ISO 13485 certification cost: what moves the price, and what the certificate does not cover

What an ISO 13485 budget is made of

Two device companies of the same size can need very different systems: a distributor with no design work and a steriliser of implantable components share a standard, not a price.

Consulting and implementation. Optional, and priced on what has to be built: medical device files, design and development files, the risk management file, supplier controls, validated processes, complaint handling with reportability decisions, internal audit and management review. The fee depends on how much of that exists already and on who does the writing.

Independent certification. Paid to an accredited certification body for audits, not for a certificate: the Stage 1 readiness review, the Stage 2 audit, surveillance in the following two years and recertification in the third. ISO/IEC 17021-1 keeps these two budgets apart, since a certification body may not provide management system consultancy.

Internal resources. Never invoiced and often the largest line. Engineers rebuild design history, run validation studies and update risk files; quality staff requalify suppliers; operations may need to change a facility or a controlled environment.

What moves the price: the device-specific drivers

Headcount and sites matter here as for any management system, but for a device company they are rarely what separates one quotation from another. The product and the regulatory picture do.

Holding ISO 9001 already changes the starting point rather than the destination; the ISO 13485 vs ISO 9001 guide sets out what the device standard adds.

How the certification body sets ISO 13485 audit time

Every accredited certification body must have documented procedures for working out audit time under ISO/IEC 17021-1, which lists factors such as size, number of sites, complexity, outsourcing and risk. For medical device quality management systems, accreditation bodies apply an additional document, IAF MD 9, which the certification body must follow.

• Audit time. IAF MD 9 has its own annex on audit duration for ISO 13485, separate from the rules used for general quality systems.
• Auditor competence. Auditors must be qualified for the technical areas of your devices, which limits the pool of auditors and can affect travel.
• No sampling of key sites. Sites involved in design, development and manufacturing are not sampled, so a group with three manufacturing plants is audited at all three.
• Reports for regulators. The certification agreement may cover releasing audit reports to regulators, which is part of what gives the certificate standing with them.

The cycle runs for three years from the certification decision. Surveillance happens at least once a calendar year, the first within twelve months of that decision, and recertification comes before the certificate expires. Ask each body for the audit days of every visit in the cycle, with the reasoning, before you compare prices.

The cost that sits inside your organisation

Consultants and certification bodies can quote their own work. Neither can quote your engineering time, and on a device project that is where schedules and budgets usually slip.

• Design and risk files. Design history scattered across e-mail, test folders and engineers' memory has to be gathered into design files, and a risk analysis completed after design freeze has to be reworked into a risk management file that follows the product.
• Validation. Processes whose output cannot be fully verified need validation, and sterilisation and packaging validation run to the laboratory's and the process's timetable.
• Facilities. Clean or sterile product may need changes to the work environment and contamination control before the audit.
• Suppliers. Critical suppliers are evaluated, requalified where needed and brought under written quality agreements.
• Running time. The system has to operate long enough to produce complaint, corrective action, traceability and internal audit records. Plan for six to twelve months overall; the certification process guide sets out the stages.

What the certificate does not include, and the costs quotations leave out

Regulatory routes. An ISO 13485 certificate is not CE marking, an FDA clearance or a Philippine FDA registration. Notified-body conformity assessment under the EU MDR or IVDR, MDSAP audits by an authorised auditing organisation, and registration dossiers carry their own fees and timelines. They rest on the same quality system but sit outside a certification body's ISO 13485 quotation. The FDA QMSR guide covers what the United States adds.

Re-audits. A major nonconformity at Stage 2 must be corrected and verified before a certification decision; if that cannot happen within six months of the last day of Stage 2, the body repeats Stage 2.

Unaccredited certificates. A certificate from a body without medical device accreditation is cheaper because the audit is short or absent. Regulators, notified bodies and hospital procurement teams check accreditation, and the certification then has to be done again. If it takes ten days, it is not ISO 13485 certification.

Surveillance and travel. A quotation that stops at Stage 2, or leaves auditor travel open, shows only part of the three-year cost.

How to compare ISO 13485 quotations

Make the quotations describe the same scope before you look at totals.

Certification bodies

• Accreditation for ISO 13485 specifically, by an accreditation body recognised through the Global ACI arrangement; check the accreditation body's own directory.
• The same devices, life-cycle stages, sites and exclusions in every quotation.
• Audit days for Stage 1, Stage 2, each surveillance audit and recertification, with the justification.
• Auditor competence for your technical areas, travel terms and the charges for follow-up visits.

Consultants

• An all-inclusive proposal for a written scope, or an open rate by the day or by the document?
• Who writes the device and risk files, and who runs validation: your engineers or the consultant?
• Internal audit, management review, training and software: included or extra?
• Certification-body fees kept separate. A single price for consulting and a certificate is a warning sign.

ISO 13485 certification cost: questions companies ask