ISO 13485 for US Medtech Companies: What FDA and Device Buyers Expect

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• A fixed quote

  A fixed quote follows a free gap assessment, so you know the full cost before you commit.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

The outcome. One quality management system, built to ISO 13485, that answers FDA, your OEM customers and regulators abroad from the same records, plus a certificate issued by an accredited certification body. We do the consulting and the heavy lifting; the certification body audits and decides.

Since February 2, 2026, FDA's device quality rule at 21 CFR Part 820 has been the Quality Management System Regulation (QMSR), and it incorporates ISO 13485:2016 by reference^[1][3]. For a US device company, the standard now sits inside the US rule itself.

Three US situations bring the request to your desk:

• FDA's QMSR. A manufacturer covered by Part 820 must document a quality management system that complies with the applicable requirements of ISO 13485, plus FDA's own additions^[3].
• OEM supplier approval. In Sterling's experience, US device makers require contract manufacturers and component suppliers to hold an ISO 13485 certificate before they reach the approved supplier list.
• Sales outside the US. In Sterling's experience, a certified ISO 13485 system is the starting point regulators and distributors abroad look for when a US device is registered in their market.

The outcome. You know where ISO 13485 ends and FDA's own requirements begin, so nothing falls through the gap at inspection.

• Who is covered. Anyone designing, manufacturing, packaging, labeling, storing, installing or servicing finished devices intended for human use, including contract sterilizers, relabelers, remanufacturers and specification developers^[3].
• What FDA adds. Unique device identification, set contents for complaint and servicing records, reporting under Part 803, and labeling and packaging inspection^[3].
• Where FDA prevails. Where an ISO 13485 clause conflicts with the Federal Food, Drug, and Cosmetic Act or FDA's regulations, the Act and the regulations control^[3].
• Design controls. Class II and Class III devices, and certain Class I devices, including those automated with computer software, must meet the standard's design and development requirements^[3].
• Records now open to FDA. FDA states that the QMSR gives it authority to inspect management review, quality audit and supplier audit reports^[2].

A certificate does not replace any of this. FDA states that it will not require or issue certificates of conformance to ISO 13485, and that a certificate will not exempt a manufacturer from an FDA inspection^[2].

The outcome. A certificate that gets you onto US OEM approved-supplier lists faster and keeps you there through customer audits.

Part 820 does not apply to manufacturers of components or parts of finished devices, though FDA encourages them to consider its provisions as appropriate^[3]. Contract firms that sterilize, relabel or develop specifications fall within FDA's definition of manufacturer^[3]. For most suppliers, the push therefore comes from customers rather than from FDA.

• Shorter qualification. In Sterling's experience, a current certificate shortens OEM supplier qualification and cuts repeat on-site audits.
• Quality agreements you can meet. Change notification, traceability and nonconforming-product terms flowed down by OEMs map straight onto an ISO 13485 system.
• A scope that names your work. Machining, molding, assembly, sterilization, packaging or software: the certificate should describe what your customers actually buy.

The outcome. One quality system that supports registrations abroad, instead of a fresh effort per country.

FDA participates in the Medical Device Single Audit Program (MDSAP) with Australia's Therapeutic Goods Administration, Brazil's ANVISA, Health Canada and Japan's MHLW and PMDA; the European Union and the UK's MHRA are official observers^[4]. MDSAP lets a recognized auditing organization run a single regulatory audit that satisfies the relevant requirements of the participating authorities, and FDA states it may accept MDSAP audit reports as a substitute for routine inspections^[4].

In Sterling's experience, US companies heading for the EU, Canada or Asia-Pacific find that ISO 13485 is the common base each of those routes builds on. We confirm every target market's current rules during the gap assessment.

The outcome. Evidence ready in the five areas that carry the most weight, built around how your engineers and production staff already work.

1. Risk management. Applied across the product lifecycle, from design inputs to field feedback. 2. Design and development. Plans, inputs, outputs, verification, validation and a design history you can show. 3. Suppliers and purchasing. Supplier evaluation, quality agreements and control of what others make or test for you. 4. Production and traceability. Process validation, labeling, identification and, where needed, sterilization records. 5. Feedback and CAPA. Complaints, corrective and preventive action, internal audit and management review.

The outcome. A successful certification audit on schedule, with the work done for you. Sterling's record is 100% success and on-time completion across 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience. Sterling does not certify, and the people who consult never audit you.

1. Free gap assessment. We compare your current system with ISO 13485 and FDA's Part 820 additions, then propose a scope. 2. Build. We prepare the quality manual, procedures, risk management framework and forms, sized for your company. 3. Records. Your team runs the system and generates real evidence; Effivity, our GRC automation platform, holds it in one place. 4. Internal audit and management review. We test the system first and close the findings. 5. Certification audit. We coordinate with the accredited certification body you select and support you to the decision.

A fixed quote follows a free gap assessment. Ready to move? Get started, and a Sterling consultant will reply.

ISO management system standards such as ISO/IEC 27001, ISO/IEC 42001 and ISO 9001 are certified by an accredited certification body, not by a consultant^[1]. Sterling never certifies. The certificate carries the name of the body that issued it, and that independence is what makes it credible to your buyers.

What Sterling does is prepare your company so that the certification body's audit goes smoothly. We coordinate:

• a gap assessment against the standard;
• the management system itself: scope, risk assessment, policies, procedures and records, sized for your company;
• training for your people and an internal audit before the certification audit;
• management review and corrective actions;
• the certification audit process, from choosing an accredited body to closing any findings.

Consulting and auditing are always separated. The people who consult never audit you, so the internal audit is a genuine test and the certification body's audit is independent.

Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years, and our experts bring 30+ years of experience.

^[1] About the IAF MLA (multilateral recognition arrangement). International Accreditation Forum (functions transferred to Global Accreditation Cooperation Inc., 1 Jan 2026). accessed October 23, 2026.

• ISO 13485: standard overviewStandard overview
• Meet US Contract, MSA and RFP Compliance Clauses FastUnited States
• Win Buyers Abroad: Compliance for US Companies ExpandingUnited States
• ISO 13485 and FDA's QMSR: What US Device Makers Need to KnowUnited States
• ISO 13485 Cost and Timeline for US Medtech Start-upsUnited States
• Sterling in the United StatesUnited States

1. Quality Management System Regulation (QMSR). U.S. Food and Drug Administration. accessed October 26, 2026.

2. Quality Management System Regulation: Frequently Asked Questions. U.S. Food and Drug Administration. accessed October 26, 2026.

3. 21 CFR Part 820, Quality Management System Regulation (sections 820.1, 820.3, 820.7, 820.10, 820.35, 820.45). eCFR (Office of the Federal Register). accessed October 26, 2026.

4. Medical Device Single Audit Program (MDSAP). U.S. Food and Drug Administration. accessed October 26, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.