ISO 13485:2016 Medical Devices Quality Management (MDQMS)

What ISO 13485 is

ISO 13485:2016 is the international standard for quality management systems in the medical device sector. It sets requirements for how a company designs, produces, stores, distributes, installs and services medical devices, with a strong focus on regulatory compliance, risk management and documented evidence.

The 2016 edition is still current. The ISO committee responsible reviewed it in 2025 and chose stability over a new edition for now, partly because major regulators have just aligned with it.

Why it matters more in 2026

On February 2, 2026 the FDA's Quality Management System Regulation (QMSR) took effect. It amends 21 CFR Part 820, the US device quality rule, to incorporate ISO 13485:2016 by reference, with a small number of FDA-specific additions. For the first time, a device maker building to ISO 13485 is building to most of the US requirement too.

Two points are often misunderstood. The FDA does not require ISO 13485 certification, and an ISO 13485 certificate does not exempt a manufacturer from FDA inspection. The FDA inspects against its regulation. Certification is still valuable, especially for the EU and for buyers, but it is not an FDA approval.

In the EU, the Medical Device Regulation requires manufacturers to run a quality management system, and notified bodies commonly assess it against the harmonised EN ISO 13485. Many other regulators, and the multi-country MDSAP audit programme, also rely on it.

Who this is for

• Device manufacturers exporting to the US, EU, UK, Canada, Australia or Japan.
• Contract manufacturers and component suppliers whose customers require ISO 13485.
• Start-ups taking a first device through design controls toward regulatory submission.
• Companies with ISO 9001 that now make or supply medical devices.
• Distributors and service providers in the device supply chain.

What BookMyLLC handles

• Gap analysis against ISO 13485:2016 and the regulations for your target markets.
• Quality manual and procedure set, scaled to your size and device class.
• Design and development controls, including design history and technical documentation structure.
• Risk management procedures aligned with ISO 14971.
• Supplier evaluation and control, complaint handling, feedback and CAPA processes.
• Internal auditor training and a full internal audit.
• Management review preparation and certification audit support.

Step-by-step process

1. Define scope. Devices, activities (design, manufacture, distribution, service) and markets.
2. Gap analysis. We compare your current practice with each clause and list gaps by priority.
3. Build the system. Procedures, forms and records are drafted with your team.
4. Implement and run. The system operates long enough to produce records, typically a few months.
5. Internal audit and management review. Both are required before certification.
6. Certification audit. An accredited certification body, or a notified body for EU MDR purposes, audits in two stages.
7. Surveillance. Annual surveillance audits follow, with recertification every three years.

What you need to provide

• A list of devices, their classification in each target market, and intended use.
• Existing procedures, design files, risk files and supplier lists.
• Organisation chart and named quality lead.
• Details of outsourced processes such as sterilisation, testing or contract manufacturing.
• Complaint, return and service records, if the product is already on the market.

Timeline

For a small company with some quality processes in place, reaching certification readiness typically takes several months. Companies starting from scratch, or with design controls to rebuild for an existing device, should plan for longer. Certification body availability also affects dates.

How ISO 13485 differs from ISO 9001

ISO 9001 is the general quality standard for any organisation. ISO 13485 is built on an older version of its structure but goes further in areas regulators care about: documented design controls, risk management across the product life cycle, sterile and implantable device requirements, traceability, complaint handling and reporting to regulators. It also puts less weight on continual improvement and customer satisfaction and more on maintaining an effective, compliant system. Holding ISO 9001 helps, but it does not satisfy medical device regulators on its own.

MDSAP: one audit, several regulators

The Medical Device Single Audit Program lets an authorised auditing organisation carry out one audit of a manufacturer's quality system that several regulators then rely on. Participating regulators include the FDA, Health Canada, Brazil's ANVISA, Australia's TGA and Japan's regulators. The audit is built on ISO 13485 plus each country's specific requirements.

For companies selling in several of those markets, MDSAP can replace separate regulatory audits. Health Canada requires MDSAP certification from manufacturers of Class II, III and IV devices licensed for sale in Canada. If Canada or several participating markets are on your roadmap, we plan your ISO 13485 system with MDSAP in mind from the start, so you do not rebuild procedures later.

Common mistakes to avoid

• Treating certification as FDA clearance. Market authorisation is a separate regulatory process in each market.
• Weak design controls. Design history and traceability from requirements to verification are the most scrutinised areas.
• Risk management as a one-off document. ISO 14971 expects risk files updated with post-market data.
• Uncontrolled outsourcing. You remain responsible for processes you outsource, and auditors will check how you control them.
• A generic quality manual. Auditors quickly spot documents that do not match how the company works.
• Leaving post-market surveillance until launch. Complaint trending, vigilance reporting and feedback loops must work from the first unit sold, and auditors test them with real examples.

This is general guidance, not regulatory advice; confirm market-specific requirements with the relevant regulator. For EU market access, pair this with CE marking support. Related systems include ISO 9001 and ISO 27001 for connected devices and software. Book a call to scope your certification.

ISO 13485 at a glance

ISO 13485 and ISO 9001 compared

The certification path

MDSAP and regulators

Some regulators accept one audit for several markets through the Medical Device Single Audit Program, which uses ISO 13485 as its basis. If you plan to sell in several of those markets, an ISO 13485 system built with that audit in mind can save repeat work. Check which markets accept MDSAP and which require their own registration.

Certification is one part of regulatory approval, not the whole of it. Device classification, clinical evidence and labelling also matter, and we point out where you will need a regulatory specialist.

Documents an auditor will ask for