1ISO 13485 certification, step by step.
ISO writes the standard but “does not perform certification or issue certificates”. Certification bodies do, and accreditation bodies check them, under rules now published by Global ACI, which has taken over the roles of IAF and ILAC.¹ Certify against ISO 13485:2016, confirmed in 2025.²
| Step | What happens | Rule |
|---|---|---|
| 1. Implement | Build and run the quality system to ISO 13485:2016 and the device regulations of your markets | ISO 13485:2016² |
| 2. Choose a body | Check its accreditation, and get its audit time and the justification for it in the contract | ISO;¹ TECH-3-004, 4.3 and 4.4³ |
| 3. Stage 1 | Documentation review and a check that you are ready for Stage 2; it should be on site for higher-risk devices such as GHTF classes C and D | MDSAP audit approach;⁴ TECH-3-007, MD 9.3.1.2⁵ |
| 4. Stage 2 | Whether every applicable requirement is implemented and effective | MDSAP audit approach⁴ |
| 5. Close findings | For a major nonconformity, the body must accept your correction and corrective action and verify they worked | TECH-3-007, MD 9.4.5⁵ |
| 6. Certificate | Issued for a three-year cycle | TECH-3-004, 5³ |
| 7. Surveillance | Each year, about a third of the initial audit time, including what you did about adverse event reports, advisory notices and recalls | TECH-3-004, 5;³ TECH-3-007, MD 9.6.2.2⁵ |
| 8. Recertify | In year three, about two thirds of the time a fresh initial audit would take then | TECH-3-004, 6;³ MDSAP audit approach⁴ |
2ISO 13485 certification readiness checklist.
What must exist before each stage, from NSAI’s published list: its Stage 1 and Stage 2 expectations for clauses 4.1.5, 5.6 and 8.2.4, and its common Stage 1 findings restated as what to have in place. Other bodies differ in detail, so ask yours for its list.
| Clause | What must exist | By |
|---|---|---|
| 4.1.2, 4.1.3 Processes | Each process in scope monitored, with an objective or metric, and on the internal audit schedule | Stage 1 |
| 4.1.5 Outsourcing | Ideally, providers identified, contracts drafted, evaluation under way | Stage 1 |
| 4.1.5 Outsourcing | Contracts signed, providers on the approved supplier list | Stage 2 |
| 4.2.1 Change control | How to identify a substantial change to the system and notify the body | Stage 1 |
| 4.2.2 Quality manual | Scope, exclusions correctly identified, how the processes interact, references to the required procedures | Stage 1 |
| 4.2.4, 4.2.5 Records | Retention periods defined, and aligned with the related documents | Stage 1 |
| 5.3 Quality policy | A commitment to comply with requirements and maintain effectiveness, and a framework for quality objectives | Stage 1 |
| 5.5.2 Representative | The management representative’s responsibilities and authority clearly stated | Stage 1 |
| 5.6 Management review | Completed, covering all applicable requirements, and concluding on “Continued suitability, adequacy and effectiveness” | Stage 1; update after it if needed |
| 6.2 Training | A training system, with a method to judge training effectiveness | Stage 1 |
| 7.1 Risk management | A procedure saying what triggers a risk management file review or update, and how often periodic review happens; annual review may not be adequate for some technical files | Stage 1 |
| 7.4 Purchasing | Supplier re-evaluation documented, quality agreements with key suppliers signed, key suppliers on an approved list; for outsourced processes, the 4.1.5 rows apply | Stage 1 |
| 8.2.1 Feedback | A documented procedure for obtaining and using customer feedback | Stage 1 |
| 8.2.2 Complaints | A complaint handling system, with complaint defined as ISO 13485 defines it | Stage 1 |
| 8.2.4 Internal audit | A schedule matching your processes, at least one audit done, and trained auditors who do not audit their own work | Stage 1 |
| 8.2.4 Internal audit | A full round of internal audits completed | Stage 2 |
| 8.5.2 CAPA | Procedures requiring corrective and preventive action without undue delay | Stage 1 |
3How long ISO 13485 certification takes.
