Standards & frameworks
Healthcare, medical devices & life sciences: standards and frameworks
Healthcare and medical device standards cover four kinds of obligation: a device quality system certified to ISO 13485, market regulations such as EU MDR and the FDA QMSR, good practice inspected by medicines regulators, and accreditation of hospitals and clinical laboratories. Each route has its own decision-maker.
About this family
What these standards cover and how they fit together
This family brings together the standards, regulations and schemes that decide whether a medical device, a medicine, a cosmetic or a clinical service can reach patients and stay in use. Requests reach us from three directions. A regulator or notified body needs evidence before it lets a product onto a market. A hospital group, distributor or brand owner asks a supplier for a certificate before it signs. And a hospital or laboratory wants an external accreditation that patients, partners and regulators recognise. The obligations differ, but the evidence overlaps heavily: controlled documents, traceable records, validated processes, risk decisions that can be defended, and complaints that are investigated and closed with proof.
The standards relate to each other in layers. ISO 13485 is the quality system most device regulators now reference: the FDA’s QMSR incorporates it by reference, and a single MDSAP audit is accepted by the regulators of Australia, Brazil, Canada, Japan and the United States. ISO 14971 supplies the risk management process that system depends on, while IEC 62304, IEC 62366-1, the IEC 60601 series, ISO 10993 and the sterilisation standards supply the product evidence that goes into the technical documentation EU MDR and IVDR require. Medicines follow GMP and GDP, inspected by the competent authority rather than certified; ISO 15378 and ISO 22716 apply good manufacturing practice to primary packaging for medicinal products and to cosmetics. Clinical investigations follow ISO 14155 and ICH GCP, and electronic records follow 21 CFR Part 11 or EU Annex 11. Healthcare providers have their own layer: ISO 7101 for healthcare quality management, and readiness for JCI, NABH or CAP accreditation, where the accrediting organisation assesses and decides. Sterling engages in one of two ways, as alternatives: Design™, where we develop the system and you implement it under our advice and supervision, or Drive™, where we design it and implement it under your approval. Either way, Effivity is included at no additional cost, so documents, risk files, complaints, CAPA and audits sit in one place. Sterling does not certify, accredit or inspect; the certification body, notified body, regulator or accrediting organisation decides.
In this family
28 standards, frameworks and schemes in this family
Device quality and regulation, product evidence, medicines good practice, clinical research and healthcare accreditation. Standards with full guides come first, then shorter pages, each group in order of demand.
- ISO 13485ISO 13485 certification consulting for medical device makers: design controls, risk, traceability and complaints, prepared for an accredited audit.
- EU MDR 2017/745EU MDR compliance consulting for CE marking: QMS, technical documentation, traceability and post-market surveillance prepared for your notified body.
- EU IVDR 2017/746EU IVDR compliance consulting for IVD manufacturers: performance evidence, QMS, traceability and post-market follow-up prepared for your notified body.
- FDA 21 CFR Part 820 (QMSR)FDA QMSR compliance consulting for device makers selling in the US: a quality management system ready for FDA inspection, wherever you manufacture.
- ISO 14971ISO 14971 Risk Management implementation consulting: device hazards identified, risks controlled and files ready for ISO 13485 and notified-body audits.
- GMP (PIC/S, EU, WHO)GMP compliance consulting for medicine manufacturers: quality systems, batch records and controls ready for your national regulator's inspection on any day.
- ISO 22716ISO 22716 Cosmetics GMP certification consulting: cosmetic production, control, storage and shipment under documented control, ready for a certification audit.
- HITRUST CSFHITRUST certification consulting: e1, i1 or r2 controls implemented and evidence ready for the External Assessor's validated assessment and HITRUST's review.
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- HIPAAHIPAA compliance consulting for US covered entities and business associates: a documented programme protecting PHI. HIPAA is a law; no certificate exists.
- IEC 62304IEC 62304 compliance and requirements explained: safety classes, the software life cycle processes, evidence reviewers expect, cost and timeline factors.
- IEC 62366-1IEC 62366-1 compliance and requirements explained: usability engineering for medical devices, the file, why there is no certificate and how Sterling helps.
- IEC 60601 seriesIEC 60601 compliance and requirements explained: prepare the ISO 14971 risk file and documentation for medical electrical equipment testing. All-inclusive support.
- ISO 10993 seriesISO 10993 compliance and requirements explained: the 2025 edition of Part 1, the biological evaluation plan and report, and how Sterling supports your file.
