Frequently asked questions about ISO 13485
Here you will find short, practical answers about ISO 13485. The standard is published by ISO , is available via NEN , and certification runs through accredited bodies (check via the RvA ).
Want to start quickly? Begin with what ISO 13485 is, then who it is relevant for, and then the step-by-step plan.
ISO 13485 FAQs at a glance
| Question | Short answer | More detail |
|---|---|---|
| Is ISO 13485 mandatory? | Not always legally required, but often a commercial requirement | Who is it for? |
| How long does it take? | Usually 6-15 months | Step-by-step plan |
| What does it cost? | Often €30,000 to €300,000+ in year 1 | Costs and timeline |
| How often is it audited? | Stage 1, stage 2, annual surveillance, recertification in year 3 | Audit process |
| What is the link with the MDR? | The MDR is legislation, ISO 13485 secures its implementation | MDR and ISO 13485 |
Is ISO 13485 mandatory?
Not in every case is it legally required. In practice, it is often a firm market requirement from medtech clients, distributors or notified bodies.
How long does ISO 13485 certification take on average?
For most organisations, 6 to 15 months, depending on scope, product complexity, maturity and internal capacity.
What does ISO 13485 cost roughly?
In year 1, often €30,000 to €300,000+, depending on organisation size, number of sites, external support and depth of the audit.
Is ISO 13485 the same as MDR compliance?
No. The MDR is legislation, and ISO 13485 is a standard. ISO 13485 does help you secure MDR requirements structurally within your processes.
Can you do ISO 13485 without a consultant?
Yes, especially with experienced quality and regulatory teams. Many organisations do use targeted external help, however, to speed things up and reduce rework.
What is the difference between ISO 13485 and ISO 9001?
ISO 9001 is generic. ISO 13485 goes into more depth for medical devices, including a stricter focus on traceability and audit evidence.
How often are you audited under ISO 13485?
After initial certification, there is usually annual surveillance, and recertification in year 3. For how long a certificate is valid and how to check it, read the page ISO 13485 certificate.
Which documents do auditors want to see under ISO 13485?
Usually, among others:
- current procedures and record templates;
- training records;
- supplier assessments;
- CAPA files;
- evidence of management review and internal audit.
What are the biggest pitfalls with ISO 13485?
- building evidence too late;
- an unclear scope;
- too little attention to supplier controls;
- CAPA without demonstrable effectiveness checks.