ISO 13485 Certification for Medical Device Quality Management Systems

ISO 13485 is the international quality management system standard for medical devices, and itmad audits ISO 13485 systems for organisations in the medical device sector. itmad operates across the Middle East, Asia and Europe, using local auditors and a travelling team. Certification follows a two-stage audit and results in a certificate valid for three years, kept current by annual surveillance audits. Last reviewed: October 2026.

ISO 13485 in brief

The standard sets quality management system requirements for organisations that design, produce, install or service medical devices, or that supply parts and services to those that do. It is built around regulatory expectation and patient safety, which makes it more prescriptive than ISO 9001 on documentation, risk and traceability. A certificate is independent confirmation that the system meets those requirements, and it is the baseline credential that the medical device supply chain works to.

Who the standard is for

ISO 13485 applies to any organisation in the medical device lifecycle, including:

• Medical device manufacturers and their contract producers
• Providers of sterilisation, packaging, storage and distribution for devices
• Suppliers of components, materials and services to the device industry

The certificate states precisely which of these roles it covers.

What auditors examine

• Regulatory alignmentA quality system built to meet the regulatory requirements that apply to the device and to the markets in which it is placed.
• Risk managementRisk-based thinking throughout, with risk management built into product realisation.
• Design and development controlsControlled inputs and outputs, review, verification, validation and change control for device design.
• Documentation and recordsThe medical device file and the records the standard requires, kept to the rigour that regulators expect.
• TraceabilityThe ability to trace components, processes and product to the degree that the risk of the device demands.
• Cleanliness and contamination controlControls over the environment, sterilisation and contamination wherever the device requires them.
• Supplier controlSelection, evaluation and monitoring of suppliers in proportion to their effect on the device.
• Feedback and complaint handlingSystems for post-market feedback, complaint handling and, where required, regulatory reporting.

How ISO 13485 relates to ISO 9001 and ISO 14971

ISO 13485 is based on ISO 9001 but departs from it on purpose, keeping the earlier emphasis on documented procedures and regulatory compliance instead of adopting every later change in ISO 9001. Organisations that hold both run them as related but separate systems. Where ISO 14971 is also applied to medical device risk management, the two standards reinforce each other directly.

How an itmad audit runs

Because ISO 13485 faces regulators, the value of certification lies in a rigorous, evidence-based assessment. Stage 1 reviews the quality system documentation, the medical device file and the scope of devices and activities covered, establishing readiness and raising gaps early enough to close them. Stage 2 tests implementation: whether design controls, risk management, traceability and contamination controls operate as documented, and whether the records support what the procedures claim.

The certificate cycle

An ISO 13485 certificate from itmad is valid for three years, with surveillance audits in each of the two intervening years and full recertification before it expires. The certificate states its scope, including the devices and activities covered.

Independence

Independence is what gives the certificate its value to the customer who asked for it. ISO/IEC 17021-1 bars itmad from designing, implementing or consulting on the system being certified, so the role of itmad is limited to the audit, the certification decision and, on request, a pre-assessment that identifies gaps against ISO 13485 without prescribing the fix.

What itmad delivers

• A Stage 1 report on readiness gaps, issued before the main audit
• A Stage 2 audit report whose findings rest on objective evidence
• Nonconformities graded by severity, each with a defined response time
• A certificate of registration naming the certified scope and locations
• The certification mark, for use under itmad's mark and seal policy
• Annual surveillance audits and reports across the three-year cycle

Frequently asked questions

What is ISO 13485?

ISO 13485 specifies quality management system requirements for organisations that design, produce, install or service medical devices, or supply parts and services to those that do. It is built around regulatory expectation and patient safety.

Who needs ISO 13485?

Any organisation in the medical device lifecycle: manufacturers and their contract producers, providers of sterilisation, packaging, storage and distribution, and suppliers of components, materials and services. The certificate states precisely which of those roles it covers.

How does ISO 13485 differ from ISO 9001?

ISO 13485 is based on ISO 9001 but departs from it deliberately, keeping the earlier emphasis on documented procedures and regulatory compliance. It is more prescriptive than ISO 9001 on documentation, risk and traceability.

What does ISO 13485 require?

It requires regulatory alignment, risk management, design and development controls, documentation and records, traceability, contamination control, supplier control, and feedback and complaint handling. Risk management runs through the whole of product realisation.

How does an ISO 13485 audit work?

itmad audits in two stages. Stage 1 reviews the quality system documentation, the medical device file and the scope. Stage 2 tests whether design controls, risk management, traceability and contamination controls operate as documented.

How long does an ISO 13485 certificate last?

An ISO 13485 certificate from itmad is valid for three years, with surveillance audits in each of the two intervening years. Recertification is completed before the certificate expires.