ISO 13485 guide
ISO 13485 vs ISO 9001: what the medical device standard adds, and when you need both
How ISO 13485:2016 relates to ISO 9001:2026, a side-by-side comparison of scope, assessment, cycle and timing, the device controls ISO 13485 adds, where ISO 9001 frames things differently, and whether your business needs one standard or both.
Key points
- ISO 9001 shows that an organisation manages quality for its customers; ISO 13485 shows that a medical device business controls safety, performance and regulatory obligations across the device life cycle.
- ISO 13485:2016 is built on the older ISO 9001:2008 layout (clauses 4 to 8), not the harmonised structure of ISO 9001:2026, so neither certificate stands in for the other.
- What the device standard adds is concrete: a medical device file per family, formal design controls, risk management tied to ISO 14971, validated and sterile processes, traceability, complaint handling, regulatory reporting and preventive action.
- Device makers selling into regulated markets need ISO 13485; ISO 9001 remains useful where customers or tenders name it, or where the business runs activities outside medical devices.
ISO 13485 vs ISO 9001: the short answer
If you design, make, sterilise, store, distribute, install or service medical devices, or supply parts and services to companies that do, ISO 13485 is the standard your regulators, notified bodies and device customers recognise. ISO 9001 is the general quality standard for any sector.
The two are close relatives rather than a basic and an advanced version of the same thing. ISO 13485 started from the ISO 9001 text of 2008 and pointed it at the question every regulator asks: is the device safe, does it perform as intended, and can you prove, trace and report it? Many device companies hold both certificates, and the choice between one and two is a business decision rather than a technical one.
How are the two standards related?
The current device standard is ISO 13485:2016, the third edition. ISO confirmed it at its October 2025 systematic review; no revision is listed. Its introduction states that it is based on ISO 9001:2008, and ISO's own practical guide notes that it did not adopt the Annex SL high level structure that ISO 9001:2015 introduced.
ISO 9001 has since moved again. ISO 9001:2026 was published on 16 September 2026 and keeps the harmonised clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement. ISO 13485 still runs from clause 4, quality management system, to clause 8, measurement, analysis and improvement. The same topic therefore often sits under a different clause number in each standard.
ISO 13485 is explicit on the certificate question: an organisation that conforms to it cannot claim conformity to ISO 9001 unless its system also meets every ISO 9001 requirement. Equally, an ISO 9001 certificate says nothing about design files, sterilisation records or adverse event reporting. What ISO 9001:2026 itself changes is covered in the ISO 9001 hub's transition guide, and the wider sector comparison, including IATF 16949 and AS9100, is in ISO 9001 vs ISO 13485, IATF 16949 and AS9100.
Side-by-side comparison
| Aspect | ISO 9001 | ISO 13485 |
|---|---|---|
| Scope | Any organisation, any product or service | Any stage of the medical device life cycle, and its suppliers and service providers |
| Current edition and structure | ISO 9001:2026, harmonised clauses 4 to 10 | ISO 13485:2016, clauses 4 to 8 on the 2008 layout |
| Meaning of risk | Risks and opportunities affecting the system and its results | Risk to the safety or performance of the device, or to meeting regulatory requirements |
| Who assesses | A certification body accredited to ISO/IEC 17021-1 | The same kind of body, applying the additional medical device accreditation rules on auditor competence and audit time |
| Output | A certificate for the stated scope | A certificate for the stated scope; device approval remains a separate decision by the regulator or notified body |
| Cycle | Three years, with annual surveillance | Three years, with annual surveillance; design and manufacturing sites are not sampled |
| Cost drivers | Maturity, scope, sites and headcount | The same, plus device classes, design responsibility, sterile or implantable product and validation work |
| Typical time to certification | Three to six months | Six to twelve months; four to six for a distributor or contract manufacturer without design work |
The timeframes are Sterling's practical ranges from consulting work, not published figures. The price factors are set out in the ISO 13485 cost guide.
What does ISO 13485 add to ISO 9001?
A team moving from an ISO 9001 system to ISO 13485 usually finds that its document control, internal audit, management review and supplier evaluation carry over with adjustment. The work lies in the areas below, which ISO 9001 does not spell out.
| Area | What ISO 13485 requires | Where it sits |
|---|---|---|
| Documentation | A quality manual and a medical device file for each device type or family; anything required to be documented must also be established, implemented and maintained | 4.2.2, 4.2.3 |
| Management | A management representative, and management review inputs that include complaints, reporting and new regulatory requirements | 5.5.2, 5.6 |
| Work environment | Controls on the work environment and, where relevant, contamination control, including for sterile product | 6.4 |
| Risk and design | A documented risk management process across product realisation, and design controls from planning through verification, validation, transfer, change control and design files | 7.1, 7.3 |
| Production | Process validation, sterile device particulars, validation of sterilisation and sterile barrier systems, identification (UDI where regulation requires it) and traceability, with extra records for implantable devices | 7.5.5 to 7.5.9 |
| Post-market | A feedback process that feeds risk management, documented complaint handling, reporting to regulatory authorities and advisory notices for product after delivery | 8.2.1 to 8.2.3, 8.3.3 |
| Improvement | Corrective action and a separate requirement for preventive action | 8.5.2, 8.5.3 |
Why the design and post-market areas take longest
Design files and risk files are built from real engineering records: review minutes, verification reports, validation results and the risk decisions behind each design choice. They cannot be written after the fact, and validation or sterilisation runs follow the process's own timetable. Post-market controls take time because complaint handling, reportability decisions and advisory notices must be tested, linked to CAPA and seen working. What goes into each file is explained in the medical device file and the design file, and the full set of sub-clauses in ISO 13485 requirements explained.
