ISO 13485:2016 is the international standard for quality management systems in the medical device and diagnostics industry. It is the foundation for selling regulated products in Europe, the United States, Canada and most other major markets, and increasingly a requirement from customers and distribution partners.
This guide walks through the standard in practical terms, based on hands-on experience building and certifying a quality system for a clinical genomics software company.
Why ISO 13485 matters
- Market access: required or expected for CE marking under the IVDR and MDR, for MDSAP and Canada, and now the basis of U.S. FDA quality requirements
- Customer trust: hospitals, laboratories and distributors increasingly ask for a certificate before signing
- Better products: disciplined design, risk management and feedback loops catch problems before patients do
- Company value: investors and acquirers treat a mature quality system as a sign of a well-run business
Key facts at a glance
| Current version | ISO 13485:2016 |
| Applies to | Manufacturers of medical devices and IVDs, including software, and their suppliers and service providers |
| Companion standard for risk | ISO 14971:2019 |
| Certificate cycle | Three years, with annual surveillance audits |
| U.S. status | Incorporated by reference in the FDA QMSR since February 2, 2026 |
| Typical time to certification | Six to twelve months for a small or mid-sized company |
In this guide
Understanding the Standard
Scope, clause structure, required documentation and how exclusions work.
Design and Development Controls
Planning, inputs, outputs, verification, validation, transfer and change control, including agile software teams.
Risk Management (ISO 14971)
Applying ISO 14971 across the product lifecycle, with a focus on diagnostics.
CAPA, Complaints and Feedback
Turning complaints, nonconformities and field data into effective corrective action.
Suppliers and Outsourcing
Risk-based control of suppliers, quality agreements, cloud providers and distributors.
Software, Cybersecurity and AI
IEC 62304, usability, cybersecurity and AI for medical device software.
The Certification Roadmap
The step-by-step path to certification, timelines, audits and cost drivers.
ISO 13485 and the FDA QMSR
How the FDA’s new QMSR builds on ISO 13485, and what MDSAP adds.
Looking for the European diagnostics regulation? See our IVDR guide.
Need help? Salto Partners guides diagnostics, genomics and medical device companies through ISO 13485 and IVDR. Send us an email and we will set up a conversation.
For general information only; not legal or regulatory advice. Regulations and deadlines change, so confirm current requirements with your notified body or regulatory counsel. Last updated October 2026.