No rule sets how long the whole project takes. Greenlight Guru says most device companies certify in six to 18 months, with at least three months running the system before Stage 1 and one to three months’ wait for the certification body.⁷ OpenRegulatory gives a typical four to nine months.⁸ After the build, the gates are fixed: records that meet the checklist, the body’s scheduling, and up to six months to clear a major nonconformity.
3.1Example: nine months from procedures to certificate.
Example. Corrowby Medical Ltd, an invented contract manufacturer, assembles and packs sterile single-use infusion sets for device companies whose supplier agreements require an ISO 13485 certificate. Months count from the day its procedures take effect; they are illustrative, the gates are not.
| Month | What happens | Gate |
|---|---|---|
| Before 0 | Gap analysis, two to four weeks; procedures written and staff trained, three to 12 months | None set by rule; durations are Greenlight Guru’s⁷ |
| 0 | Procedures take effect and records start | None: the clock starts |
| 3 | First internal audit done; first management review complete; steriliser contract drafted | NSAI’s Stage 1 expectations⁶ |
| 4 | Stage 1: documents reviewed, readiness for Stage 2 judged | The body decides whether you are ready for Stage 2⁴ |
| 5 | Full round of internal audits complete; steriliser contract signed and the supplier approved | NSAI’s Stage 2 expectations⁶ |
| 6 | Stage 2 raises one major nonconformity | The body must accept the correction and corrective action⁵ |
| 8 | The body verifies they are implemented | Within 6 months of Stage 2’s last day, or Stage 2 is repeated⁹ |
| 9 | Certification decision; certificate takes effect | Not before the decision¹⁰ |
4What ISO 13485 certification costs.
OpenRegulatory’s planning model puts initial certification for most small device companies at €15,000 to €100,000, counting consultants, internal labour, training and software as well as the body’s fees. Consultants are the biggest swing: €8,000 to €20,000 for targeted reviews, €25,000 to €60,000 for full implementation.⁸
4.1How audit days are set.
No accreditation rule sets fees; the rules set audit time, which each body prices at its own rates. An audit day is normally 8 hours, and a body may not cut the days by planning longer hours. Audit time includes time at your premises, physical or virtual, planning, document review and report writing; travel does not count as audit time on site.³
Days start from the effective number of personnel: everyone in the scope of certification, permanent, temporary or part-time, on every shift, and contractors when they are in scope. Depending on hours worked, part-timers may be converted to full-time equivalents: 30 working 4 hours a day count as 15.³
| Effective personnel | Initial audit, days |
|---|---|
| 1 to 5 | 3 |
| 6 to 10 | 4 |
| 11 to 15 | 4.5 |
| 16 to 25 | 5 |
| 26 to 45 | 6 |
| 46 to 65 | 7 |
| 66 to 85 | 8 |
| 86 to 125 | 10 |
| 126 to 175 | 11 |
| 176 to 275 | 12 |
| 276 to 425 | 13 |
| 426 to 625 | 14 |
The table is a starting point. When more than one main technical area is audited, the time “shall be increased”, and sterilisation is a main technical area of its own, so a sterile device brings a second one. Time may also go up for complex devices, critical suppliers, installation at customers’ premises, poor regulatory compliance, and multiple shifts or lines. Reductions, for example for a scope without manufacturing, may not exceed 20% in total, or 50% for distribution or transport alone. Time to audit national or regional regulatory requirements comes on top.⁵ Days are rounded to the nearest half day, and the audit itself, from opening to closing meeting, should typically take at least 80% of the calculated time.³
4.2Example: checking a quote.
