ISO 13485 vs ISO 9001: Which Certification Does Your Medical Device Business Need?

When you search for guidance on ISO 13485 vs. ISO 9001, you get dozens of conflicting answers. Both standards address quality management. Both apply to manufacturers. Yet most buyers still walk away unsure which one they actually need.

If your business touches medical devices—designing, building, labeling, or distributing them—this article gives you a direct answer. The wrong choice costs you time, supplier contracts, and in some cases your ability to sell into the US market at all.

The short verdict: if you operate in the medical device space, ISO 13485 certification is the standard you need. ISO 9001 is not a substitute.

ISO 13485 vs ISO 9001 at a Glance

ISO 13485 and ISO 9001 share a process-based foundation, but they serve entirely different purposes. ISO 9001 is a general quality standard for all industries. ISO 13485 certification is purpose-built for the regulatory demands of the medical device sector.

What ISO 13485 Requires That ISO 9001 Does Not

The two standards are parallel, not progressive. Achieving ISO 9001 certification does not put you partway toward ISO 13485. They branch in different directions at the point of purpose. 1. Device-Specific Documentation and Traceability

“ISO 13485:2016 requires organizations to maintain a quality management system specific to the medical device industry,” including device history records, design and development controls, and risk management across the full product lifecycle. These controls do not exist in ISO 9001.

Where ISO 9001 measures customer satisfaction and continual improvement, ISO 13485 measures regulatory compliance and patient safety—two objectives that produce different documentation, different audit evidence, and different organizational obligations. 2. What ISO 9001 Holders Need to Know

If your business holds ISO 9001 and now needs to enter the medical device supply chain, you are beginning a parallel certification process—not an upgrade. 

“ISO 13485:2016 includes requirements specific to medical devices not appropriate as general regulatory requirements. Because of these inclusions, organizations whose QMS conforms to ISO 13485 cannot automatically claim conformity to ISO 9001, and vice versa.”

The structural overlap exists. The compliance obligations do not.

Why the FDA's 2026 QMSR Update Changed Everything

Most articles treat ISO 13485 as a market preference—something OEMs and hospital systems ask for. That framing is now out of date.

“On February 2, 2026, the FDA's Quality Management System Regulation (QMSR) became effective, amending 21 CFR Part 820 and incorporating ISO 13485:2016 by reference as the federal regulatory framework for medical device quality management in the United States.”

The legacy 1996 Quality System Regulation no longer governs US medical device manufacturers. The QMSR does—and it is built on ISO 13485. 1. What This Means for Your Quality System

If your business designs, manufactures, packages, or distributes medical devices for the US market, your QMS must now conform to the ISO 13485:2016 clause structure under federal law. 

A business operating under ISO 9001 alone is running a general quality management system. It is not running the federally recognized medical device QMS. Those are two different things—and regulators treat them that way. 2. Does ISO 9001 Satisfy FDA Requirements?

No. “ISO 9001 is not referenced in 21 CFR Part 820 or the QMSR.” FDA-regulated medical device businesses must operate under a QMS that conforms to ISO 13485:2016. ISO 9001 may remain valuable for non-device business units, but it does not satisfy FDA requirements for medical device operations. 

If your business spans both device and non-device divisions, a dual-certification strategy is valid—substitution is not.

How KSQA Certifies Businesses Against ISO 13485

KSQA—K&S Quality Assessments LLC—is an IAS-accredited certification body that audits and certifies US businesses against ISO 13485, ISO 9001, AS9100, and ISO 27001. Certificates are issued within 2–3 days at a fixed price with no hidden fees. 1. Why IAS Accreditation Matters for Your Certificate

KSQA holds IAS Management Systems Certification Body Accreditation—MSCB-207—and is a member of the IAF Multilateral Recognition Arrangement. That membership means certificates issued by KSQA carry recognition across IAF member economies globally.

Accreditation is what makes a certificate valid in the eyes of your customers, your regulators, and your trading partners. 

