When you search for ISO 13485 certification requirements, you get dozens of answers, and most of them blur the line between an internal quality check and an accredited audit. Some manufacturers assume a thorough self-assessment covers the requirement.
It does not. Original equipment manufacturers (OEMs) generally require a certificate issued by an accredited third-party body before a supply agreement moves forward. This guide compares both paths so you know exactly which one actually qualifies you.
For most OEM contracts, only accredited third-party certification satisfies ISO 13485 certification requirements. Self-assessment alone will not qualify you as a supplier.
Quick Comparison: Third-Party Certification vs. In-House Self-Assessment
A side-by-side view shows why third-party certification, not self-assessment, is the path OEMs actually accept.
Understanding ISO 13485 Certification Requirements for Third-Party Audits
Meeting ISO 13485 certification requirements means passing an independent audit, not just documenting your own processes.
A manufacturer preparing for certification typically works through four connected stages: a gap analysis, a Stage 1 documentation review, a Stage 2 implementation audit, and a certification decision. Each stage builds on the last.
Skipping straight to self-review misses the independent verification that OEMs actually check for. An accredited body confirms that your quality management system works in practice, not just on paper. That independent confirmation is what separates a certificate from an internal memo.
Gap Analysis, Stage 1, and Stage 2 Audit: Core Process
The gap analysis identifies where your current practices fall short of the standard before the formal audit begins.
Stage 1 then reviews your documented policies and procedures.
Stage 2 tests how well those procedures actually operate on your production floor.
Only after both stages succeed does a certification decision follow.
Why an Accredited Body, Not the Manufacturer, Must Issue the Verdict
A manufacturer cannot certify itself and expect an OEM to accept that verdict. Accreditation exists precisely to remove that conflict of interest. When an independent, accredited body signs off, the OEM gains a verifiable, third-party guarantee that has no financial stake in the outcome.
What to Look for Before Choosing a Certification Path
Three factors decide whether a certification path will actually satisfy your OEM contract on time and on budget.
Accreditation the OEM Will Actually Recognize
Check that the certification body carries a recognized accreditation, not just a claim of expertise. KSQA holds IAS Management Systems Certification Body Accreditation, MSCB-207, an active credential displayed publicly and verifiable through the International Accreditation Service.
Turnaround Time Against Your Contract Deadline
Traditional certification bodies often take 30 to 45 days to issue a certificate. KSQA issues certificates within 2-3 days of successful audit completion, which matters when an OEM deadline is fixed and non-negotiable.
Fixed-Price Certainty vs. Open-Ended Internal Review Costs
An open-ended internal review consumes staff hours with no guaranteed outcome. KSQA's fixed-price model covers a full three-year certification cycle, so you know the total cost before you commit.
Why the 2026 FDA QMSR Rule Ends the Self-Assessment Shortcut
Since February 2, 2026, the FDA's Quality Management System Regulation incorporates ISO 13485:2016 by reference, closing the gap that once let some manufacturers rely on internal review alone.
What Changed in the Regulation
“The FDA's Quality Management System Regulation (QMSR) took effect on February 2, 2026, amending 21 CFR Part 820 to incorporate ISO 13485:2016 directly into federal device manufacturing requirements.”
This change aligns the FDA's domestic framework with the international standard rather than running a separate, parallel system.
Why This Raises the Stakes for OEM Supplier Qualification
“The FDA's own QMSR overview clarifies that the agency incorporates the standard by reference but does not itself issue ISO 13485 certificates.”
That distinction matters. An internal self-assessment might satisfy your own documentation habits, but it cannot produce the accredited certificate that OEMs and regulators now expect to see referenced against the same incorporated standard.
A supplier relying on self-assessment alone faces a widening gap between what the regulation recognizes and what their paperwork actually proves.
For the full regulatory text, see the FDA's QMSR Frequently Asked Questions page, which confirms the revised 21 CFR Part 820 is now titled the Quality Management System Regulation.
How KSQA Approaches Third-Party ISO 13485 Certification
KSQA combines IAS accreditation with a fast, fixed-price audit process built specifically for manufacturers who cannot afford delay.
KSQA's Specific Audit Process
KSQA delivers the gap analysis, Stage 1 documentation review, and Stage 2 implementation audit virtually by default, with in-person audits available where needed.
Surveillance audits follow within twelve months of certification, and a recertification audit is conducted before the three-year cycle expires.
Proof Point: IAS Accreditation and Track Record
KSQA holds IAS Management Systems Certification Body Accreditation, MSCB-207, an active accreditation from the International Accreditation Service.
With more than 20 years of experience and hundreds of successful certifications completed, KSQA issues certificates within 2-3 days of successful audit completion, well ahead of the 30- to 45-day industry standard.
What In-House Self-Assessment Offers
An internal self-assessment has a real, limited purpose. It helps a quality team identify obvious gaps, organize documentation, and prepare staff before an external audit begins.
What it cannot do is produce a credential an OEM will accept as proof of compliance. Self-assessment works best as preparation, not as a substitute for accredited certification.
The Key Differences That Matter
Every apparent shortcut in self-assessment comes with a trade-off that surfaces later in the OEM qualification process.
"Self-Assessment Feels Faster and Cheaper Upfront, But..."
Yes, reviewing your own system internally avoids an immediate audit fee. That saving typically disappears the moment an OEM asks for a certificate you cannot produce, forcing you to restart the process under contract pressure.
"Internal Review Builds Useful Documentation, But..."
Yes, self-assessment produces documentation you can reuse. Only an accredited third-party audit converts that documentation into a certificate recognized outside your own company.
Which Option Is Best for You?
Self-assessment best fits manufacturers doing early internal readiness checks with no immediate OEM deadline and full tolerance for rework later.
Third-party certification through KSQA best fits medical device manufacturers who need an OEM-recognized, IAS-accredited ISO 13485 certificate before a supply agreement can proceed.
Frequently Asked Questions (FAQs)
Q1. Does self-assessment satisfy ISO 13485 certification requirements for OEM contracts?
No. Self-assessment can prepare your documentation, but most OEM contracts require a certificate issued by an accredited third-party body. Internal review alone does not meet that requirement.
Q2. How long does third-party ISO 13485 certification take?
Timelines vary by certification body. KSQA issues certificates within 2-3 days of a successful audit, compared with the 30- to 45-day industry standard at many traditional registrars.
Q3. Does the FDA require ISO 13485 certification directly?
The FDA's QMSR incorporates ISO 13485:2016 by reference into federal device manufacturing rules, but the FDA itself does not issue ISO 13485 certificates. Accredited bodies handle certification separately.
Q4. What does an ISO 13485 Stage 1 and Stage 2 audit check?
Stage 1 reviews your documented quality policies and procedures. Stage 2 audits how effectively those procedures actually operate in your facility before a certification decision follows.
Q5. How much does ISO 13485 certification cost?
Costs vary between certification bodies. KSQA uses a fixed-price model covering a full three-year certification cycle, so the total cost is known upfront rather than billed per audit.
Ready to Move Past Self-Assessment?
Self-assessment can prepare your team, but it cannot replace the accredited certificate your OEM contract requires. Meeting ISO 13485 certification requirements means working with a certification body that can prove its accreditation and deliver on time.
KSQA's IAS-accredited process delivers a recognized ISO 13485 certificate within 2-3 days of a successful audit, at a fixed price with no hidden fees.
Request a proposal from KSQA to schedule your Stage 1 audit and move toward a certificate your OEM will actually accept.
.png)
