01
Which medical-device companies use ISO 13485
ISO 13485 is designed for organisations involved in one or more stages of the medical-device lifecycle. Certification need depends on regulatory role, customer contracts, target markets, device activities, and the expectations of manufacturers or supply-chain partners.
- Legal and finished-device manufacturers preparing products for commercial distribution
- Medical-device startups building a QMS before launch, transfer, or customer onboarding
- Contract manufacturers, specification developers, software providers, and service organisations
- Critical component, sterilisation, packaging, testing, and outsourced-process suppliers
02
What the operating QMS must control
A certificate-ready system must follow the actual device lifecycle. Procedures are only useful when responsibilities, risk decisions, acceptance criteria, records, escalation, and change control remain connected to the device and its intended use.
- Regulatory and customer requirements, device files, design controls, and design transfer
- Risk management, supplier qualification, purchasing controls, and outsourced processes
- Production, process validation, software validation, identification, and traceability
- Monitoring, measurement, calibration, release, nonconforming product, and rework
- Complaints, reportability interfaces, advisory notices, corrective action, and management review
03
How ISO 13485 now interfaces with FDA QMSR
FDA's Quality Management System Regulation became effective on February 2, 2026 and incorporates ISO 13485:2016 by reference with additional FDA provisions. One well-designed QMS can support both objectives, but an ISO 13485 certificate does not establish FDA approval, clearance, registration, listing, or complete legal compliance.
- Confirm whether the organisation and activities fall within QMSR applicability
- Map FDA-specific definitions, records, labelling, packaging, and reporting interfaces
- Test working evidence against current FDA inspection expectations
- Keep certification findings and regulatory obligations under distinct ownership
04
Build the system without waiting for finished documentation
A company does not need an existing ISO 13485 manual before starting. Vecta maps the devices, roles, processes, suppliers, records, risks, and commercial deadlines, then builds the QMS around the real operating model and prepares it for independent certification.
Frequently asked questions
Is ISO 13485 required for every US medical-device company?
No single certification rule applies to every organisation. Need depends on regulatory role, activities, target markets, customer contracts, supply-chain expectations, and certification objectives. Applicable FDA requirements must be assessed separately.
Can a medical-device startup obtain ISO 13485 certification?
Yes. The QMS can be designed around the startup's current lifecycle stage, devices, development activities, suppliers, outsourced processes, risks, and commercialisation plan.
Does ISO 13485 certification prove FDA compliance?
No. FDA QMSR incorporates ISO 13485:2016 by reference and includes additional US requirements. Certification and FDA compliance, inspection, clearance, approval, registration, and listing remain distinct.
Can contract manufacturers and component suppliers become certified?
Yes, when the certification scope accurately reflects their medical-device activities, products or services, sites, responsibilities, and customer requirements.
Who issues the ISO 13485 certificate?
An independent certification body audits the scoped QMS and makes the certification decision. Vecta provides system implementation, evidence, audit readiness, and programme support.
Primary sources