Medical Device QMS Guide

ISO 13485 vs MDR QMS: What's the Difference?

Q: Is ISO 13485 certification legally required under MDR?

Not literally — MDR Article 10(9) requires manufacturers to establish, document, implement, and maintain a quality management system, but does not name ISO 13485 by statute. In practice, ISO 13485 is the internationally recognised way to demonstrate this, and virtually every EU Notified Body expects manufacturers to hold or be pursuing ISO 13485 certification as the backbone of their QMS evidence.

Q: Does ISO 13485 certification alone satisfy MDR?

No. ISO 13485 covers the general structure of a medical device quality management system, but MDR Article 10(9) requires additional elements that go beyond the standard — a PRRC (Person Responsible for Regulatory Compliance), an EU-specific vigilance and incident-reporting system tied to EUDAMED, UDI assignment and database registration, and post-market clinical follow-up (PMCF) integrated into ongoing clinical evaluation. A manufacturer needs ISO 13485 as the foundation, plus these MDR-specific layers on top.

Q: How long does ISO 13485 certification take?

For a company building a QMS from scratch, typically 6–12 months to develop and implement the required processes and documentation, followed by a two-stage certification audit (documentation review, then on-site assessment). Companies with a mature ISO 9001 QMS already in place can often complete the transition faster, in roughly 3–6 months.

Q: Do I need ISO 13485 for a Class I self-declared medical device?

MDR still requires a QMS for Class I devices under Article 10(9), even though most Class I devices do not require Notified Body involvement. In practice, many manufacturers of Class I devices without measuring function or sterile packaging implement a proportionate QMS aligned with ISO 13485 principles without necessarily pursuing full third-party ISO 13485 certification, since there is no NB audit requiring formal certificate evidence. This should be confirmed against the specific product's classification rules.

"We're ISO 13485 certified" is not the same as "we meet MDR's quality management system requirement." The two overlap heavily but aren't identical — and misunderstanding the gap is one of the most common causes of delay in MDR certification.

See How ECP Can Help How ECP Works

Two Different Things That Overlap Heavily

ISO 13485:2016 is an international standard specifying requirements for a quality management system (QMS) for organisations involved in the medical device lifecycle. It is issued by a certification body through third-party audit and is recognised globally — not an EU-specific instrument.

MDR Article 10(9) is a legal requirement in EU Regulation 2017/745: manufacturers must establish, document, implement, and maintain a quality management system covering a specific list of elements. MDR does not name ISO 13485 as mandatory by statute — but in practice, it is the accepted way to demonstrate compliance, and Notified Bodies build their QMS assessments around it.

⚠ ISO 13485 certification alone does not equal MDR compliance Holding an ISO 13485 certificate is necessary but not sufficient for MDR. Article 10(9) requires several elements that go beyond the standard's scope — most notably a formally appointed PRRC, an EU vigilance system tied to EUDAMED, UDI assignment, and PMCF integrated into ongoing clinical evaluation.

What ISO 13485 Covers

Management responsibility and quality policy
Resource management (personnel competence, infrastructure, work environment)
Product realisation — design and development controls, purchasing, production, and process validation
Measurement, analysis, and improvement — internal audits, corrective/preventive action (CAPA), complaint handling, monitoring of processes
Risk management integrated throughout the product lifecycle (aligned with ISO 14971)

What MDR Article 10(9) Adds on Top

MDR-specific element	Not explicitly required by ISO 13485
Person Responsible for Regulatory Compliance (PRRC)	A named individual with defined MDR Article 15 responsibilities and minimum qualification criteria
EUDAMED registration and UDI system	Device identification, registration in the EU database, and UDI assignment/maintenance
EU vigilance system	Incident and field safety corrective action reporting through the EU vigilance framework, on MDR-specific timelines
Post-market clinical follow-up (PMCF)	Ongoing clinical evaluation updates as part of the post-market surveillance plan, not just generic complaint monitoring
Regulatory strategy and GSPR mapping	Documented strategy for regulatory compliance, including identification of applicable General Safety and Performance Requirements and how they are met
Communication with competent authorities and Notified Bodies	Formal procedures for interaction, not just general customer communication

