Sector-specific · ISO 13485:2016
ISO 13485 certificationMedical Devices Quality Management
ISO 13485:2016 medical device quality management system certification for UK manufacturers, suppliers and service providers in the device life cycle.
- Supports regulatory submissions
- Supply chain requirements
- Risk management throughout
- Validated processes
Overview
What is ISO 13485:2016?
ISO 13485:2016 specifies requirements for a quality management system where an organisation needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements. It applies to manufacturers and to organisations involved in other stages of the device life cycle, such as design, distribution, installation, servicing, sterilisation and component supply. The standard places particular emphasis on risk management, process validation, traceability and regulatory reporting.
Unlike most management system standards, ISO 13485 does not use the Harmonized Structure. Its requirements sit in clauses 4 to 8, covering the quality management system, management responsibility, resource management, product realisation, and measurement, analysis and improvement. Hexa Certifications Limited carries out independent third-party certification audits against ISO 13485. In line with ISO/IEC 17021-1 we do not write quality manuals, procedures or technical documentation for clients. An optional pre-assessment is available before the formal audit.
In the UK, medical devices placed on the Great Britain market are regulated by the MHRA under the UK Medical Devices Regulations 2002, with UKCA marking and, for higher-class devices, conformity assessment by a UK Approved Body. ISO 13485 is widely used to demonstrate the quality management system aspects of those requirements. However, ISO 13485 certification from Hexa is not a UKCA or CE conformity assessment and does not by itself permit a device to be placed on the market.
Who it is for
Organisations that choose ISO 13485
- Medical device manufacturers, including those making Class I devices
- Contract manufacturers and component or subassembly suppliers
- Sterilisation, cleaning and packaging service providers
- Medical device distributors, importers and service organisations
- Software developers producing software as a medical device
- Calibration, maintenance and installation providers for medical equipment
Benefits
What ISO 13485 certification does for you
Supports regulatory submissions
Regulators and conformity assessment bodies expect manufacturers to operate a quality management system. ISO 13485 is the internationally recognised framework for that system and supports wider regulatory work.
Supply chain requirements
Device manufacturers commonly require critical suppliers, such as component makers, contract manufacturers and sterilisers, to hold ISO 13485 certification as part of their documented supplier controls.
Risk management throughout
The standard requires a risk-based approach to processes and documented risk management in product realisation, normally using ISO 14971, so safety is considered at each stage.
Validated processes
Requirements for process validation, sterile processing and software validation help make sure outputs that cannot be fully verified afterwards are produced consistently, safely and to the required specification.
Traceability and recall readiness
Identification, traceability and records requirements, which are stricter for implantable devices, support effective field safety corrective actions and recalls if they are needed after devices reach the market.
Structured complaint handling
ISO 13485 requires documented complaint handling, feedback processes and reporting to regulatory authorities, helping you identify safety issues early and meet vigilance and post-market obligations in good time.
Requirements
What the auditor will assess
The main clauses of ISO 13485:2016 and what each one asks of your organisation.
Clause 4
Quality management system
Document the role of the organisation under applicable regulations, apply a risk-based approach, control outsourced processes, validate QMS software and maintain a medical device file for each device type or family.
Clause 5
Management responsibility
Top management commits to the QMS and regulatory requirements, sets quality policy and objectives, appoints a management representative and conducts documented management reviews.
Clause 6
Resource management
Provide resources, ensure competence and effectiveness of training, and control infrastructure, work environment and contamination where these can affect product conformity.
Clause 7.1 to 7.3
Planning, customer and design
Plan product realisation with documented risk management, determine product and regulatory requirements, and control design and development, including verification, validation, transfer and design changes.
Clause 7.4
Purchasing
Evaluate and select suppliers based on their ability to meet requirements and the risk associated with the product, and verify purchased product.
Clause 7.5
Production and service provision
Control production, cleanliness, installation and servicing, validate special processes and sterilisation, and maintain identification, traceability and preservation of product.
Clause 8.2
Feedback, complaints and reporting
Gather and analyse feedback, handle complaints in a documented and timely manner, report to regulatory authorities where required and conduct internal audits.
Clause 8.3 to 8.5
Nonconformity and improvement
Control nonconforming product, including after delivery, issue advisory notices, analyse data, and take corrective and preventive action without undue delay.
Audit evidence
What we will ask to see
Auditors sample records and talk to people doing the work. Having these ready makes Stage 2 smoother and faster.
- Quality manual describing scope, exclusions and justifications, and process interactions
- Medical device files or technical documentation references
- Risk management files linked to product realisation
- Design and development records, including verification, validation and transfer
- Process and software validation records, including sterilisation where applicable
- Supplier evaluation, approval and monitoring records
- Complaint files, regulatory reports and advisory notices
- Internal audits, management reviews and CAPA records
Process
Your route to ISO 13485 certification
- 1
Application and quotation
You tell us your scope, sites, headcount and standards. We calculate audit duration using the accreditation rules and send a fixed quotation for the full three-year cycle.
- 2
Stage 1 audit
Your auditor reviews your documented information, scope, legal and regulatory awareness, internal audit and management review, and confirms you are ready for Stage 2.
- 3
Stage 2 audit
An on-site evaluation of how your management system works in practice. The auditor interviews people, observes activities and samples records against every requirement.
- 4
Certification decision
Any nonconformities are closed with evidence. A qualified reviewer who did not take part in the audit makes the certification decision and your certificate is issued.
- 5
Surveillance and recertification
Surveillance audits take place at least once a year to confirm continued conformity. A recertification audit before the third anniversary renews your certificate.
