ISO 9001:2015 is a general quality management standard for any organisation, built around customer satisfaction and continual improvement. ISO 13485:2016 is the quality management standard for medical devices, designed to help organisations meet regulatory requirements and consistently supply safe, effective devices.
The two overlap heavily, but they are not interchangeable. A device maker with only ISO 9001 will usually find that regulators and device customers expect ISO 13485, and an ISO 13485 system demands far more documentation, risk management and regulatory focus.
This guide compares them in plain terms, with an example from a syringe manufacturer in Sharjah.
Different purposes
ISO 9001 asks whether customers are satisfied and whether the system is improving. ISO 13485 asks whether the system reliably meets regulatory and safety requirements and is kept effective. Regulatory requirements run through ISO 13485, and each organisation must document its role, for example manufacturer, importer or distributor.
ISO 13485 deliberately talks about maintaining effectiveness where ISO 9001 talks about continual improvement. Improvement still happens through CAPA and management review, but the priority is control of a stable, validated system.
Structure: Annex SL vs the older format
ISO 9001:2015 follows the Annex SL high-level structure shared with ISO 14001 and ISO 45001, with ten clauses including context of the organisation, leadership, planning, support, operation, performance evaluation and improvement.
ISO 13485:2016 does not follow Annex SL. Its eight clauses stay close to the older ISO 9001:2008 layout: management responsibility, resource management, product realisation, and measurement, analysis and improvement. Integrating the two therefore needs a clause cross-reference rather than a simple overlay.
ISO 9001 is under revision and a revised edition is expected, so check the current edition before planning any transition.
Key differences in practice
Documentation
ISO 9001:2015 leaves most documentation decisions to the organisation. ISO 13485 requires a quality manual, many documented procedures and a medical device file for each device type or family. It also requires validation of software used in the QMS and in production.
Risk management
ISO 9001 applies risk-based thinking to the management system. ISO 13485 requires documented risk management throughout product realisation, and most organisations meet this using ISO 14971:2019. Risk then drives design decisions, supplier controls, process validation and complaint evaluation.
Design and development
Both standards cover design, but ISO 13485 is far more detailed: planning, inputs, outputs, review, verification, validation (including clinical or performance evaluation where required), transfer to manufacturing, control of changes and a design and development file.
Sterile and implantable devices
ISO 13485 adds requirements for sterile devices, including validation of sterilisation and sterile barrier systems, sterilisation records for each batch and contamination control. Implantable devices need stricter traceability records covering components, materials and work environment conditions.
Complaints, reporting and feedback
ISO 13485 requires documented complaint handling, a decision on whether each complaint must be reported to regulatory authorities, procedures for advisory notices and a feedback process that feeds risk management. ISO 9001 handles complaints as customer feedback and nonconformity, and asks organisations to monitor customer satisfaction.
ISO 13485 vs ISO 9001 comparison table
| Area | ISO 9001:2015 | ISO 13485:2016 |
|---|---|---|
| Purpose | Generic QMS for any sector | QMS for medical device organisations and their suppliers |
| Structure | Annex SL, ten clauses | Older eight-clause format, not Annex SL |
| Main aim | Customer satisfaction and continual improvement | Regulatory compliance, safety and maintained effectiveness |
| Documented procedures | Few mandated | Many mandated, plus quality manual and medical device file |
| Risk | Risk-based thinking across the QMS | Documented risk management in product realisation, usually via ISO 14971 |
| Design | General design and development controls | Detailed controls including design transfer and a design file |
| Sterile and implantable devices | Not addressed | Specific requirements |
| Complaints | Customer feedback and nonconformity | Documented complaint handling and regulatory reporting decisions |
| Software validation | Not specifically required | Required for QMS and production software |
| Exclusions | Organisation justifies requirements that cannot apply | Only clauses 6 to 8, justified; design excluded only where regulations permit |
Where ISO 14971, MDSAP and EU MDR fit
ISO 13485 tells you to manage risk; ISO 14971:2019 tells you how, with ISO/TR 24971:2020 as guidance. The Medical Device Single Audit Program (MDSAP) lets one audit against ISO 13485 plus country requirements serve participating regulators, including those of Australia, Brazil, Canada, Japan and the US.
