“Are you ISO 13485 certified?” is now one of the first questions a medical device buyer, OEM or export customer asks an Indian manufacturer. This guide explains what the ISO 13485 standard is, who needs it, what the standard requires and how it connects to India’s Medical Devices Rules, 2017 — in plain language, the way our consultants explain it on the shop floor.
Quick answer
ISO 13485 is the international standard for a medical device quality management system. Its full title is ISO 13485:2016 — Medical devices — Quality management systems — Requirements for regulatory purposes. The current edition is ISO 13485:2016, confirmed by ISO after its 2025 review. It applies to every organisation in the medical device life cycle — design, production, components, packaging, sterilisation, storage, distribution and servicing — and focuses on product safety, risk management and regulatory compliance.
ISO 13485 Full Form and Meaning
ISO stands for the International Organization for Standardization, and 13485 is the number of the standard. In simple words, ISO 13485 is a rulebook for running a medical device business so that every device is designed, made, stored and delivered safely, every time — and so that you can prove it to regulators and buyers.
It is based on the process approach of ISO 9001 but is written for regulatory purposes. That is why it places more weight on risk management, documented controls, process validation, traceability and reporting to regulators than on customer satisfaction or business growth.
Who Needs ISO 13485?
ISO 13485 applies to any organisation involved in one or more stages of a medical device’s life cycle:
- Medical device manufacturers — Class A to D, from disposables and syringes to implants and diagnostic kits
- Design and development companies, including medical device software
- Contract manufacturers making devices under another company’s brand
- Suppliers of components, raw materials, moulded parts and sterile-barrier packaging
- Sterilisation, testing and calibration service providers
- Importers, distributors and companies that install or service medical equipment
Is ISO 13485 Mandatory in India?
The certificate itself is voluntary. What is mandatory is the quality management system set out in the Fifth Schedule of the Medical Devices Rules, 2017, which every licensed medical device manufacturer in India must follow. The Fifth Schedule closely follows ISO 13485, so an ISO 13485 system is the most practical way to meet it. Before a manufacturing licence is granted, Class B sites are audited by a Notified Body, and Class C and D sites are inspected by CDSCO officers or a Notified Body.
Outside India, ISO 13485 is the quality system behind CE marking under the EU Medical Device Regulation, and since 2 February 2026 the US FDA’s Quality Management System Regulation (QMSR) incorporates ISO 13485:2016 by reference. For most manufacturers, the real driver is simple: OEM, hospital and export buyers ask for the certificate.
Not sure what ISO 13485 means for your plant?
Book a free 30-minute ISO 13485 Gap Check. A Greendot lead auditor tells you where your system stands, what is missing and how long certification will take.
Book My Free ISO 13485 Gap CheckISO 13485 Requirements: How the Standard Is Structured
ISO 13485:2016 has 8 clauses. Clauses 1 to 3 explain the scope and terms; clauses 4 to 8 contain the requirements your system must meet. Unlike ISO 9001, it keeps its own structure instead of the 10-clause high-level structure.
| Clause | What it requires | What it looks like in your plant |
|---|---|---|
| Clause 1–3 | Scope, normative references, terms and definitions | Defines which activities are in scope and which requirements, such as design, can be excluded |
| Clause 4 | Quality management system: processes, outsourcing, software validation, documentation, medical device file, control of documents and records | Quality manual, a medical device file for each device family, controlled documents and records kept for the life of the device |
| Clause 5 | Management responsibility: commitment, quality policy, objectives, responsibilities, management representative, management review | Top management sets quality objectives and reviews the system with data at planned intervals |
| Clause 6 | Resource management: competence, training, infrastructure, work environment and contamination control | Training records, maintained equipment, clean room and hygiene controls where the product needs them |
| Clause 7 | Product realization: planning with risk management, customer and regulatory requirements, design and development, purchasing, production, process and sterilisation validation, identification, traceability, preservation, measuring equipment | Risk file, design files, supplier evaluation, validated processes, batch or serial traceability and calibrated instruments |
| Clause 8 | Measurement, analysis and improvement: feedback, complaint handling, reporting to regulatory authorities, internal audit, nonconforming product, data analysis, corrective and preventive action | Complaint and vigilance records, internal audit reports, nonconformity control and CAPA closed with evidence |
6 Key Concepts of ISO 13485
These six ideas run through the whole standard. If your team understands them, the clauses make sense.
Risk-based approach (ISO 14971)
Risks to patients and users are identified, evaluated and controlled across the whole product life, usually following ISO 14971.
Medical device file
For each device type or family, a file holds its description, intended use, labelling, specifications, manufacturing and servicing procedures.
Process validation
Where output cannot be fully checked afterwards — sterilisation, sealing, moulding, software — the process itself must be validated.
Traceability
Every batch or serial number can be traced to its materials, process records and customers, with stricter rules for implantable devices.
