ISO 13485 Compliance

FDA's QMSR Is Now in Effect. Is Your Supply Chain Quality System Audit-Ready?

ISO 13485 compliance demands documented supplier controls, validated processes, and traceable quality records across every tier of your medical device supply chain—with regulators now inspecting against ISO 13485:2016 directly. MDSAP audits cover five jurisdictions in a single assessment. FDA warning letters for QMS violations increased sharply in 2025. Certivo automates supplier quality evidence collection from declaration to audit-ready documentation.

Regulation Overview

Jurisdiction
Global (recognized by EU, US, Canada, Japan, Australia, Brazil, and 160+ countries)
Regulatory Body
International Organization for Standardization (ISO); enforced by FDA (US), EU Notified Bodies, Health Canada, TGA, ANVISA, MHLW/PMDA
Regulation Number
ISO 13485:2016
Effective Date
March 1, 2016 (FDA QMSR incorporating ISO 13485 effective February 2, 2026)
Official Source
ISO 13485:2016
Key Threshold
Organizations involved in any stage of the medical device lifecycle

What Is ISO 13485?

ISO 13485 is the international quality management system standard governing medical device design, development, production, storage, distribution, installation, and servicing. For supply chain and compliance teams, the central obligation is maintaining documented evidence that every supplier, process, and component meets regulatory requirements for safety and performance.

Over 32,000 organizations hold active ISO 13485 certificates globally. With the FDA's QMSR now in effect since February 2, 2026, ISO 13485:2016 is directly incorporated into US federal regulation—making ISO 13485 compliance the single quality system baseline for both domestic and international market access. Notified Bodies under the EU MDR require demonstrated ISO 13485 conformity for CE marking. MDSAP enables a single audit to satisfy five regulatory authorities simultaneously.

Key Components / Sub-Frameworks

Key Compliance Requirements

Who Must Comply

• Medical device manufacturers designing, producing, or servicing devices for any regulated market
• Contract manufacturers performing outsourced sterilization, assembly, packaging, or testing
• Component and raw material suppliers to medical device OEMs
• Distributors and importers placing medical devices on regulated markets
• Software developers producing Software as a Medical Device (SaMD) or embedded device software
• Service organizations providing calibration, installation, or maintenance under OEM quality agreements

Key Thresholds

• Clause 7.4.1: Supplier evaluation criteria must be documented and risk-proportionate
• 3-year cycle: Certification validity period with annual surveillance audits
• MDSAP grading: 4-point nonconformity grading matrix applied to ~80 audit tasks
• 6 months: Typical maximum interval between supplier re-evaluations for critical suppliers

Core Obligations

1. Quality Agreements
Establish written quality agreements with all suppliers of critical components and services
DEADLINE: Before supplier activation
2. Supplier Evaluation
Document evaluation criteria, assess supplier capability, and maintain re-evaluation records
DEADLINE: Ongoing; risk-based frequency
3. Design Controls
Maintain design input/output, verification, validation, review, and transfer records
DEADLINE: Throughout design lifecycle
4. CAPA System
Investigate nonconformities, identify root causes, implement and verify corrective actions
DEADLINE: Without undue delay per Clause 8.5.2
5. Complaint Handling
Document, investigate, and trend all complaints; report to regulatory authorities where required
DEADLINE: Per regulatory reporting timelines

Certivo in Action

Certivo Workflow

GET EVIDENCE IN
Collect Quality Declarations and Certificates from Every Supplier—Without the Chasing
CORA launches targeted campaigns to collect ISO 13485 certificates, quality agreements, material certifications, and conformity evidence from every tier of your supply chain through automated supplier data collection.

MAKE SENSE OF IT
Know Instantly When Supplier Certifications Expire or Quality Records Fall Below Threshold
CORA extracts every data point from quality documents—certificate numbers, expiry dates, scope of accreditation, material composition—validates against your requirements, and flags gaps automatically through AI document parsing and certificate validation.

PROVE COMPLIANCE OUT
Respond to Audit Requests in Hours, Not Weeks
Generate audit-ready supplier quality packages and traceability documentation instantly from validated supplier data as a centralized compliance data backbone.

Related Regulations

• EU MDR (2017/745): Notified Bodies require ISO 13485 conformity for CE marking
• FDA QMSR (21 CFR 820): QMSR incorporates ISO 13485:2016 by reference since February 2026
• MDSAP: Single audit program built on ISO 13485 covering 5 jurisdictions
• ISO 14971: Risk management standard cross-referenced throughout ISO 13485
• EU RoHS: Substance restrictions affecting medical device material choices
• REACH: SVHC tracking requirements for components in medical devices

Key Statistics

• 32,000+ Organizations certified to ISO 13485 worldwide
• 99.2% Document extraction accuracy from supplier quality records
• 95% Supplier response rate with CORA-powered campaigns

Frequently Asked Questions

What organizations are subject to ISO 13485 compliance obligations?
Any organization involved in the medical device lifecycle must comply—including manufacturers, contract manufacturers, component suppliers, software developers, sterilization providers, distributors, and importers. With the FDA's QMSR incorporating ISO 13485:2016 by reference since February 2026, US market access now requires ISO 13485-aligned quality systems. CORA helps organizations across the supply chain maintain audit-ready quality documentation regardless of their role in the device lifecycle.

What are the consequences of ISO 13485 non-compliance?
Consequences vary by jurisdiction but are significant. In the US, FDA enforcement includes warning letters, product seizure, injunctions, and withheld export certificates—44 warning letters cited device manufacturers in FY2025 alone. In the EU, Notified Bodies can suspend or withdraw CE certificates, blocking market access. MDSAP nonconformity grades can trigger increased regulatory scrutiny across all five participating jurisdictions. Certivo's continuous compliance monitoring helps organizations identify and resolve gaps before they become audit findings.

How does Certivo manage ISO 13485 supplier qualification at scale?
Certivo automates the entire supplier qualification lifecycle—from initial evaluation campaigns through ongoing re-evaluation. CORA collects quality documents in any format and language, extracts certification scope and expiry data automatically, scores supplier risk based on quality performance, and triggers re-evaluation workflows when certifications approach expiry or quality metrics decline. The platform serves as a centralized compliance data backbone across your entire approved supplier list.

Does Certivo support multi-framework compliance alongside ISO 13485?
Yes. Certivo validates a single supplier submission against ISO 13485, EU MDR, FDA QMSR, MDSAP, REACH, RoHS, and additional frameworks simultaneously through BOM substance and threshold management capabilities. This eliminates duplicate collection campaigns and gives compliance teams a unified view of supplier qualification status across quality, substance, and environmental requirements through digital passport and traceability systems.