stage 2 certification audits, then maintain through annual surveillance.
ISO 13485 compliance checklist
- Scope, device types, sites and outsourced processes defined
- Applicable regulatory requirements identified per market (QMSR, EU MDR, MDSAP)
- Clause-by-clause matrix maps ISO 13485 requirements to procedures and records
- Quality manual and medical device files current
- Risk management procedure defines how activities are performed and documented
- QMS software validated proportionate to risk
- Supplier controls documented and risk-based
- Complaint handling includes regulatory reporting decisions
- Design change records include verification, validation and risk review
- Internal audit and management review records written to be inspection-ready
- CAPA effectiveness verified before closure
- Certification or MDSAP audit schedule maintained
Check your procedures against ISO 13485, clause by clause
Finding whether every procedure addresses every clause is slow, manual work. AI document assessment can do the first pass: it reads procedures and records against ISO 13485:2016, the QMSR or your own checklist, flags missing or vague content such as undefined risk activities, and cites the passage behind every finding so your team can verify and fix it.
Run a sample ISO 13485 document assessment on one procedure. AskDona shows the evidence; your quality team decides.
FAQ
What is ISO 13485? The international QMS standard for medical device organizations, focused on meeting regulatory requirements and device safety and effectiveness.
Is ISO 13485:2016 still current in 2026? Yes. ISO reviewed and confirmed it in 2025 (ISO).
Does FDA require ISO 13485 certification? No. FDA’s QMSR incorporates ISO 13485:2016 by reference, but FDA verifies compliance through its own inspections, not certificates.
What is the difference between ISO 13485 and ISO 9001? ISO 13485 is built for regulated medical device work: it requires more documentation, applies risk management throughout and links quality processes to regulatory reporting.
How long does ISO 13485 certification take? Typically several months to more than a year, depending on QMS maturity. Certification runs on a three-year cycle with annual surveillance audits.
References
All pages opened and checked by October 13, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| ISO: ISO 13485:2016 | Standards body | Confirmed Oct 31, 2025 | Status |
| Nemko: ISO 13485 revision status | Certification body (Japanese) | Sep 10, 2026 | Revision status |
| FDA: QMSR | Regulator | Feb 2, 2026 | Incorporation by reference |
| eCFR: 21 CFR 820 | Regulation | Current | 820.10 |
| FDA: QMSR FAQ | Regulator | Oct 2, 2026 | Records access |
| FDA Law Blog: First QMSR warning letters | Law firm | Aug 12, 2026 | Clauses cited |
| RAPS: Top QMSR observations | Professional body | May 14, 2026 | Observations |
| GlobalSTD: ISO Survey 2024 summary | Third-party summary | Oct 2025 | Certificate counts |
| FDA: MDSAP | Regulator | Dec 19, 2025 | MDSAP members |
| PJR: Common ISO 13485 nonconformities | Certification body | n.d. | Common gaps |