ISO 13485 Quality Management System for EU MDR and FDA QMSR

A quality management system compliant with ISO 13485 is the foundation for conformity and market access for manufacturers of medical devices. Every manufacturer that places products on the market in the EU must establish and implement a QMS.

Since February 2, 2026, the FDA Quality Management System Regulation (QMSR) incorporates ISO 13485:2016 by reference into 21 CFR Part 820. For U.S. medical device manufacturers, a quality management system built on ISO 13485 is therefore the basis for FDA compliance, for CE marking under the EU MDR and for markets that rely on the Medical Device Single Audit Program (MDSAP).

The QMS itself is mandatory, ISO 13485 certification is not. The FDA does not require a certificate and inspects your system regardless of whether you hold one. In the EU, a Notified Body audits your QMS as part of the conformity assessment for most device classes.

We support manufacturers of medical devices and in vitro diagnostics in building, certifying and maintaining a QMS that meets ISO 13485, the QMSR and the EU MDR or IVDR: from the gap assessment through the QMS documentation to audit and inspection readiness.

What is ISO 13485?

ISO 13485 is the international standard for quality management systems of organizations that design, manufacture, store, distribute or service medical devices. The current edition is ISO 13485:2016. It is structured in clauses 4 to 8: quality management system, management responsibility, resource management, product realization, and measurement, analysis and improvement. Unlike ISO 9001:2015, it does not follow the High Level Structure. Its focus is device safety, regulatory requirements and documented evidence, not customer satisfaction as a goal of its own.

Regulators on several continents use the standard as their reference. The FDA has incorporated it into the QMSR. In the EU, EN ISO 13485:2016/A11:2021 is a harmonized standard under the MDR and IVDR, and its Annexes ZA and ZB show which regulatory requirements it covers. MDSAP uses ISO 13485 as the audit basis for Australia, Brazil, Canada, Japan and the United States. See also our overview of international approvals.

Is ISO 13485 mandatory for medical device manufacturers?

In the European Union

Article 10(9) of the EU MDR and Article 10(8) of the IVDR require every manufacturer to establish, document, implement and maintain a QMS, for all risk classes including Class I. For Class IIa, IIb and III devices, a Notified Body assesses the QMS, typically under Annex IX MDR. Class I manufacturers declare conformity themselves.

A Notified Body is involved only for sterile devices (Is), devices with a measuring function (Im) and reusable surgical instruments (Ir), limited to those aspects. Manufacturers outside the EU also need an EU authorized representative under Article 11 MDR.

See medical devices in the EU market and risk classification.

In the United States

Manufacturers of finished devices intended for commercial distribution in the U.S. must establish and maintain a QMS that meets the QMSR, 21 CFR 820.10. Because the QMSR incorporates ISO 13485, the clauses of the standard are now FDA requirements. An ISO 13485 certificate does not exempt you from FDA inspections, and the FDA does not issue ISO 13485 certificates.

When the FDA reviews your QMS depends on the pathway. For a 510(k), the FDA generally does not inspect before clearance, but your system must be in place once you distribute the device. For a PMA, a preapproval inspection is part of the process. Many Class I devices are exempt from most QMSR requirements, but typically not from complaint handling and record keeping. The exemptions are listed in the respective classification regulation.

How does WQS implement ISO 13485 within its own organization?

Certification body: TÜV NORD Polska
Recertified: Oktober 2026
Valid until: 30.09.2029

WQS Management Consultants operates under a quality management system certified to ISO 13485. In October 2026, TÜV NORD Polska reaffirmed this certification. The scope of certification is divided into two certificates: The first covers consulting on quality management and regulatory affairs as well as contract storage and packaging of medical devices. The second covers contract shipping and falls outside the scope of accreditation.

The requirements we implement when setting up your QM system apply to us in exactly the same way. Document control, internal audits, CAPA, supplier evaluation, and management review are part of our daily work, and we demonstrate compliance with these requirements to the certification body during every surveillance audit. This experience gained from our role as an audited company flows directly into your project: from the gap analysis and process descriptions to the preparation for the certification audit by your Notified Body.

What does the EU MDR add to ISO 13485?

EN ISO 13485 covers most QMS requirements of the MDR, but not all. Annex ZA of EN ISO 13485:2016/A11:2021 shows the gaps. Under Article 10(9) MDR, your QMS must also address:

a strategy for regulatory compliance, incl. conformity assessment procedures and management of changes
identification of the applicable general safety and performance requirements under Annex I
clinical evaluation under Article 61 and Annex XIV, including PMCF
the post-market surveillance system under Art. 83 etc.
UDI assignment and registration under Articles 27 & 29
reporting of serious incidents and field safety corrective actions under Article 87
communication with competent authorities, Notified Bodies and other economic operators

In addition, Article 15 MDR requires a person responsible for regulatory compliance (PRRC). For U.S. manufacturers, this means that the QMS you use for FDA purposes is the starting point for CE marking, and the EU-specific elements connect it to your technical documentation.

