The stakes got higher in February 2026. The FDA's Quality Management System Regulation (QMSR) incorporated ISO 13485:2016 by reference, replacing 21 CFR Part 820 as the foundational U.S. quality system framework for medical device manufacturers. That one regulatory move changed what "good enough" means for device makers operating in the U.S. market.
This article breaks down what each standard actually requires, where they diverge most sharply, and which one applies to your organization.
Key Takeaways
- ISO 9001 is a general QMS standard for any industry; ISO 13485 is built exclusively for medical device organizations
- ISO 13485 applies stricter requirements across regulatory compliance, risk management, documentation, and management accountability
- ISO 9001 drives continuous improvement; ISO 13485 focuses on sustained QMS effectiveness and patient safety
- As of February 2026, the FDA's QMSR incorporates ISO 13485:2016 by reference as the foundation of U.S. device quality system requirements
- Medical device manufacturers cannot substitute ISO 9001 for ISO 13485
ISO 13485 vs ISO 9001: Quick Comparison
The table below maps the six dimensions where these standards diverge most — and where those differences create real compliance obligations for your team.
| Dimension | ISO 9001 | ISO 13485 |
|---|---|---|
| Scope | Any organization, any industry | Medical device design, manufacture, installation, and servicing |
| Primary focus | Customer satisfaction, continuous improvement | Regulatory compliance, patient safety |
| Risk management | Risk-based thinking as a principle | Formal documented risk management across the product lifecycle |
| Documentation | Flexible — as needed for process effectiveness | Prescriptive — medical device files, batch records, traceability procedures |
| Improvement obligation | Must actively drive QMS improvement | Must demonstrate QMS remains suitable, adequate, and effective |
| Regulatory role | No medical device regulatory standing | Incorporated into FDA QMSR; harmonized under EU MDR/IVDR |
The sections below break down each of these dimensions in detail — starting with scope and regulatory standing, where the two standards diverge most sharply.
What Is ISO 9001?
ISO 9001 is the world's most widely adopted quality management system standard, issued by the International Organization for Standardization. With 1,265,216 valid certificates worldwide as of 2022, it applies to any organization regardless of industry, size, or product type. Its core function is providing a consistent, customer-focused, process-driven QMS framework.
The standard is built on seven quality management principles:
- Customer focus
- Leadership
- Engagement of people
- Process approach
- Improvement
- Evidence-based decision making
- Relationship management
ISO 9001:2015 (with Amendment 1:2024) is the current edition.
What ISO 9001 Actually Requires in Practice
ISO 9001 creates structure for documenting processes, managing audits, and driving corrective actions. Critically, it gives organizations significant flexibility in how they meet requirements. That flexibility is its greatest strength — and its primary limitation in regulated sectors.
That flexibility works well for general manufacturers. It breaks down when regulators want to see specific records, formal risk documentation, and documented traceability.
Where ISO 9001 Fits
ISO 9001 is the right standard for:
- General manufacturers: injection molding, machining, fabrication, assembly, consumer goods
- Service organizations and software companies needing a recognized QMS framework
- Corporate/administrative functions of large enterprises that want unified quality practices across divisions
- Any organization with quality obligations but no industry-specific regulatory requirements
Some global organizations implement ISO 9001 at the corporate level while a device manufacturing subsidiary maintains ISO 13485, covering different compliance layers within the same enterprise. The two standards can coexist without conflict.
What Is ISO 13485?
ISO 13485 is the international QMS standard built specifically for organizations involved in the medical device lifecycle — design, development, production, installation, and post-market servicing. First published in 1996, with the current third edition released in March 2016 and confirmed by ISO in 2025, it operates as a fully independent standard with no normative reference back to ISO 9001.
What separates it from every general QMS standard is regulatory scope. ISO 13485 explicitly requires organizations to establish and maintain records demonstrating compliance with applicable regulatory requirements — not just internal quality targets.
Regulatory Standing of ISO 13485
ISO 13485 carries formal weight in major markets:
- EU: EN ISO 13485:2016 is a recognized harmonized standard under both the MDR and IVDR. Conformity with it provides a presumption of conformity for the QMS requirements it covers
- United States: As of February 2026, the FDA's QMSR incorporates ISO 13485:2016 by reference under 21 CFR 820.7
- MDSAP: The Medical Device Single Audit Program — covering Australia, Brazil, Canada, Japan, and the U.S. — uses ISO 13485:2016 requirements alongside each participating jurisdiction's regulatory obligations
What ISO 13485 Compliance Looks Like
An ISO 13485-compliant QMS includes:
- Separate medical device files for each device type or product family
- Production records for each lot, including traceability and quantities approved for distribution
- Documented traceability procedures through the supply chain
- Formal CAPA procedures with justification requirements — even when complaints are not escalated
- Regulatory update reviews as part of management review (not just performance metrics)
- Validated processes for sterilization and cleanliness where applicable
ISO 13485 applies regardless of device risk classification or company size, covering everything from ankle braces to implantable cardiac devices.
Key Differences Between ISO 13485 and ISO 9001
Risk Management Depth
ISO 9001 treats risk-based thinking as a quality principle. Organizations identify and address risks, but have considerable latitude in how. ISO 13485 requires formal, documented risk management throughout the product lifecycle — supported by ISO 14971:2019, which provides the terminology, principles, and process framework for medical device risk management.
ISO 13485 auditors expect records, not just awareness. The standard is evidentiary: a well-intentioned risk discussion with no documented output is a finding.