Corrowby has one site, no design in its scope, GHTF class B devices, and ethylene oxide sterilisation by a contractor.
| Line | Working |
|---|---|
| Personnel | 31 full-time on two shifts, 20 part-time packers at 4 hours a day (10 full-time equivalents), 4 contract QC analysts in scope: 45 |
| Starting point | Table D.1, 26 to 45 people: 6 days |
| Adjustments | Sterilisation is a second main technical area, so time must go up: the body adds 0.5 day. Two shifts: another 0.5 day. 7 days |
| Steriliser | A critical supplier. If Corrowby cannot show enough evidence of its control, the body may add time to audit it |
| Initial audit | 7 days, Stage 1 and Stage 2 together |
| Surveillance | 7 ÷ 3 = 2.33, rounded to 2.5 days a year |
| First cycle’s audits | Initial and two surveillances: 7 + 2.5 + 2.5 = 12 audit days |
| Audit fees | NSAI’s standalone ISO 13485 rate: 12 days × €1,900 = €22,800 |
| Fixed fees | €2,000 application, which includes year one’s annual fee, plus €1,500 in each of years two and three: €5,000 |
| First cycle’s total | €27,800, before travel |
| Recertification | In year three, before expiry, if nothing changes: 7 × 2/3 = 4.67, rounded to 4.5 days; 4.5 × €1,900 = €8,550 |
NSAI’s list also prices pre- and post-audit activities at €1,900 a day and invoices handling of more than three nonconformities in half days, so ask what a quote includes.¹¹
If Corrowby sold sets under its own name, the certificate would not be enough:
- EU. Sterile devices need an MDR notified body, whose audit can cover the ISO 13485 elements.¹²⁵ At NSAI’s MDR rate of €3,000 per auditor-day, the same 12 days cost €36,000, plus time to audit the MDR’s own requirements;⁵ technical documentation assessment starts at €19,500, and an unannounced audit, which the MDR requires at least once every five years, costs €6,000 a day with two auditors.¹¹¹²
- Canada. An MDSAP certificate is required.¹³ MDSAP counts audit tasks, plus 25% for an initial audit, instead of using Table D.1,¹⁴ and NSAI charges €3,000 per auditor-day and €1,200 a year above the ISO 13485 annual fee.¹¹
4.3Comparing bodies’ published fees.
Day rates are close; minimums are not. NEOEMKI charges €234 an hour, or €1,872 for an 8-hour day, against NSAI’s €1,900, but sets minimums of €7,650 for initial certification, €4,000 for surveillance and €5,500 for renewal.¹⁵¹¹ Table D.1 gives a company of 1 to 5 people 3 audit days, worth €5,616 at €1,872, so the €7,650 minimum applies. Compare quotes on audit days and their written justification first, and on rates second.³
5Checking an ISO 13485 certificate.
Check the number on IAF CertSearch, which “aggregates data from accreditation bodies and certification bodies”, or with the body,¹ then read the certificate field by field:
| Field | Example: Corrowby | Rule |
|---|---|---|
| Number | C-27-0417 | A unique identification code |
| Effective date | 9 September 2027, the decision date | Not before the certification decision |
| Expiry date | 8 September 2030 | No more than three years after the effective date |
| Name and address | Corrowby Medical Ltd, with its full street address | For a Canadian licence, the same as on the licence and device label |
| Sites | One; the steriliser is not listed | Every covered site listed; subcontractors are not |
| Scope | Manufacture of sterile single-use infusion sets | Processes and generic device groups, with no trade names, catalogue numbers or device classes |
A contract manufacturer’s certificate does not stand in for its customers’: Health Canada will not accept a subcontractor’s certificate as evidence for a manufacturer’s licence.¹⁰ And a certificate shows the system was audited; it is not your supplier evaluation. See supplier qualification.
6What a certificate does in the US, EU, UK and Canada.
- United States. No formal role. Part 820 incorporates ISO 13485:2016, but FDA “will not require certificates of conformance to ISO 13485”, and one “will not exempt a manufacturer from an FDA inspection”.¹⁶ FDA may accept MDSAP audit reports in place of routine inspections.¹⁷ See ISO 13485 vs 21 CFR 820.