How does the FDA QMSR differ from ISO 13485?

The QMSR adopts ISO 13485 as its core, but keeps FDA-specific requirements. A QMS that meets the standard alone is not QMSR compliant. The main additions are:

control of records with additional content for complaint records, servicing records and UDI (21 CFR 820.35)
device labeling and packaging controls, including inspection of labeling before release (21 CFR 820.45)
FDA definitions that take precedence over ISO terminology where they conflict (21 CFR 820.3)
continued obligations under related parts: medical device reporting (Part 803), corrections and removals (Part 806) and UDI (Part 830)

Under the new Quality System Regulation, management review, internal audit and supplier audit reports are no longer exempt from FDA inspection. These records now serve as evidence for both your certification body and the FDA. The QMSR replaces the terms DMR, DHF and DHR with the medical device file of ISO 13485.

More on risk management under the QMSR on our page Risk Management under QMSR.

What are the requirements of ISO 13485?

A QMS under ISO 13485 has to be implemented, not just described. Auditors and FDA investigators therefore review records, not statements of intent. The core elements include:

documented processes and control of documents and records (clause 4.2)
management responsibility with quality policy, quality objectives and management review (clause 5)
competence, training and evaluation of training effectiveness (clause 6.2)
risk management throughout the product lifecycle, in practice according to ISO 14971 (clause 7.1)

design and development, purchasing with supplier evaluation, and production (clauses 7.3 to 7.5)
traceability and validation of processes and of software used in the QMS (clauses 4.1.6 and 7.5)
feedback, complaint handling and reporting to regulatory authorities (clauses 8.2.1 to 8.2.3)
internal audits, control of nonconforming product and corrective and preventive action (CAPA) (clauses 8.2.4, 8.3 and 8.5)

The scope depends on your company and your devices. Requirements that do not apply to your activities, such as design and development, can be excluded if regulatory requirements allow it and the justification is documented in the quality manual.

How do you implement ISO 13485 and get certified?

Implementing a QMS under ISO 13485 means turning existing practices into documented processes and applying them long enough to generate records. The following sequence has proven effective:

1. Gap assessment

We assess your current system against ISO 13485, the FDA QMSR or the QMS requirements of the EU MDR or IVDR. Gaps are prioritized by audit relevance and turned into a schedule.

2. Build or adapt the QMS

Process map, responsibilities and interfaces are defined. Existing procedures stay in place wherever they already meet the requirements.

3. Create the documentation

The quality manual, procedures and forms, and the medical device file are prepared according to the requirements of your company’s size and the class of your device.

4. Train your team

Employees are trained on the processes relevant to their role. Training effectiveness is evaluated and documented.

5. Internal audit and management review

A complete internal audit cycle and a management review produce the records that demonstrate the system is in use. Under the QMSR, FDA investigators can now review these records as well.

6. Audit and inspection readiness

A mock audit shows the remaining weak points. We support the selection of the certification body or Notified Body and manage communication with it.

7. Certification audit

In Stage 1 the certification body reviews documentation and audit readiness, in Stage 2 the implementation on site. The certificate is issued once the nonconformities are closed.

An ISO 13485 certificate from a certification body is typically valid for three years and is maintained through annual surveillance audits, followed by recertification. A QMS certificate issued by a Notified Body under Annex IX MDR is valid for a maximum of five years (Article 56(2) MDR).

What happens after audit nonconformities or FDA 483 observations?

In a certification audit, the auditor records a nonconformity when a requirement is not met. Major nonconformities question the effectiveness of the system or device safety. Minor nonconformities concern a limited gap. Major nonconformities must be closed before the certificate is issued. For minor ones, an accepted action plan is usually sufficient. The certification body sets the deadlines.

In an FDA inspection, observations are listed on Form FDA 483. A response within 15 business days is not legally required, but the FDA considers timely responses before deciding on further action such as a warning letter.

In both cases, a finding is closed when the root cause is eliminated and effectiveness is verified. This requires a root cause analysis, a CAPA plan with responsibilities and dates, and documented effectiveness checks.

For Notified Body findings on the technical documentation, see non-conformities in the EU MDR report.

How does WQS support your ISO 13485 QMS?

Since 1993, we have supported manufacturers of medical devices and in vitro diagnostics through conformity assessments, from the MDD to today’s MDR and IVDR. With offices in Hamm, Germany, and St. Petersburg, Florida, we connect FDA and EU requirements in one system. We scale our ISO 13485 consulting to your company size, device portfolio and risk class.

