ISO 13485 Certification: QMS Consultancy for Medical Devices

ISO 13485 is the international standard for quality management systems (QMS) in the medical device industry. It sets out how an organisation that designs, makes, supplies or services medical devices must control design, risk, suppliers, production, traceability, complaints and reporting, so that devices are consistently safe and effective and meet regulatory requirements. The current edition is ISO 13485:2016. Certification is voluntary, but it is the benchmark regulators, notified bodies and customers use to judge a device maker’s quality system.

Sovereign Secure provides ISO 13485 consultancy, from gap analysis to certification audit, as part of our wider ISO certification service. We do not issue certificates: the audit is carried out by an independent certification body. Because device security is now part of regulatory evidence, we can also test the device itself.

What is ISO 13485? (in plain English)

In plain English, ISO 13485 is the rulebook a medical device business follows to prove it makes safe devices the same way every time, and can show a regulator the records to back that up. Its full title is Medical devices: quality management systems, requirements for regulatory purposes, and it is the standard a medical device QMS is built and audited against. The ISO 13485:2016 listing shows the current, third edition. It is based on the older ISO 9001:2008 structure rather than the clause 4 to 10 structure of modern management system standards, and it stands alone: an ISO 13485 certificate does not imply ISO 9001 conformity, or the other way round.

Who needs ISO 13485 certification?

ISO 13485 applies to any organisation involved in one or more stages of a medical device’s life cycle, and to suppliers that provide products or services to them.

Our healthcare cyber security page covers the wider security picture for providers and their suppliers.

What are the ISO 13485 requirements?

ISO 13485 requirements sit in clauses 4 to 8. Design and development (7.3) can only be excluded where device regulations allow it, and other requirements in clauses 6, 7 and 8 can be marked not applicable only where you do not carry out that activity.

Design controls (clause 7.3)

Design controls cover planning, inputs, outputs, review, verification, validation, transfer to production, control of changes and a design and development file for each device type or family. Auditors sample the trail from user needs and regulatory requirements to verified outputs, and check that every design change was reviewed for its effect on safety, performance and risk.

Risk management with ISO 14971

ISO 13485 requires documented risk management processes throughout product realisation (clause 7.1). The method used almost everywhere is ISO 14971:2019, which covers identifying hazards, estimating and evaluating risks, controlling them, judging residual risk and collecting production and post-production information.

Supplier control and records

Suppliers must be evaluated, selected and monitored using criteria proportionate to the risk of what they supply (clause 7.4), and outsourced processes stay your responsibility. Records must be kept for at least the lifetime of the device as you define it, and never less than two years from release, or longer where regulations require.

How does ISO 13485 fit UK, EU and US medical device regulation?

ISO 13485 certification sits beside device regulation, not in place of it. This is an overview, not regulatory advice: your notified body, UK approved body or regulatory adviser confirms the route for each device.

In Great Britain, CE marked devices can currently be placed on the market until 30 June 2028 or 30 June 2030 at the latest (or earlier, if an EU directive certificate expires first), depending on the device and the EU legislation it meets, and the government has said it will consult on recognising CE marking indefinitely. Check the MHRA’s guidance on regulating medical devices in the UK for the current position.

What cyber security evidence do medical device makers need?

Regulators now expect connected devices and device software to show that security was designed in and verified. The EU MDR’s general safety and performance requirements (Annex I, section 17) require software to be developed to the state of the art, taking account of risk management including information security, and require manufacturers to set out the minimum IT security measures, including protection against unauthorised access, needed to run the software as intended. The Medical Device Coordination Group’s guidance MDCG 2019-16 explains how manufacturers can meet these requirements, and in the US, section 524B of the Federal Food, Drug, and Cosmetic Act sets cyber security requirements for “cyber devices”, including a software bill of materials.

ISO 13485 is where that evidence lives. Security requirements are design inputs (7.3.3), security testing is design verification (7.3.6), security risks are handled in your ISO 14971 process, and vulnerability reports arrive through feedback and complaint handling (8.2). IEC 81001-5-1 gives a security life cycle that fits alongside it.

Independent testing gives auditors and regulators the verification evidence they look for:

• Hardware and IoT penetration testing of the device, its firmware, debug interfaces and wireless links such as Bluetooth.
• Mobile app penetration testing of the companion app, plus testing of the cloud services and APIs the device talks to.
• Source code review of device and backend software before release.

Test reports and retest results can then be kept as design verification records, showing that security risk controls were implemented and are effective.

One point on scope: the EU Cyber Resilience Act does not apply to products covered by the MDR or IVDR, so device cyber security is assessed under those regulations. Connected products you sell that are not themselves medical devices may fall under the Cyber Resilience Act instead.

How do you get ISO 13485 certification?

You get ISO 13485 certification by building and running a medical device QMS, then passing a two-stage audit by an independent certification body.

1. Agree the scope: which sites, device types and life cycle stages (design, production, servicing, distribution) the certificate must cover, and which regulatory markets it supports.
2. Run a gap analysis against clauses 4 to 8, including which requirements can be justified as not applicable.
3. Build the QMS: quality manual, documented procedures, the medical device file for each device type or family, and record controls.
4. Put design control and risk management in place, linking design files to an ISO 14971 risk management file.
5. Control suppliers and outsourced processes, with quality agreements where needed.
6. Run the QMS long enough to produce records: complaints, nonconforming product, supplier monitoring, training and validation.
7. Complete an internal audit and a management review.
8. Stage 1 audit: the certification body reviews your documentation and readiness.
9. Stage 2 audit: the certification body samples records and interviews staff, then decides on certification. The certificate lasts three years, with surveillance audits in between.

How long does ISO 13485 certification take?

There is no fixed timescale. It depends on what you do and how much of the system already exists.

Whatever the starting point, the QMS must run long enough to produce the records an auditor samples, including an internal audit and a management review, before Stage 2. If you already hold ISO 9001, our ISO 9001 consultancy team can show where your existing system meets ISO 13485 and where it does not.

How much does ISO 13485 certification cost?

There is no fixed price. ISO 13485 certification cost depends on what you do across the device life cycle, and it has two parts: the certification body’s audit fees over the three-year cycle and any consultancy you buy to get ready. These drivers move both:

Budget for the full three-year cycle, not just the first audit. We give you a fixed quote for the consultancy once we know your scope.

How does an ISO 13485 consultant help?

An ISO 13485 consultant builds the QMS with you and prepares you for the certification audit. Our route has six steps:

1. Gap analysis against every clause, with a prioritised plan.
2. QMS design and procedures, including the medical device file and record controls, written to fit how you work.
3. Design control and risk management, linking design files to your ISO 14971 risk management file.
4. Supplier and outsourced process controls, with quality agreements where they are needed.
5. Internal audit and management review, carried out impartially before the certification audit.
6. Certification audit support at Stage 1 and Stage 2, and help closing any findings. The independent certification body makes its own decision.

Why Sovereign Secure

• We hold ISO 27001 ourselves, so we know the certified side of an audit.
• Quality and security from one team: ISO 13485 consultancy plus hardware, firmware, mobile, cloud and API penetration testing, including point-of-sale and PIN entry devices.
• Independent certification. We never certify a system we helped build, and we are not a notified body or UK approved body. Our partner certification body is MQA International; we confirm the certification body for your ISO 13485 scope when we quote.
• A UK company since 2012, headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka.

Get an ISO 13485 quote

Tell us what you do across the device life cycle, your device types and classes, the markets you sell into, how many people and sites are in scope and any certificates you already hold. We will scope the consultancy, and any device testing, and send a fixed quote. Request your ISO 13485 quote or call +44 161 523 5276.