- European Union. It supports, but does not replace, the notified body’s audit for devices that need one. EN ISO 13485:2016 is a harmonised standard, and a notified body “shall assume” a system that meets it conforms to the requirements it covers, unless it substantiates otherwise.¹⁸¹²
- United Kingdom. In Great Britain, EN ISO 13485:2016 is a designated standard under the UK MDR 2002,¹⁹ and a UK approved body does any third-party UKCA assessment. CE-marked devices remain accepted until 30 June 2030 under the EU MDR or IVDR, or until the sooner of certificate expiry and 30 June 2028 under the MDD or AIMDD (30 June 2030 under the IVDD). Northern Ireland applies the EU MDR.²⁰ On 21 October 2026 the government said it intends to legislate to recognise devices certified under the EU MDR indefinitely.²¹
- Canada. Class II, III and IV licences need an ISO 13485 quality system certificate, and Health Canada requires it to be issued by an auditing organisation recognised under MDSAP.¹³
7Mistakes that add audit days or a major.
- Narrowing the scope. A body may not exclude processes, products or services that affect safety and quality, “unless allowed by regulatory authorities”.⁵
- Sampling sites. In a multi-site certification, sites that design, develop or manufacture devices cannot be sampled; each is audited.⁵
- Repeat findings. Nonconformities repeated from earlier audits are a listed example of a major, as is failing to act when post-market data shows a pattern of defects.⁵
- Surprises. New ownership, a new site or adding design to the scope can justify a short-notice audit, so tell the body first.⁵
8What changed in 2026.
- 2 February 2026. FDA’s QMSR took effect, incorporating ISO 13485:2016 into Part 820.¹⁶ See the QMSR.
- 28 August 2026. Global ACI-TECH-3-004 and -007 took effect, replacing IAF MD 5 and IAF MD 9, which several top-ranking guides still cite.²²³⁵
9How it runs in Seal.
Seal’s medical device blueprint records traceability as the work is done: protocols are created against requirements, results attach to executions, and risk controls, technical documentation and complaints link to the same records. The design and development file, the medical device file and the record for each device or batch are kept as connected records, whichever names your procedures use.
Audit management runs internal, supplier and system audits from one risk-based programme, and each gap becomes owned follow-up. For a certification audit or an inspection, inspection readiness logs requests, scope, packages, redactions and delivered evidence, and a mock inspection uses the same request log and package workflow as a real one. Neil assembles the evidence behind an auditor’s question and makes missing records explicit; your audit owner checks scope and completeness before anything is shared.
References
- 1Certification, ISO. https:/
/ www. iso. org/ certification. html (read 9 November 2026) - 2ISO 13485:2016, Medical devices, Quality management systems, Requirements for regulatory purposes, edition 3, ISO, March 2016, confirmed 2025. https:/
/ www. iso. org/ standard/ 59752. html (read 9 November 2026) - 3Global ACI-TECH-3-004, Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems, version 1.0, Global ACI, issued 10 July 2026, implemented 28 August 2026, clauses 1.8, 1.9, 2.1, 2.2, 2.3, 4.3, 4.4, 5 and 6. https:/
/ sys. global- aci. org/ uploads/ documents/ Global_ ACI_ TECH- 3- 004_ %28M%29_ v1_ 0. pdf (read 9 November 2026) - 4MDSAP AU P0002.011, MDSAP Audit Approach, Medical Device Single Audit Program, revision date 3 August 2026, MDSAP audit cycle and initial audit. https:/
