ISO 13485 Certification in the U.S.

ISO 13485:2016 is the international standard for quality management systems (QMS) for organizations involved in medical devices and related services. It sets requirements for consistently meeting applicable customer and regulatory requirements across activities such as design and development, production, distribution, installation, and servicing. The standard emphasizes documented processes, risk-based controls, traceability, and the effectiveness of the quality management system.

ISO 13485 is relevant to medical device manufacturers, contract manufacturers, and certain suppliers or service providers. Its requirements should be applied according to the organization's role, the medical devices and services involved, and the scope of its QMS. Controls for design, sterile production, software, outsourced processes, and product traceability depend on the activities performed and the applicable regulatory environment.

ISO 13485 certification means that an independent certification body has audited the organization's QMS against the standard and made a positive certification decision for a defined scope. It is not a product approval, FDA clearance, or authorization to place a medical device on the U.S. market. A certificate also does not replace applicable FDA requirements, inspections, or market-specific regulatory obligations.

As of October 2026, ISO 13485:2016 remains the current international edition. ISO confirmed it in 2025. There is no published ISO 13485:2026 edition or universal transition deadline to a new edition.

For medical device companies operating in the United States, ISO 13485 certification, FDA QMSR compliance, and MDSAP auditing are related but distinct. They can support a coordinated quality management approach, but they serve different purposes and should not be treated as interchangeable.

ISO 13485 certification is a third-party assessment of a medical device quality management system against the international standard. It is often used to demonstrate QMS maturity to customers, distributors, and international partners. Whether a company needs a certificate depends on its business relationships and applicable market requirements.

FDA Quality Management System Regulation (QMSR) is a binding U.S. regulatory framework under 21 CFR Part 820. It became effective on February 2, 2026 and incorporates ISO 13485:2016 by reference while retaining additional FDA-specific requirements. The FDA can inspect applicable manufacturers for compliance. An ISO 13485 certificate does not establish FDA compliance or substitute for an FDA inspection, device clearance, or approval. See the FDA QMSR overview and the FDA's QMSR FAQs.

MDSAP (Medical Device Single Audit Program) allows audits by recognized auditing organizations against requirements of participating medical device regulators. It is a distinct regulatory audit program, even though ISO 13485 forms part of the underlying QMS framework. A conventional ISO 13485 certification body is not necessarily an MDSAP-recognized auditing organization. Learn more from the FDA's official MDSAP overview.

Before requesting quotes, determine whether you need an accredited ISO 13485 certificate, a regulatory MDSAP audit, or both. If your goal is U.S. market access, confirm applicable FDA obligations separately; certification alone does not replace them.

ISO 13485 certification is particularly relevant to organizations that design, manufacture, assemble, package, sterilize, distribute, install, or service medical devices. Medical device startups, established manufacturers, contract manufacturers, component suppliers, software-related device businesses, and outsourced service providers may pursue certification to meet customer expectations, strengthen supplier qualification, or support operations in multiple markets.

The need for certification varies by the company's role and target markets. A company developing an implantable device has different QMS processes, regulatory responsibilities, and audit risks from a distributor or a supplier of non-sterile components. Not every activity requires every ISO 13485 requirement to be applied in the same way; the proposed certification scope must accurately reflect the organization's activities.

In the United States, FDA QMSR obligations may apply independently of whether a company has a voluntary ISO 13485 certificate. Organizations should clarify their device categories, design and manufacturing responsibilities, outsourced processes, and customer requirements before choosing a certification body.

Before scheduling an ISO 13485 certification audit, confirm that the QMS has been implemented and is supported by objective evidence. The exact documentation and controls depend on the activities included in your scope, the medical devices involved, and applicable regulatory requirements.

Check that your organization has:

• defined the QMS scope, sites, medical device categories, and outsourced activities;
• established a quality policy, measurable objectives, process responsibilities, and a quality manual as applicable;
• identified relevant regulatory requirements and defined how they are incorporated into QMS processes;
• documented product realization, design and development controls where applicable, and risk management throughout relevant processes;
• established purchasing controls and evaluation of critical suppliers and outsourced processes;
• validated processes where outputs cannot be fully verified, including sterilization or software applications where applicable;
• implemented identification, traceability, labeling, preservation, and record retention controls appropriate to the devices;
• established complaint handling, feedback, nonconformity, corrective action, and applicable regulatory reporting processes;
• retained operational evidence demonstrating that the QMS is implemented and controlled;
• completed internal audits, management review, and follow-up on identified issues.

Use this list as an initial readiness check, not as a substitute for reviewing the full text of ISO 13485:2016 and applicable FDA obligations.