Design and development control
Planning, inputs, outputs, review, verification, validation, transfer and changes, recorded in a design and development file.
Feedback, complaints and CAPA
Complaints are handled within set times, reportable events are notified to regulators, and corrective actions remove root causes.
Benefits of ISO 13485 Certification
- Meets the quality system expected under India’s Medical Devices Rules, 2017 and makes licensing inspections smoother
- Opens doors to OEM, hospital and export buyers who ask for ISO 13485
- Strong base for CE marking under the EU MDR and for supplying the US market
- Fewer complaints, recalls and rejections through risk-based control
- Full traceability when something goes wrong
- Clear, validated processes that do not depend on one person
How ISO 13485 Has Changed
| Year | Edition and status |
|---|---|
| 1996 | ISO 13485:1996 — first edition, published together with ISO 13488 |
| 2003 | ISO 13485:2003 — second edition, aligned with ISO 9001:2000 |
| 2016 | ISO 13485:2016 — third and current edition, published 1 March 2016; 3-year transition to March 2019 |
| 2021 | EN ISO 13485:2016/A11:2021 — European version harmonised with the EU MDR and IVDR |
| 2025 | ISO confirms ISO 13485:2016 after its systematic review — no new edition started |
| 2026 | US FDA’s QMSR incorporates ISO 13485:2016 by reference from 2 February 2026 |
ISO 9001 vs ISO 13485
| Point | ISO 9001 | ISO 13485 |
|---|---|---|
| Purpose | Customer satisfaction and continual improvement in any business | Safe and effective medical devices that meet regulatory requirements |
| Structure | 10 clauses (high-level structure) | 8 clauses (own structure) |
| Risk | Risk-based thinking across the business | Documented risk management for the product across its life (ISO 14971) |
| Documentation | Flexible — what the organisation decides | Quality manual, required procedures and a medical device file for each device family |
| Process validation | General requirement | Specific requirements, including sterilisation and software validation |
| Traceability | Where required | Required, with extra rules for implantable devices |
| Regulators | Not linked to regulators | Complaint handling and reporting to regulatory authorities |
Already certified to ISO 9001? You do not start from zero — your existing ISO 9001 system is upgraded with the medical device requirements, and both can run as one Integrated Management System.
How to Get ISO 13485 Certified
Certification follows a clear path: gap analysis, risk management and medical device files, a practical quality system, implementation with process validation and training, internal audit and management review, and finally the Stage 1 and Stage 2 audits by an accredited certification body. For most Indian manufacturers it takes about 3–4 months. Rushing the last steps is the most common reason audits fail — see why ISO audits fail and how to avoid it.
Get ISO 13485 Certified with Greendot
Greendot Management Solutions is an ISO 13485 certification consultant for medical device manufacturers, contract manufacturers and component suppliers, with offices in Valsad, Surat and Vadodara and on-site teams across Gujarat and Maharashtra. Since 1999 we have served 1,200+ mid and large-size companies and helped 200+ achieve ISO certification. Our consultants include IRCA-certified ISO Lead Auditors, and they build your ISO 13485 system on the shop floor with your team until you are certified. We also support CE marking for medical devices.
Start your ISO 13485 journey
Free 30-minute Gap Check · Written plan and timeline · Typical project 3–4 months · Any accredited certification body of your choice.
Get a Free ISO 13485 Gap CheckWhat Is ISO 13485 — FAQs
What is ISO 13485 in simple words?
ISO 13485 is the international rulebook for running a medical device business, so that every device is designed, made, stored and delivered safely and consistently, and you can prove it to regulators and buyers.
What is the full form of ISO 13485?
ISO stands for the International Organization for Standardization. The full title of the standard is ISO 13485:2016 — Medical devices — Quality management systems — Requirements for regulatory purposes.
Who needs ISO 13485?
Medical device manufacturers, designers, contract manufacturers, component and packaging suppliers, sterilisation and testing service providers, importers, distributors and companies that install or service medical equipment.
Is ISO 13485 mandatory in India?
The certificate is voluntary. The Medical Devices Rules, 2017 make the quality management system in their Fifth Schedule mandatory for licensed manufacturers, and that schedule closely follows ISO 13485. Most OEM and export buyers also ask for the certificate.
What is the latest version of ISO 13485?
ISO 13485:2016 is the current edition. ISO confirmed it after its 2025 systematic review and has not started a new edition.
What are the main requirements of ISO 13485?
A documented quality system with a medical device file for each device family, management responsibility, competent people and controlled work environment, risk management, design and purchasing controls, validated processes, traceability, complaint handling, internal audit and corrective action.
Is ISO 13485 a product certification?
No. ISO 13485 certifies your quality management system, not the product. Product approvals such as CE marking or an Indian licence are separate, but they rely on an ISO 13485 quality system.
How long is an ISO 13485 certificate valid?
Three years, with a surveillance audit every year and a recertification audit before the certificate expires.