/ www. mdsap. global/ sites/ default/ files/ 2026- 07/ MDSAP%20AU%20P0002. 011%20MDSAP%20Audit%20Approach. pdf (read 8 November 2026) - 5Global ACI-TECH-3-007, Application of ISO/IEC 17021-1 in the Field of Medical Device Quality Management Systems (ISO 13485), version 1.0, Global ACI, issued 10 July 2026, implemented 28 August 2026, clauses MD 8.2.1, MD 9.1.4, MD 9.1.5, MD 9.2.2.1, MD 9.3.1, MD 9.4.5(a) to (f), MD 9.6.2.2 and MD 9.6.4.2, Table A.1.5 and Annex D. https:/
/ sys. global- aci. org/ uploads/ documents/ Global_ ACI_ TECH- 3- 007_ %28M%29_ v1_ 0. pdf (read 9 November 2026) - 6Common Findings: ISO 13485:2016 Stage 1 Audit, MTF-2031-B Rev 1.0, National Standards Authority of Ireland (NSAI), findings for clauses 4.1.2, 4.1.3, 4.2.1, 4.2.2, 4.2.4, 4.2.5, 5.3, 5.5.2, 5.6, 6.2, 7.1, 7.4, 8.2.1, 8.2.2, 8.2.4 and 8.5.2, and expectations at Stage 1 and Stage 2 for clauses 4.1.5, 5.6 and 8.2.4. https:/
/ www. nsai. ie/ images/ uploads/ general/ MTF- 2031- B. pdf (read 9 November 2026) - 7ISO 13485 certification: a realistic timeline and cost breakdown, Greenlight Guru, 18 August 2026, a vendor’s planning figures. https:/
/ www. greenlight. guru/ blog/ iso- 13485- certification- timeline (read 9 November 2026) - 8How much does ISO 13485 certification cost?, OpenRegulatory, reviewed 19 August 2026, a vendor’s planning model. https:/
/ openregulatory. com/ iso- 13485- certification- cost (read 9 November 2026) - 9Question 36.14, Corrections and corrective actions, European co-operation for Accreditation (EA), September 2018, quoting ISO/IEC 17021-1 on initial certification. https:/
/ european- accreditation. org/ sp_ accordion_ faqs/ question- 36- 14- corrections- and- corrective- actions/ (read 9 November 2026) - 10Guidance Document GD207: Guidance on the Content of ISO 13485 Quality Management System Certificates Issued by Health Canada Recognized Registrars, Health Canada, 14 March 2017, sections 2.1 to 2.6. https:/
/ www. canada. ca/ en/ health- canada/ services/ drugs- health- products/ medical- devices/ quality- systems- 13485/ guidance- document- gd207- guidance- content- 13485- quality- management- system- certificates- issued. html (read 9 November 2026) - 11NSAI MED EU Price List June 2026, MRF-1015 Rev 1.0, National Standards Authority of Ireland (NSAI): fees for MDR and IVDR conformity assessment, effective 1 June 2026, and for ISO 13485 and MDSAP certification, effective 11 November 2024. https:/
/ www. nsai. ie/ images/ uploads/ medical- devices/ MRF- 1015. docx (read 9 November 2026) - 12Regulation (EU) 2017/745 on medical devices, OJ L 117, 5 May 2017, Article 52 and Annex IX, sections 2.3 and 3.4, EUR-Lex. https:/
/ eur- lex. europa. eu/ legal- content/ EN/ TXT/ HTML/ ?uri=CELEX:32017R0745 (read 9 November 2026) - 13Guidance Document: Requirements in the Recognition Process for Medical Device Single Audit Program (MDSAP) Auditing Organizations, Health Canada, sections 1.2 to 1.4. https:/
/ www. canada. ca/ en/ health- canada/ services/ drugs- health- products/ medical- devices/ quality- systems- 13485/ requirements- recognition- process- mdsap- auditing- organizations- profile/ guidance- document. html (read 9 November 2026) - 14MDSAP AU P0008.008, Audit Time Determination Procedure, Medical Device Single Audit Program, effective 13 October 2023, section 5.2. https:/
/ www. mdsap. global/ sites/ default/ files/ 2025- 04/ MDSAP- AU- P0008- 008- Audit- Time- Determination- Procedure. pdf (read 8 November 2026) - 15Applicable Fees and Rates / ISO 13485, valid from 1 April 2026, NEOEMKI. https:/
/ neoemki. hu/ wp- content/ uploads/ 2026/ 04/ Szolgaltatasi- dijak- jegyzeke_ EN_ 26- Apr. pdf (read 9 November 2026) - 16Quality Management System Regulation: Frequently Asked Questions, update of 2 February 2026 and question 13, FDA. https:/
