Who is ISO 13485 relevant for?
ISO 13485 is intended for organisations in the medical device supply chain. The standard is managed internationally by ISO , published in the Netherlands via NEN , and often applied together with the EU MDR .
The standard is not only for large manufacturers. Growing companies, software suppliers and component suppliers also use ISO 13485 to get through client audits and market access processes more quickly.
A quick rule of thumb: if your work directly affects product safety, conformity or traceability, ISO 13485 is usually relevant.
ISO 13485 in brief
| Organisation type | Relevance of ISO 13485 | Why |
|---|---|---|
| Legal manufacturer | Very high | Ultimately responsible for conformity and quality |
| SaMD/software medtech | High | Development and change control are critical in audits |
| Contract manufacturer | High | Product quality and traceability sit directly in your process |
| Critical supplier | Medium-high | Clients often require demonstrable control |
| Distributor/importer | Medium | Often required in vendor approval or contracts |
Typical organisations for ISO 13485
1. Manufacturers (legal manufacturer)
If you are legally responsible for the product on the market, ISO 13485 is almost always the logical choice. You must demonstrably control design, production, complaints and changes.
2. Software companies (SaMD)
Are you building software with a medical claim or clinical use? Then clients and auditors expect your development process, validation and change control to be under control. For what this means specifically for a software company, read ISO 13485 for software companies.
3. Contract manufacturers and critical suppliers
Even without your own CE marking, a client can require you to work to ISO 13485, especially if your processes directly affect patient safety.
4. Importers and distributors
In international distribution, ISO 13485 helps with vendor approval, client audits and framework contracts with larger parties.
When ISO 13485 has a direct commercial impact
ISO 13485 often delivers the most value when you:
- want to close enterprise clients in healthcare or medtech;
- want to expand into regulated markets;
- expect due diligence from investors or partners;
- want to run predictable audits without firefighting.
When you can still wait
Postponing can sometimes be sensible if you:
- are still in an early proof-of-concept phase;
- are not yet making a regulated claim;
- do not yet have clients or partners who require demonstrable compliance.
However, once market access and contract requirements come into view, waiting is usually more expensive than starting.
Are you a young medtech organisation unsure when to begin? The page ISO 13485 for medtech start-ups explains when to set up a lean QMS, what notified bodies expect as a minimum and how to scale up smartly without unnecessary overhead.
ISO 13485 decision check
| Question | If you answer “yes” |
|---|---|
| Do clients ask for a demonstrable QMS? | Start with the step-by-step plan |
| Do you work with a medical device or SaMD? | Prioritise the requirements of the standard |
| Is an MDR/IVDR process already under way? | Link it directly to MDR and ISO 13485 |
| Is an audit or contract due within 6-12 months? | Set budget and planning now using costs and timeline |