Implementation walkthrough
How to implement ISO 13485: video walkthrough
A walkthrough of an ISO 13485 implementation: a medical device quality management system built for regulatory purposes, and prepared for an independent certification audit.
Key takeaways
- ISO 13485 is a quality management standard written for regulatory purposes.
- Start from the devices, classes, life-cycle stages and markets the system must cover.
- Device files, design controls, risk management and traceability are central evidence.
- The system must run long enough to generate records before the audit.
- Certification and device market approval are separate decisions by different bodies.
A quality system built for regulators as well as customers
ISO 13485 is the international standard for a medical device quality management system, and its title says what sets it apart: requirements for regulatory purposes. Where a general quality standard examines whether you satisfy customers, ISO 13485 examines whether every device you design, make, sterilise, distribute or service is safe, performs as intended and can be traced, reported and recalled as regulation demands.
It is the common language between a manufacturer and everyone who decides whether its devices reach patients: certification bodies, notified bodies, MDSAP auditing organisations and regulators. A system built to it gives all of them the same evidence: device files, risk files, design records, validated processes, batch records, complaints with reportability decisions and corrective and preventive actions closed with proof. This short film walks through how that system is built.
The ISO 13485 implementation route
Define the scope and the regulatory picture: the device types, classes, life-cycle stages, sites and markets in scope, and the regulations the system must satisfy alongside the standard. A gap analysis then tests what exists, from device files and design history to risk management, supplier controls, validation and complaint records, against the standard and your markets' regulators.
Implementation builds the device files, design controls, risk management, traceability and complaint handling with your engineers, and the system then runs long enough to generate evidence. Internal audit and management review follow before an independent certification body, accredited to ISO/IEC 17021-1 and meeting IAF MD 9, assesses the system. Certification is decided by that body; market access for the devices is a separate decision by the regulator or notified body.
Sterling's expert and experienced consultants support the work under Sterling OS™, with the quality management system held in Effivity. ISO 13485:2016 remains the current edition, confirmed by ISO in October 2025.
Because the standard is written for regulatory purposes, the system is designed from the start to satisfy the regulations of the markets you sell into, not only the certification audit.
ISO 13485 at a glance
- Purpose
- A device quality management system for regulatory purposes: design controls, risk management, traceability, complaint handling and regulatory reporting
- Relevant to
- Manufacturers, designers, contract manufacturers, sterilisers, software developers, importers, distributors and servicers
- Edition
- ISO 13485:2016, confirmed by ISO in October 2025; no amendment and no transition running
- Certification
- Assessed and decided by an independent, accredited certification body; device approval is a separate decision by the regulator or notified body
- Sterling's role
- Consulting with your team, Effivity, training, internal audit, certification readiness and then Sustain™
- Cost and timing
- Total investment for an ISO 13485 medical device QMS depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 6 to 12 months
ISO 13485: questions people ask
Is ISO 13485 certification mandatory for medical device companies?
The standard is voluntary; the regulations that reference it are not. In the EU, the MDSAP countries, the Philippines, Saudi Arabia, Australia and India, and in the United States through the QMSR, regulators expect a device quality management system measured against ISO 13485. Whether a certificate is demanded outright depends on the market and device class; most manufacturers are asked for one.
Does an ISO 13485 certificate give us CE marking or FDA clearance?
No. The certificate confirms that an accredited certification body found your system conforming to the standard. CE marking is a conformity assessment under the MDR or IVDR, with a notified body involved above basic Class I; the FDA inspects manufacturers itself; national registrations are decided by the national regulator. The certified system supports those decisions; it does not make them.
What is the difference between a certification body, a notified body and an MDSAP auditing organisation?
A certification body is accredited to ISO/IEC 17021-1 with IAF MD 9 and certifies your system against ISO 13485. A notified body is designated by an EU member state to assess devices and quality systems against the MDR or IVDR and issues the certificates behind the CE mark. An MDSAP auditing organisation is authorised by the regulators of Australia, Brazil, Canada, Japan and the United States to conduct one audit, on ISO 13485 plus each country's requirements, that all five accept.
We are certified to ISO 9001. How much more is ISO 13485?
Enough to be a project, not an addendum. ISO 13485 keeps the structure of ISO 9001:2008 and adds what a general system lacks: a medical device file, risk management through product realisation, design files, contamination control, sterile particulars, validation, traceability, complaint handling, regulatory reporting, advisory notices and preventive action. Your document control, audit and review discipline transfers; the device content has to be built.
Do distributors, contract manufacturers and software developers need ISO 13485?
The standard applies to any organisation at one or more stages of a device's life cycle, and to their suppliers. A distributor's certificate covers storage, distribution, traceability and complaints; a contract manufacturer's covers production, validation and, where relevant, sterilisation; a software developer's covers design and development, usually alongside IEC 62304. The scope matches what you do.
Keep exploring
Related to this video
Read next
The complete guide
Everything on ISO 13485
Start with the ISO 13485 page, or go straight to the guide you need.
On the ISO 13485 page
Guides
- ISO 13485 case study
- The ISO 13485 certification process, step by step
- ISO 13485 certification cost
- ISO 13485 medical device file and design file
- Effivity ISO 13485 guide
- ISO 13485 internal audit
- ISO 13485 and FDA QMSR
- ISO 13485 vs ISO 9001
- MDSAP audit readiness
- ISO 13485 requirements explained
- ISO 13485 training
More videos: Healthcare, medical devices and life sciences
- How to implement ISO 22716Implementation walkthrough · 3 min 24 s
- ISO 22716 requirements explainedTwo-minute brief · 2 min
- ISO 7101 requirements explainedTwo-minute brief · 2 min
- How to comply with ADHICS in Abu DhabiCompliance walkthrough · 3 min 15 s
- ADHICS requirements explainedTwo-minute brief · 2 min
- How to comply with the EU IVDR (Regulation 2017/746)Compliance walkthrough · 3 min 15 s
- EU IVDR requirements explainedTwo-minute brief · 2 min
- How to comply with the EU MDR (Regulation 2017/745)Compliance walkthrough · 3 min 15 s
- EU MDR requirements explainedTwo-minute brief · 2 min
Talk to a consultant
Plan your ISO 13485 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice