ISO 13485 Certification: Process, Timeline & Costs

ISO 13485 is the international standard for quality management systems (QMS) of medical device manufacturers and their suppliers. Anyone who wants to place medical devices on the market in Europe, the United States or other regulated markets will, in practice, need a QMS that meets ISO 13485. This article explains how certification works, what determines timeline and effort, and where companies most often lose time.

What ISO 13485 covers

The current edition is ISO 13485:2016, "Medical devices – Quality management systems – Requirements for regulatory purposes". In Europe it applies as EN ISO 13485:2016 + A11:2021 and is harmonised under the Medical Device Regulation (MDR). A QMS that complies with the standard therefore benefits from a presumption of conformity with the QMS requirements of the MDR.

Unlike ISO 9001, ISO 13485 does not follow the "High Level Structure". It is organised into five core clauses:

• Clause 4: Quality management system, documentation, quality manual and medical device file
• Clause 5: Management responsibility, quality policy, management review
• Clause 6: Resources, competence, infrastructure and work environment
• Clause 7: Product realisation, from planning and design through purchasing to production
• Clause 8: Measurement, analysis and improvement, including complaints, internal audits and corrective and preventive action (CAPA)

The focus is less on continual improvement and more on effectiveness, traceability and patient safety. A risk-based approach applies to all processes, not only to product development.

Is certification mandatory?

Legally, the MDR requires a QMS (Article 10(9)), but not an ISO 13485 certificate. For devices in class IIa and above, the notified body assesses the QMS as part of the conformity assessment anyway. In practice the certificate is still the norm because

• customers, OEMs and hospitals require it in tenders and supplier evaluations,
• it is the basis for market access in other countries, for example through MDSAP (Medical Device Single Audit Program) for the United States, Canada, Brazil, Japan and Australia,
• the US FDA, through its Quality Management System Regulation (QMSR), has incorporated ISO 13485:2016 by reference into 21 CFR Part 820 since 2 February 2026.

Important: an ISO 13485 certificate does not replace FDA inspections or a notified body assessment. It does, however, create a common foundation that both build on.

The process in seven steps

1. Define the scope

The first question is what exactly will be certified: which products, which sites and which activities (design, manufacturing, distribution, servicing). Clause 7 processes that do not take place in the company, such as design at a contract manufacturer, can be excluded. The exclusion must be justified and documented in the quality manual.

2. Gap analysis

A structured gap analysis compares the current state against every requirement of the standard. The result is a prioritised list of open items. Companies that already work to ISO 9001 usually start from a solid base but need to catch up on risk management, the medical device file, traceability, validation and regulatory reporting.

3. Build the documentation

ISO 13485 requires considerably more documented procedures than ISO 9001. These include, among others:

• Control of documents and records
• Management review
• Risk management in product realisation (in practice according to ISO 14971)
• Design and development, if within scope
• Purchasing and supplier evaluation
• Complaint handling and reporting to regulatory authorities
• Internal audits
• Control of nonconforming product
• Corrective and preventive action

In addition, a medical device file is required for each device type, along with a quality manual. Good documentation describes what actually happens in the company. Processes that exist only on paper are quickly spotted in an audit.

4. Implement and operate

A certification body wants to see not just procedures but evidence that they are applied: training records, supplier evaluations, complaint files, CAPA records, validation reports. Many certification bodies therefore expect the system to have been in operation for some months and to have produced records before the main audit.

5. Internal audit and management review

Before the external audit, at least one full cycle of internal audit (clause 8.2.4) and management review (clause 5.6) must be completed. The internal audit should cover all clauses and all areas within the scope and be carried out by people who do not audit their own work. The management review evaluates the results and defines actions.

6. Certification audit (Stage 1 and Stage 2)

Certification itself takes place in two stages:

Stage	Content	Outcome
Stage 1	Review of documentation and readiness for certification, often partly remote	Report listing points to be resolved before Stage 2
Stage 2	On-site audit of all processes in scope, with sampling of records and interviews	Findings (major and minor nonconformities) and a certification recommendation

Nonconformities must be closed on time with an action plan and evidence. Major nonconformities prevent certification until they are resolved and verified.

7. Certificate and surveillance

The certificate is valid for three years. Surveillance audits take place annually in between, followed by a recertification audit after three years. The QMS therefore has to be maintained continuously, not just until the certificate is issued.

How long does ISO 13485 certification take?

There is no reliable one-size-fits-all answer. The decisive factors are:

• Starting point: Is there an existing QMS (e.g. ISO 9001), or does the company start from scratch?
• Complexity: number of products, risk classes, sterile devices, software, sites
• Design within scope: design control is one of the most demanding processes
• Internal capacity: who works on the QMS alongside day-to-day business?
• Certification body availability: lead times of several months are not unusual

For small and medium-sized companies, the journey from project start to certificate typically takes several months to more than a year. Talking to the certification body early and scheduling audit dates in advance avoids unnecessary waiting.

What does certification cost?

Costs fall into three blocks:

1. External certification fees: these depend mainly on the number of audit days, which are calculated from headcount, sites and complexity using the IAF MD 9 guidance document.
2. Internal effort: staff time for documentation, training, internal audits and audit preparation. This block is the one most often underestimated.
3. External support: consulting, training, QMS software or outsourced internal audits, depending on the experience within the team.

When comparing quotes from certification bodies, look beyond the day rate: auditor availability, industry experience, and whether the same organisation also acts as a notified body under the MDR all matter.

Common pitfalls

• Template documentation with no link to reality: auditors check whether procedures match actual practice.
• Risk management in isolation: risks must be linked to design, production, complaints and post-market surveillance.
• Incomplete supplier control: critical suppliers need evaluation, a quality agreement and ongoing monitoring.
• CAPA without effectiveness checks: an action is only closed once its effectiveness has been verified.
• Forgetting software validation: software used in the QMS (e.g. ERP or eQMS) must also be validated for its intended use.
• Contacting the certification body too late: long lead times delay market entry.

Conclusion

ISO 13485 certification is not just a documentation project. It means building a system that makes product quality and patient safety demonstrable. With a clear scope, an honest gap analysis and a system that is genuinely lived, the certification audit can be planned well. The next step usually follows directly: conformity assessment under the MDR, where the classification of the device and preparing for the notified body audit take centre stage.

We support companies in setting up or optimising a QMS according to ISO 13485, with hands-on industry experience. Learn more about our MedTech consulting.