ISO 13485:2016 addresses quality management for medical devices and related services. A system certificate is separate from authorization to market a particular device.

01

Map the device and your actual role

List device groups and whether the organisation designs, manufactures, installs, services or supplies related processes. Match each activity to a site and responsibility. A component supplier’s limited scope should not be described as certification of the finished device manufacturer. Explain any non-applicability with the organisation’s actual activities and applicable requirements.

02

Keep outsourced processes visible

For outsourced sterilisation or software development, identify specifications, supplier controls, acceptance responsibilities and access to evidence. Buying a validated service does not prove that its results fit your device and process. In a hypothetical sterile device, changing the packaging supplier may affect the established process; evaluate the change before relying on old evidence.

03

Separate ISO assessment from FDA and CE routes

The FDA QMSR took effect on 2 February 2026 and incorporates ISO 13485:2016, but an ISO certificate does not exempt a manufacturer from FDA inspection. EU medical-device conformity assessment and any required notified-body involvement depend on the applicable device route. ISO 13485 certification alone is neither FDA device authorization nor permission to affix CE marking.

04

Prepare the application boundary

Provide device groups, processes, sites, workforce, external providers and the status of design, risk and validation records. Identify target markets so regulatory obligations can be evaluated separately. Do not promise one certificate will open every market. Regulatory files, product evaluation and management-system audit can have different evidence needs and decision authorities.

05

Preparation and independent decision

ISO does not issue certificates. Verify the proposed issuer, standard and activity against any claimed accreditation scope. Consultancy cannot guarantee approval; the competent body evaluates evidence and makes the independent decision. The applicant implements the system and prepares procedures specific to its own operations and operating records. A certification enquiry to Kayra concerns actual activities, sites, application information, authority and impartiality risks; this role does not include designing or implementing the client’s system. A management-system certification body, other parts of the same legal entity and controlled entities cannot offer or provide management-system consultancy; separate contracts do not remove this restriction.

Sources and application limits

The sterile-device example is hypothetical. Confirm the current device classification and market route with the competent authority; no customer result or product approval is claimed.