What is ISO 13485?
ISO 13485 is the international standard for quality management systems (QMS) in the medical device supply chain. The standard is published by ISO , available in the Netherlands through NEN (Netherlands Standardisation Institute) , and in Europe it is often applied in the context of the EU MDR .
Unlike a general quality standard such as ISO 9001, ISO 13485 puts extra emphasis on patient safety, traceability, risk control and strict documentation. That is exactly what auditors, notified bodies and enterprise buyers in medtech look at.
The official name is NEN-EN-ISO 13485:2016. In practice, almost everyone simply says “ISO 13485”.
ISO 13485 in brief
| What is it? | QMS standard for medical devices |
| Who is it for? | Manufacturers, medical software (SaMD), critical suppliers and distributors |
| Mandatory? | Not always legally required, but often required by contract or for commercial reasons |
| Certificate validity | 3 years, with annual checks |
| Indicative cost (year 1) | EUR 30,000 to EUR 180,000+ |
| Duration | On average 6 to 15 months |
| Starting point | First establish whether ISO 13485 fits your organisation |
Why companies choose ISO 13485
The main reasons are almost always commercial and operational:
- Faster through vendor due diligence at larger customers.
- A stronger case with notified bodies and partners.
- Less audit stress thanks to fixed processes and evidence.
- Better scalability as you grow into more products and markets.
Who is ISO 13485 most relevant for?
ISO 13485 is mainly relevant for organisations that directly or indirectly affect product safety and conformity:
- Legal manufacturers of medical devices.
- Companies with software as a medical device (SaMD).
- Contract manufacturers and critical suppliers.
- Distributors and importers that must demonstrate quality requirements from contracts.
Not sure whether your profile applies? See the page Who is ISO 13485 relevant for?.
Relationship with the MDR and IVDR
ISO 13485 is not legislation, but it aligns closely with legal obligations such as the EU MDR 2017/745 and the EU IVDR 2017/746 . In practice, you use ISO 13485 as an operational framework to work consistently and demonstrate compliance.
You can read more on MDR and ISO 13485.
The core of ISO 13485
Audits often focus on five pillars:
- Document control: procedures, versions, records and approvals in order.
- Design and development controls: design controls, verification and validation.
- Supplier control: qualification, monitoring and reassessment.
- Traceability and complaints/PMS: being able to trace back quickly and completely.
- CAPA and risk control: solving deviations in a structured way and preventing recurrence.
Common starting questions about ISO 13485
| Question | Short answer | Read more |
|---|---|---|
| Do we need to do this now? | If customers or the notified body ask for it: usually yes | Who is it for? |
| How long does it take? | Often 6 to 15 months | Step-by-step plan |
| What does the first year cost? | Often EUR 30k to 180k+ | Costs and timeline |
| What does the auditor look at? | The system and evidence in practice | Audit process |
| How does this compare with ISO 9001? | ISO 13485 is more sector-specific and stricter | ISO 13485 vs. ISO 9001 |
Next steps
Sources
- ISO 13485:2016 - Medical devices - Quality management systems
- NEN - NEN-EN-ISO 13485
- EU MDR 2017/745
- EU IVDR 2017/746
- Dutch Accreditation Council (RvA)