Certificate verification
Check a Hexa certificate
Need to know whether a supplier's certificate is current? Customers, buyers and other interested parties can ask us to confirm the details held in our records.
We confirm the organisation name, certificate number, ISO standard, certified scope, status, and issue and expiry dates.
FAQs
ISO 13485 certification questions
Answers about scope, timing and audits for ISO 13485:2016.
Why does ISO 13485 have a different structure from ISO 9001?
ISO 13485:2016 was based on the earlier ISO 9001:2008 structure and was deliberately not aligned with the Harmonized Structure used by ISO 9001:2015. It focuses on regulatory compliance and maintaining effectiveness rather than continual improvement and customer satisfaction. Its requirements sit in clauses 4 to 8, so organisations holding both certificates need to map the two carefully.
Does ISO 13485 certification allow us to apply the UKCA mark?
No. UKCA marking depends on meeting the UK Medical Devices Regulations 2002 and following the correct conformity assessment route. Higher-class devices need assessment by a UK Approved Body designated by the MHRA. Hexa's ISO 13485 certificate demonstrates your quality management system meets the standard, which supports regulatory compliance but is not a conformity assessment certificate.
Which clauses can we exclude?
Clause 1 permits exclusion of design and development controls in clause 7.3 where applicable regulatory requirements allow it. Requirements in clauses 6, 7 or 8 may also be not applicable if the activity is not performed, such as sterilisation or installation. Any exclusion or non-application must be justified and recorded in the quality manual.
Do suppliers of components need ISO 13485?
The standard does not require suppliers to be certified, but device manufacturers must control suppliers in proportion to risk. Many manufacturers ask critical suppliers, such as contract manufacturers and sterilisation providers, to hold ISO 13485 certification because it simplifies supplier evaluation. Component suppliers can be certified for their specific role in the device life cycle.
Does ISO 13485 require risk management to ISO 14971?
ISO 13485 requires documented processes for risk management in product realisation but does not mandate a specific standard. ISO 14971 is the recognised standard for applying risk management to medical devices and is referenced in ISO 13485 as guidance. In practice, auditors expect manufacturers to follow ISO 14971 or be able to justify an equivalent approach.
What is a medical device file?
Clause 4.2.3 requires a file for each medical device type or family. It includes or references a general description and intended use, labelling and instructions for use, product specifications, procedures for manufacturing, storage, installation and servicing, and measurement and monitoring arrangements. In regulated markets it typically links to the technical documentation required by the regulations.
Does ISO 13485 apply to software as a medical device?
Yes. Developers of software as a medical device can be certified to ISO 13485, applying its design, risk management and validation requirements. Clause 4.1.6 and related clauses also require validation of software used in the QMS and in production. Many software manufacturers use IEC 62304 for software life cycle processes alongside ISO 13485.
How often are surveillance audits carried out?
Surveillance takes place at least annually, with the first audit due within twelve months of the certification decision. Each surveillance audit samples the system, including complaint handling, regulatory reporting, CAPA, internal audit and management review. A recertification audit is required before the certificate expires at the end of the three-year cycle.
ISO 13485 certification near you
We audit ISO 13485 systems on site across the UK, including:
- ISO 13485 London
- ISO 13485 Birmingham
- ISO 13485 Manchester
- ISO 13485 Leeds
- ISO 13485 Glasgow
- ISO 13485 Edinburgh
- ISO 13485 Cardiff
- ISO 13485 Belfast
- ISO 13485 Bristol
- ISO 13485 Liverpool
- ISO 13485 Newcastle upon Tyne
- ISO 13485 Sheffield
- ISO 13485 Nottingham
- ISO 13485 Southampton
- ISO 13485 Cambridge
- ISO 13485 Aberdeen
Integrated audits
Standards often combined with ISO 13485
Organisations frequently certify these together in one integrated audit, with one plan and fewer days on site.
Quality
ISO 9001:2026Quality Management
ISO 9001:2026 sets out the requirements for a quality management system. Published in September 2026, it replaces ISO 9001:2015 and keeps the same core approach. It asks an organisation to understand its context and interested parties, plan its processes around risks and opportunities, and show that it consistently provides products and services that meet customer and applicable statutory and regulatory requirements. It is the most widely used management system standard and applies to organisations of any size or sector, from sole manufacturers to national service providers.
- Meet tender and supplier requirements
- Consistent processes
- Fewer errors and complaints
- Risk-based planning
Information & Technology
ISO/IEC 27001:2022Information Security Management
ISO/IEC 27001:2022 specifies requirements for an information security management system (ISMS). It requires an organisation to assess information security risks to the confidentiality, integrity and availability of information, select controls to treat them and manage those controls through a continual cycle of monitoring and review. Annex A lists 93 reference controls in four themes: organisational, people, physical and technological. Each organisation compares its chosen controls against Annex A and records the outcome in a Statement of Applicability.
- Answer security questionnaires
- Risk-based security
- Supports data protection duties
- Management oversight
Environment & Energy
ISO 14001:2026Environmental Management
ISO 14001:2026, published in April 2026 to replace the 2015 edition, specifies the requirements for an environmental management system. It helps an organisation identify the environmental aspects of its activities, products and services, understand its compliance obligations, and manage significant impacts through planning, operational control and evaluation. The standard takes a life cycle perspective, so organisations consider stages they can control or influence, such as purchasing, transport, use and end-of-life treatment, as well as their own sites.
- Supply chain and tender credibility
- Structured legal compliance
- Control of significant impacts
- Resource and waste efficiency
Start your certification
Get your ISO 13485 certification quote
Tell us about your organisation and the standards you need. We will confirm audit days, scope and dates in writing, with no obligation.