An unaccredited certificate will not hold up under OEM supplier qualification requirements or FDA supply chain scrutiny. MSCB-207 confirms that KSQA's audit process meets the international standard for certification bodies—independently verified, not self-declared. 2. KSQA's ISO 13485 Certification Process

The certification process follows four stages:

1. Gap Analysis: Your existing documentation is reviewed against ISO 13485:2016 to identify gaps before the formal audit.

2. Stage 1 Audit: A documentation review that confirms your QMS is designed to meet the standard.

3. Stage 2 Audit: A virtual or on-site implementation audit confirming your QMS operates as designed.

4. Certificate Issuance: KSQA issues your ISO 13485 certificate within 2–3 days of a successful Stage 2 audit. Most certification bodies take 30–45 days.

With more than 20 years of experience in ISO and AS9100 certification auditing and hundreds of successful certifications completed, KSQA brings auditor depth that small and mid-size medical device businesses rarely access through large, slow registrars.

Which Certification Is Right for Your Business?

The answer comes down to one question: does your business operate in the medical device supply chain?

• Choose ISO 13485 if:

• Your business designs, manufactures, labels, or distributes medical devices for the US market

• An OEM or hospital system requires supplier qualification before awarding a contract

• Your QMS must conform to FDA QMSR under 21 CFR Part 820

• Choose ISO 9001 if:

• Your business does not operate in the medical device sector

• You need a universally recognized QMS standard for general procurement or contract qualification

Consider both if

• Your business spans device and non-device divisions—ISO 9001 for the general business and ISO 13485 for the regulated medical-device unit

Frequently Asked Questions (FAQs) 1. Can ISO 9001 replace ISO 13485 for a medical device company?

No. The two standards serve different regulatory purposes and cannot substitute for one another. 

“The FDA's QMSR, effective February 2, 2026, incorporates ISO 13485:2016 by reference into 21 CFR Part 820—the federal quality regulation for US medical device manufacturers. ISO 9001 is not referenced in this regulation.” 

A business holding only ISO 9001 does not meet the federal QMS requirement for device operations. 2. Does ISO 13485 include everything ISO 9001 requires?

Not exactly. ISO 13485 shares structural similarities with ISO 9001 but does not require continual improvement as explicitly. It trades that element for stricter regulatory documentation controls, device history records, and patient safety obligations that ISO 9001 does not address. The two standards have overlapping architecture but distinct compliance demands. 3. I already have ISO 9001—how long does it take to get ISO 13485 certified?

The timeline depends on how mature your existing quality system is relative to ISO 13485:2016 requirements. KSQA issues your certificate within 2–3 days of a successful Stage 2 audit. Businesses that already operate structured quality management systems typically move through the gap analysis and Stage 1 review faster because core process controls are already in place. Request a fixed-price quote from KSQA based on your organization's scope. 4. Does ISO 13485 certification satisfy FDA 21 CFR Part 820 requirements?

Yes—for the QMS component of 21 CFR Part 820. The FDA QMSR, effective February 2, 2026, incorporates ISO 13485:2016 as the recognized QMS framework for US medical device manufacturers. Certification from an accredited body such as KSQA demonstrates that your quality management system conforms to the federally recognized standard. 5. How do I choose the right certification body for ISO 13485?

Choose a body with active IAS or equivalent accreditation for management systems certification. Accreditation confirms the body's audit processes meet international standards—without it, your certificate may not satisfy OEM or regulatory requirements. KSQA holds IAS MSCB-207 accreditation, is a member of the IAF Multilateral Recognition Arrangement, and issues certificates within 2–3 days at a fixed price.

Your Next Step Is Clear

You now know the difference between the two standards, why the 2026 FDA QMSR made ISO 13485 certification a federal regulatory baseline, and what to look for in a certification body before you commit. 

If your business designs, manufactures, or distributes medical devices, the standard you need is ISO 13485—and the body you choose determines whether that certificate holds weight where it matters most.

Request your ISO 13485 certification quote from KSQA today—IAS-accredited, fixed pricing, and certificates issued within 2–3 business days. Visit ksqa.org to get started.