How do you get ISO 13485 (or ISO 9001) certification, and what does it cost?

1Who certifies, and who checks the certifier.

ISO develops the standards but “does not perform certification or issue certificates”, so a company cannot be certified by ISO. Certification is the provision by an independent body of written assurance that a system meets specific requirements; accreditation is the formal recognition, by an accreditation body, that a certification body operates according to international standards.¹ For management systems, that standard is ISO/IEC 17021-1:2015, which sets requirements for the competence, consistency and impartiality of certification bodies.² Global ACI has taken over the former roles of the International Accreditation Forum (IAF) and ILAC.¹ Its mandatory documents on audit time (Global ACI-TECH-3-004) and on ISO 13485 certification (Global ACI-TECH-3-007) correspond to the former IAF MD 5 and IAF MD 9.³

ISO advises evaluating several certification bodies, checking that each uses the relevant standard and checking whether it is accredited. Accreditation is not compulsory, but it gives independent confirmation of competence.¹ ISO 9001 certification is a choice: organisations implementing the standard can decide whether to seek it.⁴

2The certification process, step by step.

1. Implement the system against the current edition. ISO 13485:2016 was last reviewed and confirmed in 2025 and remains current.⁵ ISO 9001:2026, the sixth edition, was published on 16 September 2026.⁴
2. Apply to a certification body. It must determine the audit time for Stage 1, Stage 2, surveillance and recertification for each applicant, record the justification and give it to you as part of the contract.⁶
3. Pass the initial audit. Certification starts with an initial audit in two stages, and Stage 2 normally takes longer than Stage 1.⁶ For higher-risk devices, such as GHTF classes C and D, Stage 1 should be performed on site.⁷
4. Correct the nonconformities. For ISO 13485, major nonconformities need the certification body to accept your correction and corrective action and to verify their effectiveness. Global ACI’s examples include having no complaint handling or training system, failing to act when post-market data shows a pattern of defects, and repeating nonconformities from earlier audits.⁷
5. Keep it through surveillance. Surveillance takes about one third of the initial audit time each year. For ISO 13485 it includes a review of action taken on adverse event notifications, advisory notices and recalls, and short-notice or unannounced audits may be required, for example after significant safety information or significant changes.⁶⁷
6. Recertify. A recertification audit normally takes about two thirds of the time a fresh initial audit would need at that point, not two thirds of the original.⁶

3What sets the cost: audit days.

The Global ACI documents on audit time say nothing about fees. What they set is audit time. An audit day is normally 8 hours, and a body may not cut the days by planning longer hours. Audit time covers time at your premises, physical or virtual, plus planning, document review and report writing; travel and breaks do not count as time on site.⁶ The starting point is the effective number of personnel: everyone involved within the scope of certification, whether permanent, temporary or part-time, on every shift, and contractors where they are in scope.⁶

The ISO 13485 column is Table D.1 of Global ACI-TECH-3-007 and the ISO 9001 column is Table QMS 1 of Global ACI-TECH-3-004; both continue to larger organisations and cover the initial audit only.⁷⁶ Table QMS 1 is to be read as a continuum rather than as steps, so a headcount inside a band is interpolated, and audit days are rounded to the nearest half day.⁶

The tables are a starting point. For ISO 13485, time goes up for more than one main technical area, complex devices, critical suppliers, installation at customers’ premises, poor regulatory compliance and multiple shifts or lines. Reductions, for example where the scope excludes manufacturing, may not exceed 20% in total, or 50% for a scope solely of distribution or transport. Time to audit national or regional regulatory requirements, and dossier reviews, comes on top.⁷ For ISO 9001, medical and pharmaceutical activities count as high risk and normally need more time than the table, and reductions may not exceed 30%.⁶

4A worked example.

Take a device manufacturer with 45 effective personnel on one site and no adjustments. An initial ISO 13485 audit is 6 audit days, surveillance about 2 days each year, and recertification about 4 days if the organisation has not changed.⁷⁶ Auditing ISO 9001 and ISO 13485 together adds at least 25% to the ISO 13485 days, whether the audit is integrated or combined, so at least 7.5 days.⁷ ISO 9001 alone starts at 4 days for the same headcount, before the high-risk adjustment.⁶ When comparing quotes, compare the audit days each body proposes and its written justification for them.

5ISO 9001:2026 and the US position.

Certificates to ISO 9001:2015 have to move to ISO 9001:2026 by 30 September 2029, through a surveillance, recertification or special transition audit. After 31 March 2028, new certifications can only be to the 2026 edition.⁸

In the US, the Quality Management System Regulation has incorporated ISO 13485:2016 by reference since 2 February 2026.⁹ FDA will not require or issue certificates of conformance to ISO 13485, and a certificate does not exempt a manufacturer from FDA inspection.¹⁰ The Medical Device Single Audit Program (MDSAP) is voluntary, and FDA may accept MDSAP audit reports in place of routine inspections.¹⁰¹¹ For how the two requirement sets compare, see ISO 13485 and 21 CFR 820.

6How it runs in Seal.

Seal’s medical device blueprint brings design, manufacturing and quality onto one platform, with traceability recorded as the work is done: protocols are created against requirements, results attach to executions, and risk controls, technical documentation and complaints link to the same records. Map the configured quality system to ISO 13485, the QMSR and the other requirements that apply to your device and operation; the presence of a workflow does not itself demonstrate conformity.

Audit management runs internal and supplier audits from one risk-based programme, through findings and their follow-up. Evidence is the source record at the version selected, and a finding links its assessment, proposed change and verification, each with its own owner. Neil assembles the candidate evidence and drafts requests for what is missing; your team decides what is disclosed and what the cause is. Inspection readiness logs requests, scope, packages, redactions and delivered evidence, and a mock inspection uses the same request log and package workflow as a real one.