ISO 13485 Certification
The quality management standard for organisations that design, produce, install or service medical devices for regulated markets.
- Standard
- ISO 13485:2016
- Indicative timeline
- 12-20 weeks, depending on scope and readiness
- Discipline
- ISO Standards
- Assessment type
- Independent third-party assessment
The standard
Overview
ISO 13485:2016 sets out quality management system requirements for organisations involved at any stage of the medical device life cycle, from design and production through to storage, distribution, installation and servicing. It keeps a clause structure numbered 4 to 8 rather than the harmonised structure used by newer ISO standards, and places risk management and regulatory obligation at the centre of every process.
Certification shows regulators, distributors and hospital procurement teams that the organisation runs a documented, controlled and traceable quality system. It underpins the quality evidence used in UKCA and CE conformity assessment, although conformity assessment itself is carried out by an Approved Body or notified body and is a separate activity.
UKCert assesses in two stages. Stage 1 reviews the medical device file, risk management records, procedures and the regulatory markets in scope. Stage 2 tests how design controls, process validation, traceability, complaint handling and regulatory reporting work in practice.
Who this is for
- Manufacturers placing medical devices on the UK or export markets
- Contract manufacturers and component suppliers to device makers
- In vitro diagnostic and laboratory device producers
- Developers of software as a medical device
- Sterilisation, distribution, installation and servicing providers
What it gives you
Why organisations certify
What a certified ISO 13485:2016 assessment gives you once the certificate is issued.
Regulatory alignment
Maps quality system evidence to UK Medical Devices Regulations and to the quality requirements applied during UKCA and CE conformity assessment.
Risk-based control
Risk management runs through design, purchasing, production and servicing, so hazards are identified, controlled and reviewed across the whole device life cycle.
Design control discipline
Design planning, verification, validation, transfer and change control are documented, so design decisions can be reconstructed years after a device is released.
Traceability and recall
Batch, lot and serial records make field safety actions, advisory notices and recalls faster to scope and easier to evidence to regulators.
Supply chain access
Device makers, distributors and hospital procurement teams routinely ask suppliers for ISO 13485 certification before awarding contracts or approving new components.
Multi-market recognition
ISO 13485 is the reference quality standard across the UK, EU and other regulated markets, reducing duplicated system work between regulatory submissions.
Scope
What the assessment covers
The areas an assessor works through. Your final scope is confirmed in writing before any audit is booked.
- Medical device file and technical documentation
- Design and development controls, including design transfer
- Risk management integrated with ISO 14971
- Process validation, including sterilisation and software validation
- Cleanliness, contamination and work environment controls
- Traceability records for implantable devices
- Complaint handling and reporting to regulatory authorities
- Supplier evaluation and purchasing verification
How it runs
The assessment, stage by stage
From first enquiry to certificate. Each stage is agreed with you before it starts.
-
Scope and application
We confirm device classes, sites, processes and any non-applicable clauses, then agree audit duration and the regulatory markets the certificate is intended to support.
-
Stage 1 review
A documentation and readiness review of the quality manual, medical device files, risk management records and internal audit results, identifying gaps before the main assessment.
-
Gap closure
You address the Stage 1 findings and confirm readiness. Where preparation is needed, Stage 2 is scheduled to allow the system to generate operating records.
-
Stage 2 assessment
Auditors test implementation across design, production, servicing and post-market activities, interviewing staff and sampling records at each site included in the scope.
-
Certification decision
Nonconformities are graded major or minor. Once corrections and corrective actions are accepted, an independent reviewer takes the certification decision and the certificate is issued.
-
Surveillance and recertification
Surveillance audits are carried out annually against a sampled programme. A full recertification audit covers the whole system before the three-year certificate expires.
Questions
ISO 13485:2016 — frequently asked
Anything here that does not cover your situation, put it to an assessor rather than guessing at it.
Same discipline
Other schemes in ISO Standards
Certifying against more than one standard?
Where you hold several standards, shared clauses are assessed once in a combined visit rather than as separate audits. Talk it through with an assessor before you decide what ISO 13485:2016 should sit alongside.