ISO 13485 Certification Process: Steps, Timeline & Audits
We take medical device and IVD manufacturers through every step of ISO 13485 certification, from gap analysis and QMS documentation to internal audit, Stage 1 and Stage 2 audits and annual surveillance.
What does ISO 13485 certification involve?
ISO 13485:2016 is the international standard for quality management systems for medical devices and IVDs. Certification means an accredited certification body has audited your QMS and confirmed it meets the standard.
It is the foundation for CE marking under EU MDR and IVDR, the FDA QMSR, MDSAP and most other markets. The European version, EN ISO 13485:2016+A11:2021, is the harmonised standard under MDR and IVDR.
What ISO 13485 requires, clause by clause
Clauses 4 to 8 contain the requirements your QMS must meet.
| Clause | Covers | Key evidence auditors ask for |
|---|---|---|
| 4. Quality management system | QMS scope, processes, documentation, records, software validation | Quality manual, process map, document and record control |
| 5. Management responsibility | Quality policy, objectives, roles, management review | Signed policy, measurable objectives, review minutes |
| 6. Resource management | People, competence, infrastructure, work environment | Training records, maintenance, cleanliness controls |
| 7. Product realisation | Planning, design and development, purchasing, production, traceability | Design history, supplier approvals, validated processes, device records |
| 8. Measurement, analysis & improvement | Feedback, complaints, internal audit, nonconforming product, CAPA | Complaint files, audit reports, CAPA records, data analysis |
The ISO 13485 certification process, step by step
This is how we take you from where you are today to a certificate.
- 1
Gap analysis
Week 1–2We compare your current processes and documents with ISO 13485 and your target markets.
- 2
Plan & scope
ScopeWe define the QMS scope, any exclusions and a realistic project plan.
- 3
Documentation
Manual · proceduresWe write the quality manual, required procedures, work instructions and forms.
- 4
Implementation & training
RecordsWe train your team and help run the processes so you build records before the audit.
- 5
Internal audit & management review
ReadinessWe audit the full QMS, run management review and close any findings.
- 6
Stage 1 audit
Certification bodyThe auditor reviews your documentation and readiness. We prepare you and answer findings.
- 7
Stage 2 audit
On siteThe auditor checks implementation. We support you on the day and with any CAPA.
- 8
Certificate & surveillance
3-year cycleYou receive the certificate. We support annual surveillance audits and recertification.
Typical ISO 13485 certification timeline
Durations are typical for a small to mid-sized manufacturer and depend on product complexity and certification body availability.
| Phase | Typical duration | Output |
|---|---|---|
| Gap analysis | 1–2 weeks | Gap report and project plan |
| Documentation | 4–8 weeks | Quality manual, procedures and forms |
| Implementation | 6–10 weeks | Training records and process records |
| Internal audit & management review | 1–2 weeks | Audit report, review minutes, closed findings |
| Stage 1 and Stage 2 audits | 4–8 weeks, subject to auditor scheduling | Certificate once findings are closed |
Common ISO 13485 audit findings
Our ISO 13485 services
ISO 13485 certification process FAQs
How long does the ISO 13485 certification process take?
For a small to mid-sized manufacturer starting from scratch, it typically takes 4 to 6 months: around 2 to 3 months to document and implement the QMS, time to build up records, then the Stage 1 and Stage 2 audits.
What is the difference between a Stage 1 and Stage 2 audit?
Stage 1 checks your documentation and readiness: scope, quality manual, procedures and whether you are ready for the full audit. Stage 2 checks that the QMS is implemented and effective, through interviews, records and site observation.
How long is an ISO 13485 certificate valid?
Three years. The certification body runs surveillance audits every year, and a recertification audit before the certificate expires.
Does ISO 13485 certification mean my device is CE marked?
No. ISO 13485 certifies your quality management system, not your product. CE marking also needs technical documentation and, for most classes, a Notified Body assessment under EU MDR or IVDR.
How is ISO 13485 different from ISO 9001?
ISO 13485 is built for medical devices. It puts more weight on regulatory requirements, risk management, design controls, traceability, sterile products and documented records, and does not focus on customer satisfaction and continual improvement in the way ISO 9001 does.
Who can issue an ISO 13485 certificate?
An accredited certification body, ideally accredited by a national body that is a member of the IAF. If you also need MDSAP, choose an MDSAP-recognised auditing organisation so one audit covers both.
Ready to start your ISO 13485 certification?
Send us your details using the form below and we'll run a free gap check against ISO 13485.