ISO 13485 gap analysis for QMSR and EU MDR

We identify the evidence your current system is missing and define the steps to certification readiness for the U.S. and EU markets.

QMS setup and documentation

We build your QMS or adapt it to the QMSR and the EU MDR: process map, quality manual, procedures, forms and medical device file.

Internal audits, training and audit readiness

We conduct internal audits, train your employees and internal auditors and prepare you for the certification audit or FDA inspection with a mock audit.

Nonconformities, 483 observations and CAPA

We analyze audit findings and 483 observations, draft the action plan and support effectiveness verification until the finding is closed.

Quality Management• ISO 13485

Prepare for ISO 13485 certification

ISO 13485 is the basis for conformity and market access in nearly every target market. We bring your system to certification readiness.

Frequently Asked Questions

Quality Management System acording to ISO 13485 Compliance

What is the purpose of ISO 13485 in the Medical Device Industry?

ISO 13485 provides a structured framework for implementing a Quality Management System (QMS) specific to medical devices, ensuring consistent product quality, safety and regulatory compliance throughout the product lifecycle.

Is the ISO 13485 Certification mandatory under the EU MDR?

No, ISO 13485 certification is not legally required for CE Marking under the MDR. However, it is strongly recommended and widely used by Notified Bodies as supporting evidence in the conformity assessment process.

Is ISO 13485 certification required by the FDA?

Since February 2, 2026, the QMSR incorporates ISO 13485:2016 by reference into 21 CFR Part 820, so its requirements are mandatory for manufacturers distributing finished devices in the U.S. A certificate is not required, and the FDA inspects your QMS regardless of whether you hold one.

How can WQS support my ISO 13485 Certification?

WQS offers end-to-end support including gap assessments, QMS design and documentation, internal audits, training, and coordination with Notified Bodies. We tailor our services to your size, structure and product risk class.

What is the difference between the QMSR and ISO 13485?

The QMSR adopts ISO 13485 as its core and adds FDA-specific requirements, including control of records for complaints, servicing and UDI (21 CFR 820.35) and labeling and packaging controls (21 CFR 820.45). FDA definitions take precedence where terms conflict, and Parts 803, 806 and 830 continue to apply.

Do I need ISO 13485 to sell medical devices in the EU?

You need a QMS under Article 10(9) MDR or Article 10(8) IVDR, for all risk classes. Certification to ISO 13485 is not legally required, but EN ISO 13485 is the harmonized standard Notified Bodies use as their benchmark. The MDR adds requirements such as a regulatory compliance strategy, UDI, post-market surveillance, vigilance and a PRRC.

Does a Class I medical device need ISO 13485?

In the EU, Class I manufacturers need a QMS under Article 10(9) MDR but declare conformity without a Notified Body, except for sterile, measuring and reusable surgical devices. In the U.S., many Class I devices are exempt from most QMSR requirements, typically except complaint handling and record keeping. The exemptions are listed in the classification regulations.

How long does ISO 13485 certification take?

It depends on company size, device portfolio and starting point. Without an existing QMS, plan several months until the certification audit, because records from actual practice must be available, including an internal audit and a management review. Lead times of the certification body or Notified Body come on top.

How long is an ISO 13485 certificate valid?

An ISO 13485 certificate is typically valid for three years. It is maintained through annual surveillance audits and renewed in a recertification audit before it expires. A QMS certificate from a Notified Body under Annex IX MDR is valid for a maximum of five years.

How much does ISO 13485 certification cost?

Costs consist of the certification body’s audit fees, the internal effort for building and maintaining the system and, where needed, external consulting. Audit duration and fees depend on the number of employees, sites and the complexity of your processes. A reliable estimate is possible after a gap assessment.

Weiterführende Links

European Parliament & Council of the EU: Regulation (EU) 2017/745 on medical devices (MDR), May 5, 2017 – eur-lex.europa.eu
European Parliament & Council of the EU: Regulation (EU) 2017/746 on in vitro diagnostic medical devices (IVDR), April 5, 2017 – eur-lex.europa.eu

European Parliament & Council of the EU: Implementing Decision (EU) 2021/1182 (harmonized standards for the MDR), July 16, 2021 – eur-lex.europa.eu
European Parliament & Council of the EU: Implementing Decision (EU) 2021/1195 (harmonized standards for the IVDR), July 19, 2021 – eur-lex.europa.eu
DIN Media: ISO 13485:2016 (paid standard) – dinmedia.de
FDA: Quality Management System Regulation, Final Rule, Federal Register, February 2, 2024 – federalregister.gov
21 CFR Part 820 (current version) – ecfr.gov
FDA: Quality Management System Regulation (QMSR), February 2, 2026 – fda.gov