What does the MDR require of medical device manufacturers?
The MDR requires every manufacturer to establish, document, implement, maintain, keep up to date and continually improve a quality management system. The system must be proportionate to the risk class and the type of device.
The requirement is in Article 10(9) of Regulation (EU) 2017/745 on medical devices, which has applied since 26 May 2021. The system covers all parts of the organization that deal with the quality of processes, procedures and devices — from risk management and clinical evaluation to traceability and post-market surveillance. Regulation (EU) 2017/746 on in vitro diagnostic medical devices (IVDR) contains a similar requirement.
The MDR requires a quality management system, not a certificate to a particular standard. ISO 13485 is the most widely used way to build and demonstrate that system.
How does ISO 13485 relate to the regulation?
ISO 13485:2016 “Medical devices — Quality management systems — Requirements for regulatory purposes” is the standard created for exactly this purpose. Its European version EN ISO 13485:2016 (with amendment A11:2021) is a harmonized standard under the MDR — its reference was published by Commission Implementing Decision (EU) 2021/1182, as amended by Decision (EU) 2022/757.
Under Article 8(1) of the regulation, conformity with a harmonized standard gives a presumption of conformity with the requirements the standard covers. The regulation states explicitly that this also applies to system requirements — including those for the quality management system, risk management and post-market surveillance.
| ISO 13485 | MDR | |
|---|---|---|
| What it is | International standard — voluntary | EU regulation — mandatory |
| Subject | The quality management system | The device and all the manufacturer’s obligations |
| Who checks | A certification body — at an audit of the system | A notified body — for devices where one is required |
| Result | A certificate for the system | EU declaration of conformity and CE marking |
| Link | The basis of the quality system | Presumption of conformity through the harmonized standard |
What does an ISO 13485 certificate prove — and what does it not?
The certificate proves that an independent body has checked your quality management system and found that it meets the requirements of the standard. It is not permission to place a device on the market.
The certificate proves
- The quality system meets ISO 13485
- Processes are documented, implemented and checked on site
- The system is maintained — with a surveillance audit every year
- Independent confirmation for clients and contracting authorities
The certificate does not prove
- Conformity of a specific device with the MDR
- The right to affix the CE marking
- Assessment by a notified body under Annex IX
- That technical documentation and clinical evaluation exist
That is why an ISO 13485 certificate and a notified body certificate under the MDR are different documents. What the standard requires in detail is on the page ISO 13485 certification.
When is a notified body involved?
A notified body is involved when the MDR requires it for the device’s class. One of the procedures — Annex IX of the regulation — is conformity assessment based on a quality management system and on assessment of technical documentation.
It draws up the technical documentation and issues the EU declaration of conformity. No notified body is involved.
For class I devices that are sterile, have a measuring function or are reusable surgical instruments, involvement is limited to those aspects. For higher classes it is broader.
Even when no notified body is involved, the manufacturer still needs a quality management system. In that case an ISO 13485 certificate is often the only independent evidence of it for clients and partners.
Who benefits from an ISO 13485 certificate?
The standard is for all organizations involved in one or more stages of a medical device’s life cycle, and for their suppliers.
- ManufacturersThe basis of the quality system the MDR requires — and independent evidence of it.
- Suppliers and subcontractorsComponents, materials, sterilization, packaging — manufacturers control their suppliers and often ask for a certificate.
- Importers and distributorsStorage and transport under controlled conditions, batch traceability.
- Installation and servicingOrganizations that install and maintain medical equipment.
How does ISO 13485 certification work?
- 1Scope and role
You decide which activities and devices the system covers and what your role in the supply chain is.
- 2A system in place
Manual, procedures, medical device file, risk management, a completed internal audit and management review.
- 3Stage 1
The auditor reviews the documentation and assesses readiness for the on-site audit.
- 4Stage 2
The auditor checks how the system works — production, validated processes, traceability, complaints.
- 53-year certificate
With a surveillance audit in the second and third year and recertification before it expires.
ISO 13485 certification through Euro Standard Certification is carried out by a partner certification body accredited by RENAR (No. SM 110) — a member of EA MLA and Global ACI. The name of the body is given in the quote, and the scope of accreditation is checked for your devices before you receive it. The certification body does not provide consultancy — preparing the system is a separate service from an independent consultant.
Questions about ISO 13485 and the MDR
Is an ISO 13485 certificate mandatory under the MDR?
No. The MDR requires manufacturers to have a quality management system, but it does not require a certificate to a particular standard. EN ISO 13485 is a harmonized standard, which is why it is the most widely used way to build and demonstrate the system.
Does an ISO 13485 certificate replace the CE marking?
No. The CE marking is affixed after the device’s conformity assessment under the MDR — by the manufacturer or with a notified body, depending on the class. An ISO 13485 certificate concerns the quality management system.
Can a distributor or supplier be certified to ISO 13485?
Yes. The standard applies to organizations at any stage of the device life cycle — including storage, distribution, installation and servicing — and to suppliers of products and services to them.
Is ISO 13485 certification through ESCERT accredited?
Yes. Certification is carried out by a partner certification body accredited by RENAR under No. SM 110 — a member of EA MLA and Global ACI. The name of the body is given in the quote.