In the EU, Regulation (EU) 2017/745 (MDR) requires a quality management system, and EN ISO 13485 is the standard commonly used to show conformity. In the US, FDA's Quality Management System Regulation now incorporates ISO 13485:2016 by reference. GCC regulators, including SFDA, commonly ask for ISO 13485 evidence for device registration; confirm the current requirement with each authority.
Worked example: a Sharjah syringe manufacturer holding both
A manufacturer of sterile single-use syringes in a Sharjah free zone has held ISO 9001 for years while supplying local distributors. To register products in Saudi Arabia and export further, it adds ISO 13485, and keeps ISO 9001 for a non-medical plastic packaging line.
Rather than run two systems, the QA manager builds one integrated QMS with a matrix mapping ISO 13485 clauses to ISO 9001 clauses. Shared processes such as document control, internal audit and CAPA are written to the stricter ISO 13485 requirements.
The difference shows when a hospital in Riyadh reports syringes leaking at the plunger. Under ISO 9001 alone, the team would log the complaint, investigate and correct. Under ISO 13485 it also:
- Records the complaint in the documented complaint process and decides, with a written rationale, whether the event must be reported to the authority.
- Uses lot traceability to link the batch to the resin lot, moulding machine, cleanroom records and the contract ethylene oxide sterilisation cycle.
- Reviews the risk management file to see whether leakage was foreseen and whether the risk estimate still holds.
- Assesses whether an advisory notice or recall is needed.
- Feeds the outcome into post-market surveillance and management review.
The root cause is a worn mould cavity producing undersized plungers. The repair goes through change control with revalidation of the moulding process, because a validated process has changed.
Common mistakes
- Assuming ISO 9001 certification is enough for device registration.
- Copying an ISO 9001 manual and renaming it ISO 13485.
- Treating ISO 14971 risk management as a one-off design task rather than a living file.
- Not deciding, and documenting, whether complaints are reportable.
- Forgetting software validation for QMS tools such as complaint databases and ERP.
- Excluding design controls without a regulatory basis.
Key takeaway: ISO 9001 builds a customer-focused, improving QMS for any sector. ISO 13485 builds a regulatory-focused, risk-driven and heavily documented QMS for medical devices. If you make, supply or service devices, ISO 13485 is usually what regulators and customers expect.
Frequently Asked Questions
Can you have ISO 13485 without ISO 9001?
Yes. ISO 13485 is a standalone standard, and certification to it does not require ISO 9001. Many device companies hold only ISO 13485, while some hold both because they also make non-medical products or customers ask for it. ISO 13485 itself notes that conforming to it does not by itself mean conformity with ISO 9001.
Is ISO 13485 harder to implement than ISO 9001?
Usually, yes. ISO 13485 mandates more documented procedures and records, documented risk management, detailed design controls, software and process validation, and complaint handling linked to regulatory reporting. Organisations with a mature ISO 9001 system have a head start, but should expect significant work on risk files, validation and regulatory processes.
Does ISO 13485 require continual improvement?
ISO 13485 focuses on maintaining the effectiveness of the QMS rather than continual improvement as a stated aim. In practice, improvement still happens through CAPA, internal audits, data analysis and management review. Changes must be controlled and assessed for their effect on safety and regulatory compliance, which is why stability is valued so highly.
Is ISO 13485 mandatory for medical device manufacturers?
The standard itself is voluntary, but many regulators rely on it. EU MDR conformity commonly uses EN ISO 13485, MDSAP audits are built on it, FDA's QMSR incorporates it by reference and GCC authorities frequently ask for it. Whether certification is required depends on the market and device class, so confirm with the relevant authority.
Do suppliers and distributors need ISO 13485?
Not always, but it helps. ISO 13485 applies to organisations at any stage of the device life cycle, including component suppliers, sterilisation providers, importers and distributors. Device manufacturers often prefer or require certified critical suppliers, and some authorities expect it of importers or distributors. Check your customers' supplier requirements and local rules.
Next steps
To build a device QMS that satisfies auditors and regulators, see Medical Device Quality Management: ISO 13485. For a broader foundation in quality systems, ISO 9001 Essentials: Quality Management Systems Practical Implementation covers the general standard. You can also speak to a counsellor.
Related reading: ISO 9001 quality management checklist, risk-based thinking in ISO 9001 and FMEA risk assessment in laboratories.
Looking for structured certification?
Explore Innoryx courses or speak to a counsellor about the right program for you.