For a small or mid-sized company, getting from a standing start to an ISO 13485 certificate typically takes six to twelve months. Here is what the journey looks like.
Step by step
- Define scope: which products, sites and activities the certificate will cover
- Gap assessment: compare current practices with the standard and with target market regulations
- Plan the project: owners, timeline, budget and the choice of an electronic QMS or document system
- Write and implement procedures: lean procedures that fit how the business actually works
- Train the team: everyone must understand their role, not just the quality group
- Generate records: run the system for several months so there is evidence to audit
- Internal audit: audit every process and close findings
- Management review: leadership reviews performance and approves readiness
- Stage 1 audit: the certification body reviews documentation and readiness
- Stage 2 audit: on-site or remote assessment of implementation and effectiveness
- Certification: close any nonconformities and receive the certificate
After certification
- Annual surveillance audits
- Recertification audit every three years
- Unannounced audits by notified bodies for companies selling in the EU
- Ongoing internal audits, management reviews and CAPA
Choosing a certification body
Choose an accredited certification body. If you sell in Europe, consider a notified body that can also handle your IVDR or MDR conformity assessment. If you sell in the U.S., Canada, Brazil, Japan or Australia, an MDSAP auditing organization can cover several regulators with a single audit program.
What drives cost and effort
- Number of products, sites and outsourced processes
- Whether design and development is in scope
- Product risk class and target markets
- Maturity of existing processes and tools
- Internal capacity versus external support
ISO 13485 guide
Overview · Understanding the Standard · Design and Development Controls · Risk Management (ISO 14971) · CAPA, Complaints and Feedback · Suppliers and Outsourcing · Software, Cybersecurity and AI · The Certification Roadmap · ISO 13485 and the FDA QMSR
Need help? Salto Partners guides diagnostics, genomics and medical device companies through ISO 13485 and IVDR. Send us an email and we will set up a conversation.
For general information only; not legal or regulatory advice. Regulations and deadlines change, so confirm current requirements with your notified body or regulatory counsel. Last updated October 2026.