ISO 13485:2016 Certification Consultants for Medical Devices

ISO 13485 certification demonstrates that a medical device or IVD organisation runs a quality management system built for regulatory purposes. Medfins International helps manufacturers, contract manufacturers, importers and service providers design a practical ISO 13485:2016 QMS, implement it across the business and prepare for a certification body audit, while aligning it with CDSCO, EU MDR and US FDA requirements.

What is ISO 13485:2016?

ISO 13485:2016, Medical devices – Quality management systems – Requirements for regulatory purposes, sets out the requirements for a QMS used by organisations involved in any stage of a medical device life cycle. Unlike ISO 9001, it focuses on regulatory compliance, risk-based control, documented processes and the safety and performance of devices rather than continual customer satisfaction alone.

The standard was last reviewed and confirmed by ISO in 2025, so the 2016 edition remains current. In Europe it is published as EN ISO 13485:2016, and the A11:2021 amendment added the annexes (Z annexes) that relate its clauses to the EU MDR 2017/745 and IVDR 2017/746. The core ISO text itself has not changed.

Why ISO 13485 certification matters

An ISO 13485 QMS is now the common language of medical device regulators worldwide:

• India: the Medical Devices Rules, 2017 require manufacturers to comply with the quality management system set out in the Fifth Schedule, which closely follows ISO 13485. CDSCO and State Licensing Authorities check this during manufacturing licence audits.
• United States: the FDA Quality Management System Regulation (QMSR, 21 CFR Part 820), effective 2 February 2026, incorporates ISO 13485:2016 by reference, with some additional FDA-specific requirements.
• European Union: manufacturers use EN ISO 13485 to show conformity with the QMS requirements of the EU MDR and IVDR.
• Other markets: many regulators in Asia, the Middle East and Africa ask for an ISO 13485 certificate as part of a registration dossier.

Tenders, distributors and OEM customers also increasingly treat ISO 13485 certification as a minimum requirement.

Who needs ISO 13485?

• Medical device and IVD manufacturers, including start-ups preparing for a first CDSCO licence
• Contract manufacturers, sterilisation providers and component suppliers to device companies
• Software as a medical device (SaMD) developers
• Importers, distributors and service organisations that want a certified QMS for storage, distribution, installation or servicing

Scope and linked standards

ISO 13485 works alongside other standards that auditors expect to see reflected in your QMS:

• ISO 14971:2019 for risk management across design, production and post-market activities
• IEC 62304 for medical device software life-cycle processes, where software is involved
• IEC 62366-1 for usability engineering
• Product-specific standards for sterilisation, biocompatibility and electrical safety, where relevant

Clauses 6, 7 and 8 may be excluded or marked not applicable only where justified, for example design and development (7.3) for an organisation that does not design devices. Justifications must be documented in the quality manual.

Documents typically required

• Quality policy, quality objectives and quality manual
• Documented procedures required by the standard, such as document and record control, internal audit, CAPA, nonconforming product, complaint handling and purchasing
• Medical device files (technical files) for each device type or family
• Risk management files to ISO 14971
• Design and development files, process validation and sterilisation validation records where applicable
• Supplier evaluation records, training records and management review minutes

Our ISO 13485 certification process

1. Gap analysis: we review your current processes, products and regulatory markets against ISO 13485 and applicable regulations.
2. Project plan: we agree scope, responsibilities and target audit dates with your management team.
3. Documentation: we draft or revise the quality manual, procedures, forms and work instructions to reflect how your organisation actually works.
4. Implementation and training: your teams use the system, generate records and learn their responsibilities.
5. Internal audit and management review: a full internal audit cycle and management review are completed before certification.
6. Certification body selection: we help you choose an accredited certification body suited to your markets.
7. Stage 1 and Stage 2 audits: we support you through the documentation review and the on-site certification audit, and help close any findings.
8. Maintenance: annual surveillance audits and recertification every three years.

Timelines and what affects them

There is no fixed timeline for ISO 13485 certification. The duration typically depends on:

• The number and risk class of devices, and whether design is in scope
• How much of the QMS already exists and is in use
• Availability of process and sterilisation validation data
• Enough operating records to show the system is implemented, not just written
• Certification body scheduling

Common reasons for audit findings

• Procedures copied from templates that do not match actual practice
• Risk management treated as a one-off document rather than a live process
• Weak supplier controls for critical suppliers and outsourced processes
• CAPA records without effective root cause analysis or effectiveness checks
• Regulatory requirements, such as vigilance and complaint reporting, not built into procedures

ISO 13485 and CDSCO licensing

For Indian manufacturers, ISO 13485 work and licensing work overlap. The Plant Master File, the Device Master File and the audit by the licensing authority all draw on the same QMS evidence. Building both together avoids duplicate documents and conflicting versions.

How Medfins International supports you

Our work is led by Mr. Arunkumar Chokkalingam, a CQI and IRCA certified ISO 13485 Lead Auditor, so your system is built from an auditor’s point of view. We write documents that fit your size and operations, and we connect the QMS directly to your regulatory submissions, including the CDSCO manufacturing licence, CE marking under EU MDR / IVDR and MDSAP certification.

Before your certification audit we can run an independent pre-assessment through our internal audit support service. To discuss your ISO 13485 project, contact our team.

Frequently asked questions