ISO 13485: the quality management system for medical devices

What ISO 13485 is

It is the international standard setting out quality management system requirements for organisations that design, manufacture or distribute medical devices and related services. The version in force is ISO 13485:2016 (in Europe EN ISO 13485:2016/A11:2021, in Italy UNI CEI EN ISO 13485:2021).

Unlike ISO 9001, it does not follow the harmonised structure shared by the other ISO standards: it is written specifically for the medical sector, with a strong bias towards risk and regulatory compliance across the whole life cycle of the device.

Who needs it, and why

• Medical device manufacturers that have to place their products on the market.
• Companies that design, manufacture or sterilise components destined for the medical sector.
• Providers of related services (distribution, installation, servicing) in the medical device supply chain.
• Exporters of medical devices that have to answer to several international regulatory frameworks.

Is it mandatory? ISO 13485 is not mandatory in itself, but in practice it is the standard required to operate in the sector. EU Regulation 2017/745 (MDR) requires manufacturers to have a quality management system, and ISO 13485 is the recognised way to demonstrate one.

The link with CE marking and the MDR

The medical device sector is governed by EU Regulation 2017/745 (MDR) — and, for in vitro diagnostics, by Regulation 2017/746 (IVDR). CE marking of the device goes through assessment by a notified body.

ISO 13485, in its harmonised European version, confers a presumption of conformity with the quality system requirements of those regulations: a solid 13485 system is the precondition for tackling CE marking of the device. They are two distinct levels — the management system (13485) and placing the individual device on the market (MDR) — and they have to be kept aligned.

International recognition

ISO 13485 is in effect the global standard for quality in the medical field: it underpins MDSAP audits (accepted by several regulators, including the United States, Canada, Australia, Japan and Brazil) and it is referenced by the US FDA’s new QMSR, in force since February 2026, which incorporates ISO 13485 into its own framework. A system built properly on this standard therefore speaks to several markets from a single setup.

The path, step by step

1. Initial review — the free preliminary assessment: where you stand, what you already have, what is missing.
2. Planning — the scope of the system, objectives, responsibilities.
3. Risk analysis — focused on the device and its life cycle, and the heart of the standard.
4. Building the management system — processes, procedures, technical documentation, controls.
5. Training the staff.
6. Internal audit.
7. Certification audit — the assessment by the independent third-party body.
8. Maintenance — annual surveillance, renewal on a three-year cycle.

How the cost breaks down

There are two items and they stay separate: our consulting fee and the fee of the certification body, an independent third party. The variables are size, the class and complexity of the devices, the number of sites, and whether a system is already in place or you are starting from scratch. We discuss it openly at the first contact, on your case rather than off a generic price list.

Why BS & Partners

• Experience with management systems: structurally, ISO 13485 is a quality management system. Someone who has been implementing management systems for years knows how to set it up so that it holds at assessment, not merely so that it looks tidy.
• Ten years in business, 117 projects, work in 9 countries.
• A multidisciplinary approach: our engineering background and our familiarity with production processes help us read product and process controls, not just fill in forms.
• The firm and the way we work: the BS & Partners profile.