- ISO 14155ISO 14155 compliance and requirements for device sponsors: what the 2026 edition of good clinical practice asks for, how to prove it and how Sterling helps.
- ISO 11135 / 11137 / 17665ISO 11135, 11137 and 17665 validation and requirements: document EO, radiation and steam sterilisation and integrate it into your ISO 13485 QMS. All-inclusive proposal.
- 21 CFR Part 11 / EU Annex 1121 CFR Part 11 and Annex 11 compliance for GxP systems: requirements, validation, audit trails and e-signatures, with evidence ready for FDA and EU inspectors.
- ICH GCP (E6)ICH GCP compliance consulting for sponsors, sites and CROs: E6(R3) requirements mapped to your SOPs, oversight and records, ready for audits and inspections.
- OECD GLPOECD GLP compliance and requirements for test facilities: the Principles in plain language, the national monitoring route, cost factors and an all-inclusive plan.
- ISO 7101ISO 7101 certification and requirements for hospitals and clinics: the 2023 healthcare quality standard, the audit route, cost and timeline factors, explained.
- JCI accreditation readinessJCI accreditation consultants for hospitals: gap assessment, policies, staff training, tracer-style mock surveys and survey support. JCI accredits; we prepare.
- NABH (India)NABH accreditation consultants for hospitals in India: gap assessment, policies and SOPs, training, quality indicators and mock assessments. NABH accredits.
- CAP accreditation readinessCAP accreditation readiness for laboratories: checklist gap analysis, method records, self-inspection and peer inspection support. CAP accredits; we prepare.
- ISO 15378ISO 15378 certification and requirements for pharma packaging makers: the 2017 edition, ISO 9001 with GMP, the audit route, cost and timing factors.
- Regulatory registration (SFDA, MOHAP/EDE, CDSCO, TGA, Health Canada)Medical device registration consultants for SFDA, EDE, CDSCO, TGA and Health Canada: technical files and ISO 13485 evidence, filed by your local representative.
- ISO 27799ISO 27799 implementation and requirements explained: the 2025 health security controls, how they sit in an ISO/IEC 27001 ISMS and how Sterling helps you.
- MDSAPMDSAP audit readiness for device manufacturers: what the Auditing Organization tests, the evidence to prepare, a six-step plan and the 15-day findings response.
- GDP (EU / WHO)GDP compliance consulting for medicine wholesalers, 3PLs and carriers: quality kept from dock to pharmacy, every batch traceable, ready for inspection.
Some of these standards also belong to another family, such as GDP in supply chain and logistics and ISO 22716 in consumer goods, and appear in both. Not sure which apply to you? The Select the Standard™ tool and the readiness check help you choose.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions buyers ask about healthcare and medical device standards
Short answers on where to start, what can be combined and who decides.
Which healthcare or medical device standard should we start with?
Start with the one your first market or customer requires, then build the rest on it. For most device manufacturers that is ISO 13485, because it is the usual basis for the quality system that EU MDR, EU IVDR, the FDA QMSR and MDSAP expect, and ISO 14971 risk management runs inside it. Medicines manufacturers and distributors start with the GMP or GDP requirements of the authority that licenses them. Hospitals and laboratories start with the accreditation their patients, partners or regulators expect. A gap analysis against your target markets settles the order.
Can we combine ISO 13485, EU MDR and MDSAP in one quality system?
Yes. One quality system can carry the ISO 13485 requirements and the regulatory additions of each market you sell into, so the same procedures, records and internal audits serve every audit. The audits themselves stay separate decisions: an ISO 13485 certification audit, a notified body’s MDR or IVDR assessment and an MDSAP audit each have their own scope and outcome, although one organisation may carry out more than one where it holds the relevant designations. Effivity keeps one set of documents and records behind all of them.
What does a certification body, notified body, inspector or accrediting organisation check?
It depends on the route. A certification body audits your ISO 13485 or ISO 22716 system and decides whether to certify it. A notified body assesses the quality system and technical documentation under EU MDR or IVDR, and you affix the CE mark under your own declaration of conformity. An MDSAP auditing organisation audits once for the participating regulators. GMP and GDP are inspected by the competent authority, which issues its own certificate or licence. JCI, NABH and CAP assess hospitals and laboratories and decide on accreditation. ISO 14971 is not certified on its own; its risk files are examined in every one of these audits.
Talk to a consultant
Plan your device, medicines or healthcare compliance with a Sterling consultant
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice