ISO 13485 is a stand-alone quality standard for medical device organizations, not an add-on to ISO 9001. Both share roots and many clause titles, but they aim at different things. ISO 9001 aims at customer satisfaction and continual improvement. ISO 13485 aims at safe, effective devices and at meeting regulatory requirements, so it asks for more documentation, risk management across product realization, process and software validation, complaint handling and reporting to regulators. A medical device maker usually needs ISO 13485; ISO 9001 alone will not satisfy device regulators.
| ISO 9001:2015 | ISO 13485:2016 | |
|---|---|---|
| Purpose | Consistent products and customer satisfaction | Safe, effective medical devices and regulatory compliance |
| Who uses it | Any organization | Organizations in the medical device life cycle and their suppliers |
| Structure | The common ten-clause structure shared by ISO management system standards | Its own eight-clause layout, closer to ISO 9001:2008 |
| Improvement goal | Continual improvement | Maintain the effectiveness of the system |
| Documentation | As much as the organization judges necessary | Specific documented procedures plus a medical device file for each device type |
| Risk | Risk-based thinking across the QMS | Risk management in product realization, normally to ISO 14971 |
| Validation | Validate processes whose output cannot be verified | Also validate software used in the QMS, production, sterilization and sterile barrier systems |
| Feedback | Monitor customer satisfaction | Feedback, complaint handling and reporting to regulatory authorities |
| Preventive action | Replaced by risk-based thinking | Kept as its own requirement |
ISO 13485:2016 was built on the older ISO 9001:2008 layout, and ISO 9001 moved to the shared ten-clause structure in 2015. So the two no longer line up clause for clause. Management review, purchasing, control of nonconforming product and corrective action exist in both, but with different numbers and more required detail in ISO 13485.
The deeper difference is intent. ISO 9001 lets you decide how much documentation your system needs. ISO 13485 assumes a regulator will read your records, so it spells out documented procedures, records and retention, and it ties almost every requirement to “applicable regulatory requirements”.
These requirements create most of the extra work when an ISO 9001 shop starts making devices or device components:
In the United States, the FDA’s Quality Management System Regulation (QMSR) took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference, with some added FDA requirements. That makes the gap between an ISO 13485 system and FDA expectations much smaller than it used to be. The FDA QMSR transition guide, the pillar for this cluster, covers what changed, and the 21 CFR 820 SOP template gives a starting procedure.
Elsewhere, ISO 13485 certification supports CE marking under the EU Medical Device Regulation and the Medical Device Single Audit Program (MDSAP) used by several regulators. It does not replace either; it is the QMS evidence they build on.
Contract manufacturers that serve medical and non-medical customers often hold both certificates. One integrated system works if you write procedures to the stricter standard and note where ISO 9001-only work is exempt. The usual pressure points are corrective and preventive action, which ISO 13485 still treats separately (see corrective vs preventive action), and the CAPA form your records use.
An ISO 9001 shop starting medical device work usually begins by deciding its role. A contract manufacturer that builds to the customer’s design may be able to exclude design and development, as ISO 13485 permits when regulations allow, while a company that owns the design cannot. That choice sets the scope of everything else.
Next, list the regulatory requirements that apply in each market you ship to, because ISO 13485 points back to them repeatedly. Then work through the gaps in risk order: risk management procedures and files, process and software validation, complaint handling and regulatory reporting, traceability, and the documented procedures the standard names. Re-map your procedures to the ISO 13485 clause numbers rather than keeping the ISO 9001 map. Finally, run a full internal audit and management review on the new system before the certification audit, so the records exist when the auditor asks. Keep corrective and preventive actions as separate paths in the CAPA procedure from day one; how to write a CAPA that closes covers the record itself.
Example: Record retention for a fictional component maker moving into medical devices
Result: Example result: retention for device records rises from 3 to 7 years, and the archive more than doubles. The company updates its records retention schedule and checks whether its customer or regulator requires longer. All values are example values.
It is more prescriptive. It names documented procedures, records and validations that ISO 9001 leaves to your judgment, and it expects evidence a regulator can audit.
Yes. ISO 13485 is stand-alone. Many device companies hold only ISO 13485.
Not in the ISO 9001 sense. It asks you to maintain the effectiveness of the system and to make changes needed for that, with improvement driven by feedback, data analysis and CAPA.
It depends on the customer and the risk of the part. Many device makers accept ISO 9001 plus supplier controls for low-risk parts and ask for ISO 13485 when the component affects safety or performance.
Check the ISO website for the status of any revision. Until a new edition is published, ISO 13485:2016 is the version certification bodies audit against and the version the FDA QMSR incorporates.
COPLAIN AI PLATFORM
Coplain turns your device procedures into controlled, numbered work instructions with revision history, so production matches the device master record.
Generate yours automatically with Coplain →