ISO 13485 application: device activity and system scope

Decision and conditional example

For a hypothetical manufacturer using outsourced sterilisation, connect supplier control, process results and product release to the system scope. Outsourcing does not remove the manufacturer’s control responsibility. Where design is not performed, consider applicability against the actual role and regulatory conditions; do not hide design work simply to simplify certification. Plan preparation around gaps, competence and real device and process records. Separate destination-market registration, authorisation and conformity routes from the ISO application. Verify the independent body’s competence and current coverage for the relevant medical-device activities.

Evidence linked to this purpose

• Device groups and organisational role
• Outsourced process and release responsibility
• Separate destination-market regulatory route

Standard and authority boundaries

ISO 13485:2016 concerns medical-device quality management systems. Its certificate is not device CE conformity, market authorisation or FDA approval. FDA’s QMSR took effect on 2 February 2026 and incorporates ISO 13485 within a regulatory framework; an ISO certificate does not exempt a manufacturer from FDA inspection. Device and destination-market duties require separate verification.

Kayra’s role and the independent decision

The applicant implements the system and prepares procedures specific to its own operations and operating records. A certification enquiry to Kayra concerns actual activities, sites, application information, authority and impartiality risks; this role does not include designing or implementing the client’s system. ISO publishes standards and does not certify organisations. Verify the chosen body’s current standard edition, activity coverage and any claimed accreditation. Preparation does not guarantee approval, legal compliance or authority to certify a newly published edition. A management-system certification body, other parts of the same legal entity and controlled entities cannot offer or provide management-system consultancy; separate contracts do not remove this restriction.

Official sources

Checked: 3 October 2026. Examples are hypothetical explanations, not claims about completed client work, local offices or approval.

• ISO 13485:2016
• FDA — QMSR
• FDA — QMSR FAQ
• European Commission — medical devices
• ISO – Certification
• ISO/IEC 17021-1
• GSO ISO/IEC 17021-1