Combined Audits: The Practical Path

Most manufacturers pursue ISO 13485 certification and MDR QMS assessment together rather than sequentially. Many Notified Bodies are also accredited ISO 13485 certification bodies and offer a combined audit covering both in a single audit cycle:

One documentation review covering both the ISO 13485 clauses and the MDR Article 10(9) elements
One on-site audit assessing both, rather than two separate visits
A single surveillance audit cadence going forward (typically annual)

This is usually faster and less expensive than treating ISO 13485 and MDR QMS as fully independent workstreams — but it requires selecting a body that is accredited for both, and for the specific device classification and MDR scope you need.

Typical Costs and Timelines

Activity	Timeline	Typical cost
Building QMS from scratch (no existing ISO 9001)	6–12 months	€15,000–€60,000 (consulting + internal effort)
Transitioning from ISO 9001 to ISO 13485	3–6 months	€8,000–€30,000
ISO 13485 certification audit (stage 1 + stage 2)	2–4 months	€5,000–€20,000 depending on company size and sites
Combined MDR QMS + ISO 13485 audit (via Notified Body)	Adds 1–3 months to NB timeline	Often bundled into overall NB certification fee
Annual surveillance audit	Ongoing	€3,000–€10,000/year

Do Class I Manufacturers Need ISO 13485?

MDR still requires a QMS under Article 10(9) for Class I devices, even though most Class I products don't require Notified Body involvement. In practice, manufacturers of Class I devices without measuring function or sterile packaging often implement a proportionate QMS aligned with ISO 13485 principles without pursuing full third-party certification, since there is no NB audit that requires a formal certificate. This should always be confirmed against the specific classification rules for your device — Class Ir, Im, and Is devices do require Notified Body involvement for those specific aspects.

Building or Upgrading Your QMS?

Submit a request on ECP describing your device classification and current QMS status. We route it to ISO 13485 certification bodies, MDR consultants, and Notified Bodies who can scope a combined audit path and quote directly.

See How ECP Can Help

Frequently Asked Questions

Is ISO 13485 certification legally required under MDR?

Not by name — MDR requires a QMS under Article 10(9) without naming ISO 13485 specifically. In practice, virtually every Notified Body expects manufacturers to hold or be pursuing ISO 13485 certification as the backbone of their QMS evidence.

Does ISO 13485 certification alone satisfy MDR?

No. MDR adds requirements beyond the standard — a PRRC, an EU vigilance system tied to EUDAMED, UDI assignment, and PMCF integrated into clinical evaluation. ISO 13485 is the foundation, not the whole requirement.

What is a combined audit?

A single audit process, run by a Notified Body accredited as both an ISO 13485 certification body and an MDR Notified Body, that assesses ISO 13485 conformity and the additional MDR QMS elements together — generally faster and cheaper than two separate audits.

How long does ISO 13485 certification take?

6–12 months building a QMS from scratch, or 3–6 months transitioning from an existing ISO 9001 system, followed by a two-stage certification audit.

Do I need ISO 13485 for a Class I self-declared medical device?

A QMS is still required under Article 10(9), but many Class I manufacturers (without measuring function or sterile packaging) implement ISO 13485-aligned processes without full third-party certification, since there's no NB audit requiring a formal certificate. Confirm against your specific classification.

Find the right provider

Notified Body

For combined ISO 13485 and MDR QMS assessment, and product certification.

Find a Notified Body for MDR →

EU Authorized Representative

Mandatory for non-EU medical device manufacturers placing products on the EU market.

Find an EU Representative →

Regulatory Consultant

QMS gap analysis, PRRC support, and MDR technical documentation preparation.

See How ECP Can Help →

Not sure which you need? See How ECP Can Help and we will match you with the right expert.