ISO 13485 certificate: how long is it valid?
An ISO 13485 certificate is usually valid for three years. During that period, the certification body carries out a surveillance audit each year, and a recertification audit at the end. The certificate is issued by a certification body that is accredited by a national accreditation body such as the RvA (Dutch Accreditation Council) . The whole route is described on the page the audit process, and the duration on the step-by-step plan.
A certificate is not permanent, and it is not valid without limit for every product. Always check the expiry date and the scope. A certificate that does not cover what you supply will not help you with a customer.
How long is an ISO 13485 certificate valid?
In practice, the cycle lasts three years. The certification body follows the rules of ISO/IEC 17021-1, the standard for bodies that certify management systems. In broad terms, the cycle looks like this:
| Year | Audit | Purpose |
|---|---|---|
| Year 0 | Certification audit (stage 1 and stage 2) | The certificate is granted |
| Year 1 | Surveillance audit | Checks that the system keeps working |
| Year 2 | Surveillance audit | Same again, often with different processes |
| Year 3 | Recertification audit | Full reassessment and new validity |
The first surveillance audit usually follows within twelve months of the certification decision. A surveillance audit is shorter than the first audit. A rule of thumb from practice is about a third of the initial time, but this varies by body and by the size of your organisation. Always ask in advance.
An ISO 13485 certificate and an MDR certificate are not the same
A certification body issues an ISO 13485 certificate for your quality system. A notified body issues a CE certificate under the MDR for your product. For that second certificate, under Article 56 of the MDR , validity can be up to five years. That is why you also come across five-year cycles. Do not confuse the two. Read more on MDR and ISO 13485.
What does a valid certificate show?
A usable certificate contains at least the following details:
- The name of the organisation and the addresses of the certified sites.
- The standard and its version, for example ISO 13485:2016.
- The scope, in plain language.
- The date of the certification decision and the expiry date.
- The name and logo of the certification body, with a unique number.
If any of these details is missing, ask for a complete version. A certificate without a scope or expiry date cannot be verified.
What happens when a certificate expires?
An expired certificate means you can no longer demonstrate that your system meets the standard. Your customer or the notified body may then ask for a new assessment, or your vendor status may be on hold until that assessment is complete. Plan recertification well in advance, for example six months ahead (a guideline, not a requirement of the standard). That leaves room for any findings you still need to close.
If a surveillance audit shows major nonconformities, the body can suspend or withdraw the certificate. This does not happen lightly, but it is a real possibility. To resolve nonconformities, read the page on CAPA (corrective and preventive actions), see CAPA under ISO 13485.
How to check that a certificate is genuine
Many suppliers and customers ask for a certificate. Not every document that looks like a certificate is one. Check it in five steps.
Ask for the name of the certification body
A certificate always names the body that issued it. Write that name down and look it up.
Check the accreditation
The certification body must be accredited for ISO 13485. You can look this up with the RvA . A body that is not accredited issues a certificate that many customers will not accept.
Read the expiry date
Check whether the certificate is still valid on the day you verify it. A certificate that expired three months ago is no longer valid, however new the document looks.
Check the scope
The scope describes which products, processes and sites the certificate covers. If your customer buys a device from you and the scope only covers administration, you have a problem.
Ask for confirmation
If in doubt, ask the certification body for a confirmation. This can usually be provided quickly. For a customer you see once a year, this is a sensible standard step.
Example of a scope
A fictional example of a scope as it might appear on a certificate:
Development, production and supply of class IIb implantable cable guides, at the Eindhoven and Venlo sites, in accordance with the requirements of ISO 13485:2016.
That scope says more than the words “ISO 13485”. It shows which products, which class and which sites are covered. A different product at a different site is not automatically covered.
Common mistakes with the certificate
- Treating the certificate for the whole organisation as cover for every product. The scope determines coverage, not the company name.
- Starting recertification only when the certificate is nearly expiring. Findings often need to be resolved before the certificate can be renewed.
- Using a copy of an old certificate. Always check the most recent version with the body.
- Not reporting changes in the company. A new site, a new product group or a merger can change the scope. Report it to the body in good time.
- Thinking the certificate is legally required. ISO 13485 is not a law, but many customers require it. Read who ISO 13485 is relevant for.
What if you want to switch certification bodies mid-cycle?
Switching to another certification body is possible, but it requires consultation. The new body reviews the current certificate and decides whether an additional assessment is needed. Plan this for the next surveillance audit or recertification, not in the middle of a cycle.
For choosing a body and the related costs, see costs and timeline. More short answers are on frequently asked questions.