Where ISO 9001 requires things ISO 13485 frames differently
Holding ISO 13485 does not mean the ISO 9001 box is ticked. The harmonised structure of ISO 9001 gives separate clauses to the context of the organisation, interested parties and the planning of risks and opportunities, and its performance evaluation clause requires customer satisfaction to be monitored. ISO 13485 organises its requirements around feedback, regulatory obligations and device risk instead. A company seeking both certificates maps where each ISO 9001 requirement is met and adds the records ISO 13485 alone would not produce.
The opposite trap is more common: an ISO 9001 company treats the device standard as a bolt-on, then finds at the gap analysis that its design history lives in e-mail and its risk analysis followed the design freeze. The gap is rarely the manual; it is the engineering evidence.
Which one, or both?
- ISO 13485 alone suits a business whose whole scope is medical devices: a manufacturer registering products with the FDA, a notified body, an MDSAP authority or the Philippine FDA, a contract manufacturer or steriliser working for device firms, or a device software developer. Regulators and device customers look for this certificate, and the FDA's QMSR has incorporated ISO 13485:2016 by reference since 2 February 2026. The QMSR guide covers what that means for a certified company.
- ISO 9001 alone suits a business with no device products and no device customers, or a general supplier whose customers ask only for ISO 9001 in their supplier requirements.
- Both suit a company with a device line alongside other products, a group whose tenders name ISO 9001 explicitly. One set of processes, one internal audit programme and one management review can serve both, audited together if the certification body is accredited for both scopes.
How Sterling builds ISO 13485 on what you already have
Keep what works in your ISO 9001 system and add the device controls regulators expect
Our gap analysis tests your existing system, device files, design history, risk management and complaint records against ISO 13485 and the regulations of your markets, keeps the practice that already works and turns the rest into a dated plan. Sterling's expert and experienced consultants then build the missing files with your engineers, either guiding your team (Design™) or carrying the work (Drive™), with Effivity and Sterling Academy access included in the engagement. Sterling does not certify; an accredited certification body audits and decides. We ensure successful certification for our clients.
Book a free discovery callISO 13485 vs ISO 9001: questions buyers ask
Is ISO 13485 harder to achieve than ISO 9001?
It usually takes longer and more engineering time, because it asks for design files, risk files, validated processes and tested regulatory procedures that ISO 9001 does not.
Does an ISO 13485 certificate also cover ISO 9001?
No. ISO 13485 states that conformity to it is not a claim of conformity to ISO 9001, so a separate ISO 9001 certificate needs its own assessment. If the system meets both standards, one audit visit can often cover both scopes.
Can one certification body audit both standards at the same visit?
Yes, if it is accredited for ISO 9001 and for medical device quality management systems. Ask how it sets audit time for the combined scope, since device audits follow their own accreditation rules.
Does ISO 9001:2026 change anything for ISO 13485?
Not directly. ISO 13485:2016 was confirmed by ISO in October 2025 and is not being revised to follow ISO 9001:2026; only a company holding both certificates needs to plan the ISO 9001 transition alongside its device system.
Can we keep one set of documents for both standards?
Yes, and it is the better practice. One document set with a cross-reference to each standard's clauses avoids two manuals that drift apart, and keeping it in Effivity means auditors for either standard find the same evidence.
Should a component supplier to device makers choose ISO 9001 or ISO 13485?
Choose the one your device customers specify. ISO 13485 is written to include suppliers to device companies, so some customers name it in their supplier requirements; where they ask only for ISO 9001, that may be enough for now.
More ISO 13485 guides
Every guide in the ISO 13485 series is written for one question and links back to the hub for the whole picture.
- ISO 13485 certification process, step by step
- ISO 13485 certification cost: what moves the price
- The medical device file and the design file: what goes in them
- Effivity for ISO 13485: the guide
- ISO 13485 internal audit: planning, conduct and reporting
- ISO 13485 and the FDA QMSR: what to check
- ISO 13485 vs ISO 9001: what the device standard adds
- MDSAP audit readiness
- ISO 13485 requirements explained, clause by clause
- ISO 13485 training: who needs what
Keep exploring
Explore more about ISO 13485
Watch a video on how to implement ISO 13485 here.
Watch a video on ISO 13485 requirements here.
ISO 13485 resources
Services for ISO 13485
Industries
Talk to a consultant
Find out what your ISO 9001 system needs to meet ISO 13485.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice