Difference between MDR and ISO 13485
The difference between MDR and ISO 13485 can be explained in one sentence: the EU MDR is legislation you must comply with, while ISO 13485 is a voluntary standard for your quality management system. The MDR says what you must arrange to place your product on the market. ISO 13485 helps you do that consistently and demonstrably every day. The EU IVDR for in vitro diagnostics works the same way. They fit together, but one does not replace the other.
In short: MDR = the law (mandatory, covers your product). ISO 13485 = the standard (voluntary, covers your processes). In practice, you use the standard to meet the law.
MDR versus ISO 13485 in brief
| Topic | MDR/IVDR | ISO 13485 |
|---|---|---|
| Type of framework | Legislation | Management system standard |
| Mandatory? | Yes, to enter the EU market | No, voluntary (though often requested) |
| Purpose | Market access and legal conformity | Structural quality control |
| Focus | Product and market requirements | Process and system control |
| Assessment | Notified body, market surveillance | Certification audit |
Where is the difference in practice?
The MDR sets requirements that belong to legislation and that ISO 13485 does not fill in itself. Below are the four topics where the difference is most visible. For each topic, read the block below for an explanation.
- UDI: the unique product code that the MDR makes mandatory
- Technical documentation: the mandatory product file for each device
- EUDAMED: the European database where you must register
- Notified body: the body that assesses your MDR conformity
UDI: an MDR obligation, not an ISO requirement
UDI stands for Unique Device Identification: a unique code on your product and packaging. The MDR requires this so that devices can be traced through the whole supply chain. ISO 13485 asks for traceability in general, but it does not prescribe the UDI system. Example: under the MDR, a catheter manufacturer must give every packaging unit a UDI and link it to its product file. You can read how that code is built and which deadlines apply on UDI and EUDAMED registration.
Technical documentation: per product, not per system
The MDR requires a technical file for each device: design, risks, clinical data and performance. This is product-specific. ISO 13485 ensures how you manage documents (versions, approvals), but it does not deliver the file itself. Your QMS is therefore the factory, and the technical documentation is the product that comes out of it. See also technical documentation under the MDR and ISO 13485 for a full overview of what it must contain, and the requirements of the standard.
EUDAMED: registering in the European database
EUDAMED is the European database for medical devices. Here you register your organisation, your products and your certificates. The first four EUDAMED modules become mandatory to use from 28 May 2026, according to the European Commission . ISO 13485 has no EUDAMED obligation; this comes purely from the MDR. Always check the exact deadlines and transition periods with the Commission, as they have been amended several times.
Notified body: who assesses what?
Under the MDR, a notified body assesses whether your product and your system comply with the law, for most risk classes. For ISO 13485, an accredited certification body carries out the audit. Both may visit, but with a different focus: the notified body looks at legal conformity, the certification body at your auditable processes. For what to consider when choosing, see choosing a notified body under the MDR.
For risk management, ISO 13485 refers explicitly to ISO 14971:2019. That standard describes how to identify, assess and control hazards across the whole product lifecycle.
What ISO 13485 does not replace
ISO 13485 helps a lot, but it does not remove the legal burden. The standard does not replace:
- legal product requirements under the MDR/IVDR;
- technical documentation for each product;
- classification and conformity routes, see determining MDR risk classes;
- UDI, vigilance and EUDAMED registration obligations.
How they reinforce each other in practice
Although they differ, the MDR and ISO 13485 work well together. The standard gives you a structure that secures the legal requirements every day and makes them demonstrable. In these process areas, they overlap.
| Process area | Why the overlap? | Read more |
|---|---|---|
| Design control and changes | Product changes must be controlled and traceable | Requirements of the standard |
| Supplier qualification | External parties affect product quality | Costs and timeline |
| Traceability | Fast impact analysis and follow-up | Audit process |
| Complaints, PMS and CAPA | Continual improvement and risk follow-up | Step-by-step plan |
Practical order: law first, then the system
Start with the legal requirements and build your system around them. This way you avoid duplicate work.
- Translate MDR/IVDR obligations into concrete process requirements.
- Set up QMS processes that secure these requirements every day.
- Link records, CAPA and risk management directly to product files.
- Carry out internal audits on both compliance and how the processes work.
- Prepare certification and the notified body assessment together.