Document Control and Record-Keeping
ISO 13485 requires significantly more documentation than ISO 9001. Key clause-level requirements include:
- Clause 4.2.3: A medical device file for each device type or family
- Clause 7.5.1: Production records per lot, including traceability and quantities approved for distribution
- Clause 7.5.9: Documented traceability procedures, with additional requirements for implantable devices
- Clause 4.2.4: Document changes must be reviewed and approved by the original approving function or another designated function with access to pertinent background information
Under ISO 9001, document control requirements exist but give organizations much more flexibility in what gets documented and how changes are managed. BSI's comparison of the two standards confirms that ISO 13485 retains prescribed procedures and a quality manual, while ISO 9001 leaves organizations to determine what documented information is necessary.
Management Responsibility
ISO 9001 allows management to assign quality responsibilities without specifying roles or mandate. ISO 13485 requires that specific management team members are accountable for each QMS element, and that management reviews include regulatory updates — not just performance data.
This distinction regularly generates audit findings when device manufacturers apply an ISO 9001 mindset to an ISO 13485 audit. Auditors aren't looking for general management commitment — they expect a named individual accountable for each clause.
Training Requirements
Both standards require competency — but they diverge sharply on evidence.
- ISO 9001: Competency and training as needed, with flexibility on documentation
- ISO 13485: Documented procedures for identifying training needs, delivering training, and assessing its effectiveness — especially for roles that directly affect product quality
Competency records alone are insufficient under ISO 13485. The standard expects a closed loop: need identified, training delivered, effectiveness verified and documented.
Continuous Improvement vs. QMS Effectiveness
BSI's comparison of the two standards identifies this as a fundamental philosophical difference: ISO 9001 emphasizes continual improvement to enhance customer satisfaction, while ISO 13485 centers improvement activity on the continued suitability, adequacy, and effectiveness of the QMS for producing safe devices.
The practical implication: ISO 9001 asks "are we getting better?" ISO 13485 asks "can we prove sustained control?" Quality objectives, KPIs, and management review structure all shift accordingly.
Product Realization and Post-Market Requirements
ISO 9001 addresses product realization through customer-focused procedures and process controls. ISO 13485 goes further. Requirements that exist in ISO 13485 with no equivalent in ISO 9001 include:
- Validated sterilization and cleanliness processes
- Documented installation and verification records
- Procedures for handling returned products
- A formal customer feedback system designed to detect early warning signals of nonconformances
- Documented procedures for notifying regulators of adverse events
None of these map to an ISO 9001 equivalent. Each one represents a standalone regulatory obligation specific to the medical device context.
Which Standard Should Your Organization Follow?
The decision is cleaner than it feels:
Follow ISO 13485 if your organization is involved in any stage of medical device design, manufacture, installation, or servicing. ISO 9001 does not satisfy regulatory QMS requirements for medical device manufacturers. It cannot be used as a substitute for ISO 13485 when CE marking, QMSR compliance, or MDSAP participation is required.
Consider both if your organization operates across regulated and non-regulated divisions. A global medical device company might use ISO 9001 at the corporate level to standardize quality practices, while the device manufacturing division maintains ISO 13485 for regulatory compliance. This is complementary coverage, not duplication.
The Harder Problem
Understanding which standard applies is the easy part. The harder challenge is building a team that can operate under ISO 13485's requirements under actual audit conditions — generating compliant documentation, managing risk files as living documents, and responding to findings without freezing.
QMS Learning's Medical Device & Life Sciences QMS pathway addresses exactly that gap. It bundles four courses — ISO 13485 Medical Device QMS, FDA 21 CFR Part 820, ISO 14971 Risk Management, and HIPAA Privacy & Security — with an AI Workbench trained on the actual regulatory texts your auditor uses.
Teams complete the pathway able to:
- Run internal audits against any ISO 13485 clause
- Draft design history file entries
- Build living risk management files
- Generate audit-ready CAPA records without outside consultant support
The pilot cohort opens Q3 2026. The first three to five teams receive early-access pricing in exchange for design partner input. Book a 30-minute demo Tuesday through Thursday, 10am–4pm PST to review scope and pricing.
Frequently Asked Questions
What is the difference between ISO 9001 and ISO 13485?
ISO 9001 is a general QMS standard applicable to any industry, focused on customer satisfaction and continuous improvement. ISO 13485 is a medical device-specific standard focused on regulatory compliance and patient safety, with stricter requirements for documentation, risk management, management accountability, and training effectiveness verification.
Does ISO 9001 apply to medical devices?
ISO 9001 can be applied to medical device organizations but is not sufficient for regulatory compliance. Medical device manufacturers must follow ISO 13485 — ISO 9001 does not satisfy CE marking, MDSAP, or FDA QMSR requirements.
Do I need both ISO 9001 and ISO 13485?
Most medical device manufacturers only need ISO 13485, which covers all QMS fundamentals that ISO 9001 addresses plus additional medical device-specific requirements. Larger organizations sometimes implement both to unify quality practices across corporate and manufacturing divisions.
Is ISO 13485 mandatory for medical device manufacturers?
ISO 13485 is not universally required by statute, but is effectively required for CE marking in the EU, expected under FDA QMSR in the U.S. as of 2026, and required for MDSAP participation — making it the practical standard for any organization selling devices in major global markets.
What is the QMSR and how does it relate to ISO 13485?
The FDA's Quality Management System Regulation (QMSR), effective February 2026, replaced 21 CFR Part 820 and incorporates ISO 13485:2016 by reference under 21 CFR 820.7. This makes ISO 13485 alignment the baseline compliance requirement for medical device QMS programs in the United States.
How long does it take to get ISO 13485 certified?
According to BSI, the full journey from preparation through certification typically takes 12 to 24 months, depending on documentation gaps, risk management maturity, and internal audit completion. Auditors generally expect at least three months of implementation records before the Stage 2 assessment.