The cost of ISO 13485 certification in the United States depends on the number of personnel and sites, the certified activities, device categories, regulatory environment, and the complexity of medical device processes. Audit time may increase when the scope includes design and development, sterile production, process validation, outsourced manufacturing, or several product families.

For illustrative 2026 budgeting, initial Stage 1 and Stage 2 certification body audit fees may be approximately $7,000–$15,000 for a small, single-site organization with a relatively straightforward scope; $12,000–$30,000 for a small or medium-sized company with more complex medical device activities; and $30,000–$65,000 or more for large, multi-site, or highly complex operations. These estimates are planning assumptions, not independently verified U.S. market averages or official ISO, FDA, or ANAB rates.

These figures cover certification body audit fees only. They exclude implementing the QMS, regulatory consulting, design and process validation, testing, sterilization qualification, personnel training, supplier remediation, and FDA submission or registration expenses. They also do not represent MDSAP program pricing, which should be quoted separately.

Certification typically follows a three-year cycle with surveillance audits between initial certification and recertification. For smaller organizations, annual surveillance audit fees might be around $3,000–$10,000 as an illustrative planning range. Compare the entire certification-cycle cost, including travel, application fees, follow-up audits, and surveillance.

The certification timeline depends on the readiness of your medical device quality management system, the activities included in the audit, and the certification body's availability. If your QMS is already implemented and audit-ready, certification may take approximately 8–16 weeks after engaging a certification body. This planning window covers audit scheduling, Stage 1 and Stage 2, any necessary correction of findings, and the independent certification decision.

Organizations developing a QMS from the beginning typically need more time to define scope, establish design and purchasing controls, implement risk management, validate processes where necessary, collect operating records, and complete internal audits and management review. A relatively straightforward organization may need 6–12 months for the overall implementation and certification project.

Manufacturers of complex or sterile medical devices, businesses with multiple locations, or organizations relying on extensive outsourced production may require 9–18 months or longer. These ranges are estimates, not guaranteed completion dates. Device approval timelines, FDA submissions, and MDSAP audits are separate and may take additional time. If certification is tied to a customer or supply-chain deadline, tell prospective certification bodies when requesting quotes.

Accreditation is an important factor when choosing an ISO 13485 certification body. While a certification body audits a medical device company's quality management system (QMS) and decides whether certification can be issued, an accreditation body independently evaluates the certification body's competence, impartiality, and compliance with applicable requirements.

ISO 13485 certification requires specialized auditor competence. Auditors may need expertise in medical device categories, design controls, risk management, process validation, sterilization, traceability, outsourced operations, and applicable regulatory requirements. In addition to ISO/IEC 17021-1, certification bodies must meet the sector-specific requirements established in Global ACI-TECH-3-007, which corresponds to the former IAF MD 9:2023.

Before selecting a certification body, verify that its accreditation is valid and explicitly covers ISO 13485 certification. Also confirm that its technical scope and auditors' experience match your medical devices and manufacturing activities. ANAB is a major U.S. accreditation body, although accreditation from other internationally recognized bodies may also be acceptable depending on customer and regulatory requirements.

You can verify ANAB-accredited providers through the official ANAB Directory of Accredited Management Systems Certification Bodies. Since accreditation status and scope may change, always check these details before signing a contract.

Accredited ISO 13485 certification is not the same as MDSAP recognition or FDA authorization. If you require an MDSAP audit, confirm separately that the provider is recognized under the program. Finally, ensure that the resulting certificate identifies the correct edition of ISO 13485 and accurately describes your organization's certified QMS scope.

When comparing ISO 13485 certification bodies, do not choose solely on the lowest audit fee. Medical device quality management systems may involve significant regulatory, safety, and technical complexity, so auditor competence and the provider's accreditation scope are especially important.

Review the following factors:

• current ISO 13485 accreditation status and coverage of your relevant technical activities;
• auditors' experience with your medical device categories and regulatory context;
• competence in design controls, process validation, sterilization, and software where applicable;
• the proposed Stage 1 and Stage 2 audit duration, methodology, and scheduling;
• how outsourced manufacturers, critical suppliers, and multi-site arrangements are addressed;
• the full three-year cost, including surveillance, recertification, travel, and follow-up fees;
• whether MDSAP services are needed and, if so, separately supported by the provider;
• clarity of the proposed certification scope, deliverables, and contract terms.

The best choice is the certification body whose competence, accreditation, audit program, and overall costs match your organization's actual products and processes. Audit Advisor lets you request proposals from up to five selected providers and compare them without an obligation to buy.