What is the difference between ISO 9001 and ISO 13485?

1Two standards with different jobs.

ISO 9001 sets out the requirements for a quality management system that any organisation can use. ISO describes it as “suitable for organizations of all sizes and across all sectors”, from manufacturing and services to healthcare, education and government. It covers the context of the organisation, leadership, planning, support, operation, performance evaluation and improvement.¹ The sixth edition, ISO 9001:2026, was published on 16 September 2026 and replaces ISO 9001:2015, which ISO has now withdrawn.¹² ISO says the new edition improves clarity, emphasises quality culture and leadership, separates risks from opportunities and aligns more closely with ISO’s other management system standards.¹

ISO 13485:2016 is the quality management standard for medical devices. Its title ends “Requirements for regulatory purposes”. It is the third edition, published in March 2016 and developed by ISO technical committee ISO/TC 210. ISO last reviewed and confirmed it in 2025, so this version remains current.³ It is meant for “any organization involved in the design, production, installation, and servicing of medical devices and related services”, and suppliers to those organisations can use it too.³ ISO lists it among the sector standards “based on ISO 9001 and adapted to specific sectors”.¹

2Where ISO 13485 differs from ISO 9001.

ISO’s own comparison is short. ISO 9001 is a framework for organisations of any size or sector; ISO 13485 is designed for the medical device industry, “with a focus on regulatory compliance”. It addresses risk management, traceability and process validation, and contains additional requirements for organisations in the device life cycle. In the other direction, “where regulatory requirements are more relevant to the sector, certain generic requirements of ISO 9001 are omitted”.¹ The ISO 13485 page says the standard emphasises “meeting regulatory as well as customer requirements, risk management, and effective process validation more than ISO 9001”.³

3How ISO 13485 became the US device regulation.

On 31 January 2024 FDA issued a final rule that amends 21 CFR 820 to incorporate ISO 13485:2016 by reference, and renamed the regulation the Quality Management System Regulation (QMSR). It took effect on 2 February 2026.⁷ A device manufacturer must now “document a quality management system that complies with the applicable requirements of ISO 13485” and of the rest of Part 820.⁸ Part 820 incorporates two documents: ISO 13485:2016, third edition, and Clause 3 of ISO 9000:2015 for its terms and definitions. ISO 9001 itself is not incorporated.⁵⁹

FDA keeps its own rules beside the standard. Section 820.10(b) ties ISO 13485 clauses to other FDA regulations: unique device identification under Part 830 for Clause 7.5.8, traceability under Part 821 for Clause 7.5.9.1, reporting under Part 803 for Clause 8.2.3, and advisory notices under Part 806.⁸ Design and development, Clause 7.3, applies to class II and class III devices, to class I devices automated with computer software, and to five listed class I devices.⁸ Where a clause of ISO 13485 conflicts with the Federal Food, Drug, and Cosmetic Act or FDA’s regulations, the Act and the regulations control, and the Act’s definitions supersede the standard’s.¹⁰⁹

FDA will not require or issue ISO 13485 certificates, and a certificate “will not exempt a manufacturer from an FDA inspection”. Investigators may now review management reviews, quality audits and supplier audit reports, which the old 820.180(c) kept out of inspection.⁷ If ISO revises ISO 13485, FDA will evaluate the change and, if appropriate, amend the QMSR through rulemaking.⁷

4What the EU Medical Device Regulation expects.

Under Regulation (EU) 2017/745, every manufacturer of devices other than investigational devices must “establish, document, implement, maintain, keep up to date and continually improve a quality management system”, proportionate to the risk class and type of device, covering at least the aspects Article 10(9) lists.¹¹ Article 8 presumes conformity for devices that meet harmonised standards, and says this applies to quality management system requirements too.¹¹ Commission Implementing Decision (EU) 2022/6 of 4 January 2022 added EN ISO 13485:2016 and its amendment EN ISO 13485:2016/A11:2021 to the list of harmonised standards under the MDR, as quality management system standards.⁶

5Which standard a company needs.

A medical device manufacturer works to ISO 13485. Part 820 incorporates ISO 13485, not ISO 9001, and the European version, EN ISO 13485, is harmonised under the MDR.⁵⁶ Part 820 does not apply to manufacturers of components or parts of finished devices, though FDA encourages them to consider its provisions.¹⁰

ISO 9001 suits organisations outside the device sector, and those whose customers ask for a general quality certificate. Certification is voluntary, and it is done by independent certification bodies, not by ISO.⁴ Organisations certified to ISO 9001:2015 will have to move to the 2026 edition within the time frame their certification cycle sets, and ISO advises them to ask their certification body for details.¹

6How it runs in Seal.

In Seal an ISO 13485 quality system runs as connected records: document control, design controls, risk management, CAPA and supplier processes in one record model, alongside the rest of the quality system. For medical devices, requirements link to design outputs, verification and risk controls, and each unit links to the versions and lots it was built from. Seal keeps the design and development file, the medical device file and the record for each device or batch as connected records, whichever names your procedures use.

In design control, the traceability matrix is a view of those links, so a requirement with no linked test is listed as a gap while the design is developed. Your team maps the configured system to the QMSR, ISO 13485 and the other requirements that apply to the device; a workflow existing in Seal does not by itself show conformity.