ISO 13485 for medtech start-ups: when to begin?
For many medtech start-ups, ISO 13485 is a mandatory step towards market access, even though it is not a hard legal requirement. The standard is published by ISO and is available in the Netherlands via NEN . In practice, as a start-up you will sooner or later face notified bodies, enterprise clients or investors who ask: “Where is your QMS?”
The good news: you do not need to set up a fully bureaucratic system straight away. A lean, demonstrable QMS that conforms to ISO 13485 and fits your stage is exactly what auditors also expect from start-ups. If you wait too long, you end up building it around your product instead of alongside it. See also who ISO 13485 is relevant for and the overview of costs and timeline.
Article 10(9) of the MDR requires all manufacturers of medical devices to have a quality management system, whatever the classification of the device. ISO 13485 is the most commonly used way to meet this.
When to start with ISO 13485?
| Situation | Advice |
|---|---|
| You have a medical claim for your product | Start with basic documentation straight away |
| A client or investor asks for a demonstrable QMS | Set up a working system within 3-6 months |
| A notified body process is planned | Reach at least 65% implementation before you approach them |
| You are still in the proof-of-concept phase | Document design and test reports carefully from the start |
| You think certification is not needed | Check this per product class and market |
Minimum ISO 13485 system for a start-up
You do not have to implement everything at once. However, you should get the following parts in order early, because they are hard to build retrospectively:
- Document control: versions, approvals and archiving of your procedures and records.
- Design controls: evidence of how your design came about, was validated and was changed.
- Risk management: a risk management file in line with ISO 14971 is mandatory for every device.
- CAPA system: how you resolve deviations and complaints in a structured way (see CAPA under ISO 13485).
- Supplier management: basic qualification of critical suppliers.
What you can temporarily postpone: extensive training management, large-scale supplier monitoring and an extensive internal audit. But document everything from day one, even if it is brief.
The notified body reality for start-ups
A common mistake: only applying for ISO 13485 when you want to start a notified body process. Notified bodies expect your QMS to already be at least 65-85% implemented and demonstrably working before you approach them.
Notified bodies in the Netherlands include Kiwa , TÜV Nederland and SGS . For ISO 13485 certification, you go to an accredited certification body (not a notified body). These are different parties with different mandates:
| Party | What they do |
|---|---|
| Certification body (for example TÜV or DNV) | Audits your ISO 13485 QMS |
| Notified body (designated by a Member State) | Assesses the MDR conformity of your product |
You can tackle both at the same time or one after the other. Always ask both for a pre-assessment first.
How a start-up scales up more smartly
Build your QMS around your product, not alongside it
Do not start with a generic ISO 13485 template that you fill in. Start with your design and development process and document what you already do. Your design history file (DHF) will later form the core of your technical documentation.
Choose your tooling early
A spreadsheet works at the beginning, but you soon lose track. Consider lightweight QMS tools (Notion, Confluence or dedicated medtech QMS software) once your team grows.
Use your internal audit as a learning tool
The first internal audit is not a punishment but an opportunity. Carry it out before you even think about an external audit. Setting it up with an audit plan and checklist is part of this. That way you find gaps while they are still easy to close.
Request a pre-assessment
You can request an exploratory meeting or a pre-assessment from both certification bodies and notified bodies. This gives you insight into where the gaps are, without formal audit pressure.
Budget indications for start-ups
See the full overview on the page costs and timeline. As an indication for a lean start-up:
| Phase | Time indication | Cost indication |
|---|---|---|
| Setting up a basic QMS (in-house) | 2-4 months | Mainly staff hours |
| External help/consultant | Optional | €5,000 to €30,000 |
| Stage 1 and stage 2 audit | 2-4 months after setup | €5,000 to €15,000 (depending on scope) |
| Annual surveillance | Every year | €2,000 to €6,000 |
These are indications only. Always verify costs with the body of your choice.