/ www. fda. gov/ medical- devices/ quality- management- system- regulation- qmsr/ quality- management- system- regulation- frequently- asked- questions (read 9 November 2026) - 17Medical Device Single Audit Program (MDSAP), FDA, update of 18 December 2025. https:/
/ www. fda. gov/ medical- devices/ cdrh- international- affairs/ medical- device- single- audit- program- mdsap (read 9 November 2026) - 18Commission Implementing Decision (EU) 2021/1182 on the harmonised standards for medical devices, consolidated text of 17 June 2026, Annex, entry 10, EUR-Lex. https:/
/ eur- lex. europa. eu/ legal- content/ EN/ TXT/ HTML/ ?uri=CELEX:02021D1182- 20260617 (read 9 November 2026) - 19Designated standards: medical devices, notice of publication 0129/26 of 17 January 2026, Annex I, Part 2, row 126, Department of Health and Social Care, GOV.UK. https:/
/ assets. publishing. service. gov. uk/ media/ 696900825fd54abe6531a80f/ ds- 0129- 26- medical- devices- notice. pdf (read 9 November 2026) - 20Regulating medical devices in the UK, MHRA, GOV.UK, updated 20 February 2026, including Northern Ireland. https:/
/ www. gov. uk/ guidance/ regulating- medical- devices- in- the- uk (read 9 November 2026) - 21Government response to the targeted consultation on indefinite recognition of CE marked medical devices, MHRA, GOV.UK, 21 October 2026, proposals 1 and 2a and next steps. https:/
/ assets. publishing. service. gov. uk/ media/ 6ad76f8be9713babfbe3f755/ Government_ response_ to_ the_ targeted_ consultation_ on_ indefinite_ recognition_ of_ CE_ marked_ medical_ devices. pdf (read 9 November 2026) - 22Global ACI, IAF and ILAC Document Cross-Reference Table, version 15.0, Global ACI, 5 November 2026. https:/
/ sys. global- aci. org/ uploads/ documents/ 2026- 11- 05_ Global_ ACI_ IAF_ and_ ILAC_ Document_ Cross- Reference_ Table_ v15_ 02. pdf (read 9 November 2026)
AQuestions and answers
Does ISO issue ISO 13485 certificates?
No. ISO writes the standards but does not certify organisations or issue certificates. Certification bodies do, and accreditation bodies check that those certification bodies work to the relevant international standard.
Can an individual get ISO 13485 certified?
Not to the standard itself. ISO 13485 certification applies to an organisation’s quality management system. People take ISO 13485 training or internal and lead auditor courses, and some personnel certification bodies certify auditors, but that is a certificate of the person’s competence, not of a quality system.
How long does ISO 13485 certification last?
Three years. The body runs a surveillance audit in each of the two years after the initial certification and a recertification audit in the third, before the certificate expires. If it does lapse, accreditation guidance lets the body restore it within six months once the outstanding recertification work is done; after that, at least a new Stage 2 audit is needed.
Does FDA require ISO 13485 certification?
No. Since February 2026 the QMSR has incorporated ISO 13485:2016 by reference, so its requirements apply, but FDA neither requires nor issues certificates, and holding one does not exempt a manufacturer from FDA inspection.
Can ISO 9001 and ISO 13485 be audited together?
Yes. The certification body adds at least 25% to the ISO 13485 audit days, whether it runs one integrated audit or a combined one, and may need more where the scopes or headcounts differ.
Can a Stage 1 audit be done remotely?
Often, at least in part: document review can be done away from your site. For higher-risk devices, such as GHTF classes C and D, the accreditation rules say Stage 1 should be on site. Ask the body how it plans to split remote and on-site time, because most of the calculated audit time should still be spent auditing your operation.