Quality & operations
ISO 13485
ISO 13485 (Medical devices QMS)
ISO 13485 is the international standard for a quality management system specific to medical devices. We support the management-system, documentation and audit-readiness work and coordinate the external certification body, partnering with regulatory and clinical specialists where needed.
What ISO 13485 is
ISO 13485 is the international standard for a quality management system for organisations involved in the design, production, installation and servicing of medical devices and related services. It builds on the general principles of a quality management system but adds the regulatory-focused, risk-based and documentation requirements that medical device regulators around the world expect.
Certification is awarded by an independent, accredited certification body following an audit, not by a consultancy. tr3labs supports the management-system, governance and audit-readiness side of the work and partners with regulatory and clinical specialists for device-specific and clinical matters; we do not provide clinical or device engineering expertise ourselves.
The structure of the standard
Clause 4 · Quality management system
Sets out the general and documentation requirements, including the quality manual, the medical device file and controls over documents and records.
Clause 5 · Management responsibility
Requires top management to set the quality policy and objectives, define responsibilities and hold a management review of the system.
Clause 6 · Resource management
Covers the competence, infrastructure and work environment needed to produce safe devices, including contamination and cleanliness controls where relevant.
Clause 7 · Product realisation
Governs planning, design and development controls, purchasing, production and service provision, with traceability running throughout.
Clause 8 · Measurement, analysis and improvement
Requires monitoring, internal audit, control of nonconforming product, complaint handling and corrective and preventive action.
Risk management · Woven across clauses
A risk-based approach, aligned with the thinking in ISO 14971, is applied to processes and the product lifecycle rather than confined to one section.
Regulatory requirements · Throughout
Many clauses are framed around meeting applicable regulatory requirements, including reporting to authorities and handling advisory notices and recalls.
Who needs it
- Medical device manufacturers and their design and development teams
- Suppliers and service providers in the medical device supply chain
- Organisations whose customers or regulators require an ISO 13485 certificate
What you get
- A gap assessment and prioritised roadmap against ISO 13485
- QMS documentation, procedures and records aligned to the standard
- An internal audit programme and management review records
- Certification readiness and support through the external audit
Timelines depend on the size of your organisation, the complexity of your devices and processes and your starting point. We scope it honestly up front rather than promise a fixed number of weeks.
Current version
The current edition is ISO 13485:2016, which remains the version certificates are issued against. A systematic review has kept the 2016 text in force rather than replacing it, so organisations should continue to build and certify against ISO 13485:2016 today. If and when a new edition is published, accreditation bodies normally set a transition window during which existing certificates stay valid while systems are updated. We track the standard's status so your programme is pointed at the edition auditors are actually assessing.
What it costs
Two separate costs sit side by side. tr3labs charges a scoped advisory and implementation fee that we quote up front, once we understand your size, your devices and your starting point. Separately, the independent accredited certification body that audits you and issues the certificate charges on its own schedule for the stage one and stage two audits and the surveillance visits that follow; tr3labs is never that certifier or auditor, and where clinical or regulatory specialists are needed they bill separately too. We would rather scope it with you than quote blind.
How tr3labs gets you there
Scope and gap assessment
We define the QMS scope, map your current processes against ISO 13485, and hand you a prioritised roadmap to close the gaps.
Build the management system
We help you produce the documentation, procedures and records the standard requires and set up the risk-based processes it expects. We focus on the management system and partner with regulatory and clinical specialists where device-specific input is needed.
Internal audit and evidence
We run internal audits and a management review so the system is operating and evidenced before an external auditor arrives.
Certification support
We prepare you for the audit by your chosen accredited certification body and support you through to the certificate and the surveillance cycle that follows. tr3labs is not the certification body.
ISO 13485 and ISO 9001 side by side
The two are confused because ISO 13485 grew out of the same quality management thinking as ISO 9001, yet they serve different purposes.
| ISO 13485 | ISO 9001 | |
|---|---|---|
| Covers | Medical device QMS | General quality management |
| Who asks for it | Device regulators and supply chain | Customers and tenders across sectors |
| Core idea | Regulatory focus and risk-based control | Customer satisfaction and improvement |
| Design controls | Detailed, device lifecycle specific | Lighter, generic requirements |
| Audit model | Accredited certification body audit | Accredited certification body audit |
| Often held with | ISO 14971 and sector regulations | ISO 14001 and ISO 45001 |
ISO 13485 FAQ
- How much does ISO 13485 certification cost?
- Our scoped advisory and implementation fee is quoted up front; separately, the accredited certification body charges on its own schedule for the stage one and stage two audits and the surveillance visits that follow. Where clinical or regulatory specialists are needed they bill separately too.
- How long does ISO 13485 take?
- It depends on the size of your organisation, the complexity of your devices and processes and your starting point. We scope the timeline honestly up front rather than promise a fixed number of weeks.
- How does ISO 13485 differ from ISO 9001?
- ISO 13485 is built for the medical device sector and emphasises regulatory requirements, risk management and documentation, whereas ISO 9001 is a general quality management standard. The two share common ground but ISO 13485 is the one medical device regulators expect.
- Does tr3labs provide clinical or device engineering expertise?
- No. tr3labs supports the management-system, documentation, internal audit and audit-readiness work. For clinical, regulatory affairs and device engineering matters we partner with specialists so your system is both compliant and technically sound.
- Does tr3labs issue the ISO 13485 certificate?
- No. Certification is awarded by an independent, accredited certification body after an audit. tr3labs builds and runs the management system with you, prepares the evidence, and supports you through the audit.
Related standards
Related reading
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read
SOC 2 vs ISO 27001: an honest comparison to help you choose
A plain-English guide to the real differences between SOC 2 and ISO 27001: what each one is, who asks for which, how the audits work, what you end up holding, and whether you should do both.
8 min read