Quality Management Systems
Active ISO 13485 certificates worldwide
FDA device warning letters issued in 2025
Jurisdictions covered under a single MDSAP audit
Regulation Overview
ISO 13485:2016
ISO 13485 is the international quality management system standard governing medical device design, development, production, storage, distribution, installation, and servicing. For supply chain and compliance teams, the central obligation is maintaining documented evidence that every supplier, process, and component meets regulatory requirements for safety and performance.
Over 32,000 organizations hold active ISO 13485 certificates globally. With the FDA's QMSR now in effect since February 2, 2026, ISO 13485:2016 is directly incorporated into US federal regulation—making ISO 13485 compliance the single quality system baseline for both domestic and international market access. Notified Bodies under the EU MDR require demonstrated ISO 13485 conformity for CE marking. MDSAP enables a single audit to satisfy five regulatory authorities simultaneously.
ISO 13485 compliance requires process-level documentation—quality agreements, supplier evaluations, design verification records, and CAPA evidence—from every critical supplier. When regulatory requirements shift, your entire supplier qualification portfolio requires reassessment.
Medical device manufacturers designing, producing, or servicing devices for any regulated market
Contract manufacturers performing outsourced sterilization, assembly, packaging, or testing
Component and raw material suppliers to medical device OEMs
Distributors and importers placing medical devices on regulated markets
Software developers producing Software as a Medical Device (SaMD) or embedded device software
Service organizations providing calibration, installation, or maintenance under OEM quality agreements
Key Thresholds
Your medical device ships to the EU, US, Canada, and Japan. Each market requires QMS evidence aligned to ISO 13485 plus jurisdiction-specific requirements. Notified Body audits, FDA QMSR inspections, and MDSAP assessments demand different record sets—but your supplier quality data lives in separate spreadsheets, email chains, and shared drives. Your team spends weeks compiling evidence packages for each audit cycle.
Clause 7.4.1 requires documented re-evaluation of every supplier at risk-based intervals. You have 200 suppliers across four tiers. Evaluation criteria vary by component risk classification. Twelve suppliers changed manufacturing sites this year. Three certifications expired without notification. Your approved supplier list is six months stale—and the next MDSAP audit is in eight weeks.
FDA cited CAPA deficiencies in 68% of warning letters. Your CAPA system logs corrective actions—but verification of effectiveness is undocumented. Trend analysis across complaints, nonconformances, and supplier deviations is manual. When investigators trace a complaint to its root cause, the trail goes cold at a supplier's incoming inspection record that no one can locate.
Every design change requires updated inputs, outputs, verification, validation, and risk analysis. Complex devices with hundreds of components generate thousands of design records across multiple suppliers. Tracing a single material change through design history files, risk management files, and supplier quality agreements takes days of manual cross-referencing. Continuous compliance monitoring at this scale requires AI document parsing and certificate validation.
Certivo In Action
Certivo in Action — ISO 13485 Workflow
Features Tabs
From Manual Compilation to Automated Evidence Generation
CORA extracts and validates supplier quality documents automatically. Your team focuses on exceptions requiring human judgment—not manual cross-referencing of certificates and quality agreements. AI-native compliance automation replaces spreadsheet-based tracking.
Audit Evidence Acceleration
Generate complete, audit-ready documentation packages for MDSAP, Notified Body, or FDA QMSR inspections in hours—not the 4–6 weeks of manual compilation across supplier files.
Proactive ISO 13485 Compliance Through Regulatory Intelligence and Horizon Scanning
When supplier certifications expire, accreditation scopes change, or regulatory requirements evolve, Certivo reassesses your supplier qualification portfolio instantly. Know which suppliers require re-evaluation before auditors ask.
Frequently Asked Questions
What organizations are subject to ISO 13485 compliance obligations?
Any organization involved in the medical device lifecycle must comply—including manufacturers, contract manufacturers, component suppliers, software developers, sterilization providers, distributors, and importers. With the FDA's QMSR incorporating ISO 13485:2016 by reference since February 2026, US market access now requires ISO 13485-aligned quality systems. CORA helps organizations across the supply chain maintain audit-ready quality documentation regardless of their role in the device lifecycle.
What are the consequences of ISO 13485 non-compliance?
Consequences vary by jurisdiction but are significant. In the US, FDA enforcement includes warning letters, product seizure, injunctions, and withheld export certificates—44 warning letters cited device manufacturers in FY2025 alone. In the EU, Notified Bodies can suspend or withdraw CE certificates, blocking market access. MDSAP nonconformity grades can trigger increased regulatory scrutiny across all five participating jurisdictions. Certivo's continuous compliance monitoring helps organizations identify and resolve gaps before they become audit findings.
How does Certivo manage ISO 13485 supplier qualification at scale?
Certivo automates the entire supplier qualification lifecycle—from initial evaluation campaigns through ongoing re-evaluation. CORA collects quality documents in any format and language, extracts certification scope and expiry data automatically, scores supplier risk based on quality performance, and triggers re-evaluation workflows when certifications approach expiry or quality metrics decline. The platform serves as a centralized compliance data backbone across your entire approved supplier list.
Does Certivo support multi-framework compliance alongside ISO 13485?
Yes. Certivo validates a single supplier submission against ISO 13485, EU MDR, FDA QMSR, MDSAP, REACH, RoHS, and additional frameworks simultaneously through BOM substance and threshold management capabilities. This eliminates duplicate collection campaigns and gives compliance teams a unified view of supplier qualification status across quality, substance, and environmental requirements through digital passport and traceability systems.
How does Certivo help with FDA QMSR transition readiness?
Certivo maps your existing supplier quality documentation against QMSR requirements, identifies gaps between legacy QSR records and ISO 13485:2016 expectations, and generates QMSR-aligned evidence packages. CORA parses historical quality agreements and supplier evaluations to flag areas requiring updates—particularly the expanded inspection scope covering internal audits, supplier evaluations, and management reviews that FDA inspectors can now access under QMSR. Specialized substance reporting solutions complement the quality system documentation.