The ISO 13485 certification process, step by step: from device files to certificate

Who decides what in ISO 13485 certification

Four kinds of party take part, and confusing them is the most expensive misunderstanding in the device sector. Your organisation owns the quality management system and the devices. A consultancy such as Sterling helps you design, build and prove that system; it cannot audit you for certification and it cannot issue anything. An independent certification body, accredited to ISO/IEC 17021-1 and applying the medical device document IAF MD 9, audits the system against ISO 13485:2016 and decides whether to certify. Its accreditation body is recognised through the Global ACI arrangement, which took over the roles of the IAF MLA and the ILAC MRA on 1 January 2026.

The fourth party is the regulator, or the body acting for it. Under the EU MDR a notified body assesses most device classes before CE marking. The Medical Device Single Audit Program lets one audit by a recognised Auditing Organization serve the regulators of Australia, Brazil, Canada, Japan and the United States, and Health Canada requires it for Class II, III and IV devices. The FDA inspects under its own authority, and in the Philippines the device dossier for Classes B to D includes evidence of ISO 13485 compliance. Each of these decisions is taken separately; none of them is the certificate, and the certificate is none of them. What joins them is the evidence: one well-run system satisfies every reviewer, while a system built only for the certificate fails the first regulator who opens a complaint file.

Steps 1 to 5: preparing the system and its evidence

Step 1: fix the scope and the regulatory map

List the device types and families, their classes in each market, the life-cycle stages you perform (design, manufacture, sterilisation, storage, distribution, installation, servicing), the sites involved and the processes you outsource. Then list the regulations that apply to each market. The scope wording ends up on the certificate, and the regulatory map decides which reporting, labelling and identification duties the system has to carry.

Step 2: gap analysis

Sterling's gap analysis tests your existing records against clauses 4 to 8 of the standard and against the regulations on the map. It looks at the design history, the risk management file, supplier controls, validation reports, batch and distribution records and the complaint log, and it separates what already works from what is missing or exists only on paper. The result is a prioritised action list with owners and dates. It is not the certification body's Stage 1, which comes much later.

Step 3: build the system with your engineers

This is the longest step. It produces a medical device file for each device type or family (clause 4.2.3), design and development files with their reviews, verification, validation, transfer and change records (7.3), a documented risk management process that follows ISO 14971 (7.1), risk-based purchasing controls, validation of processes whose output cannot be fully verified (7.5.6) and, for sterile product, validation of sterilisation and sterile barrier systems (7.5.7). Where the design is already frozen, the files have to be rebuilt from real test reports and minutes, which takes the time it takes.

Step 4: run the system long enough to generate records

The certification body wants to see the system working, not just written. That means batch and traceability records, supplier evaluations, calibration records, feedback analysed, complaints investigated with a documented decision on whether each one is reportable (8.2.2 and 8.2.3), nonconforming product handled and corrective and preventive actions (8.5.2 and 8.5.3) opened and checked for effectiveness.

Step 5: internal audit and management review

Complete an internal audit of every requirement in scope (8.2.4) and a management review (5.6) whose inputs include complaints, regulatory reporting, audit results and new or changed regulatory requirements. Close the internal findings with evidence before Stage 1. The detail of planning and conducting that audit is covered in our ISO 13485 internal audit guide (ISO 13485 internal audit: planning, conduct and reporting).

Step 6: apply to an accredited certification body

Check that the body's accreditation covers ISO 13485 and the technical areas of your devices, and check it in the accreditation body's own directory rather than on the certification body's website. Ask how it applies IAF MD 9: the competence of the auditors it will send, how it has calculated audit time for your scope, and how it handles each site. Under IAF MD 9, sites that design, develop or manufacture devices are not sampled, so each one appears in the audit plan. The same document covers agreements for audit reports to be released to regulators, which matters if you sell into markets that ask for them.

If you also need MDSAP or a notified-body assessment, raise it now: those are separate programmes with separate fees, and the order in which you schedule them affects your calendar. Apply while implementation is still running, because the application review is what sets your audit dates. How to compare bodies in detail is covered in the Sterling guide to choosing a credible ISO 13485 provider.

Steps 7 to 9: the Stage 1 and Stage 2 audits

Step 7: Stage 1, the readiness review

The Stage 1 auditor reviews the documented system and the site, confirms the scope, the devices and the sites, and checks that the internal audit and management review have been carried out. Expect questions on the medical device files, the design and risk files, the outsourced processes and the procedures for complaint handling, regulatory reporting and advisory notices. The report lists areas of concern that could turn into nonconformities and sets the plan for Stage 2.

Step 8: close the Stage 1 concerns

Treat every Stage 1 concern as a nonconformity waiting to happen. Close it with evidence, and keep the interval before Stage 2 short enough that the system does not drift but long enough to act.

Step 9: Stage 2, implementation and effectiveness

Stage 2 tests whether the system works across the whole scope. Auditors trace a device from design input to released batch, pick a complaint and follow it through investigation, the reportability decision and the corrective action, read a validation report and ask the operator how the validated parameters are controlled, and check that a design change went back through risk management. Findings are classed as major or minor nonconformities, with opportunities for improvement noted separately, and the closing meeting ends with the audit team's recommendation, which is not yet the decision.

Steps 10 to 12: the decision, the certificate and the cycle

For each nonconformity you send a correction, a root-cause analysis and a corrective action within the timeframe agreed at the closing meeting. Major nonconformities must be verified as closed before the certificate can be granted; if that verification is not completed within six months of the last day of Stage 2, the certification body repeats Stage 2. For minor ones the body normally accepts the plan and checks it at the next visit. The decision is then taken by the certification body on the audit report and the evidence of closure.

The certificate runs for three years from that decision. Surveillance audits take place at least once a calendar year, the first within twelve months, and a recertification audit before expiry starts the next cycle. Changes to devices, sites, outsourced processes or ownership must be reported to the certification body between visits. The regulators keep their own clocks: the FDA's QMSR, which incorporates ISO 13485:2016 by reference, has applied since 2 February 2026, and the ISO 13485 and FDA QMSR guide explains why certification alone does not satisfy it.

How long the ISO 13485 certification process takes

Plan for six to twelve months from gap analysis to the certificate. A distributor, importer or contract manufacturer with no design responsibility and a working ISO 9001 system can often be ready in four to six. A company that designs devices, validates special processes or sterilises product usually needs nine to twelve, and sometimes more. The long poles are always the same: design and risk files rebuilt from engineering records, validation and sterilisation runs that follow their own schedule, and enough months of operation to show complaints, CAPA and traceability records. Certification-body availability then adds its own lead time, and a major nonconformity adds the time to close it. A ten-day certificate is not an ISO 13485 certificate.

Where ISO 13485 certification projects lose time

• Writing the design history after the event. Design files assembled from memory contradict the test reports and e-mails the auditor asks for. Start from the engineering evidence that exists and record the gaps accurately.
• A risk file that stopped at design freeze. Auditors look for complaints, nonconformities and design changes feeding back into risk management; a spreadsheet dated before launch shows they do not.
• Outsourced critical steps with no control. Sterilisation, component moulding or software development done by a supplier is still your process. Quality agreements, evaluations and validation evidence must be in your files.
• Complaints and reporting in separate hands. When service, sales and regulatory affairs each keep their own log, the reportability decision goes missing. One route, one record.
• Treating ISO 13485 as ISO 9001 with extras. The standard keeps an older clause structure and adds device files, validation, sterile particulars and regulatory reporting. An ISO 9001 certificate helps, but it is not a head start of months.

ISO 13485 certification process: questions buyers ask