TL;DR
ISO 13485 becomes essential when manufacturing activities must support regulatory compliance, commercial distribution, device licensing, notified body assessment, customer qualification, or reliable production at scale. In the United States, the FDA Quality Management System Regulation now incorporates ISO 13485:2016 requirements, but the FDA does not require manufacturers to obtain an ISO 13485 certificate. In Canada, an ISO 13485 quality management system certificate issued through the Medical Device Single Audit Program is required for Class II, III, and IV device licensing. In Europe, manufacturers must maintain a compliant quality management system, and notified body involvement makes ISO 13485 certification a practical expectation for most devices beyond basic Class I products.
The best time to begin operating under an ISO 13485-aligned quality system is usually before design verification, process validation, clinical manufacturing, or commercial production begins. Waiting until submission or scale-up often forces teams to reconstruct records, repeat builds, requalify suppliers, and explain why earlier data should be considered reliable.
Certification, Compliance, and the Real Question
The question, “When do you need ISO 13485 for manufacturing?” sounds straightforward, but it usually contains two different questions.
The first is whether your organization must comply with ISO 13485 requirements. The second is whether your organization must obtain a formal ISO 13485 certificate from an accredited certification body.
Those are not the same thing.
ISO 13485 is the internationally recognized quality management system standard for organizations involved in the design, manufacture, installation, servicing, and related lifecycle activities of medical devices. It establishes requirements for documented processes, management responsibility, risk-based decision-making, supplier controls, design and development, production controls, validation, complaint handling, corrective action, and ongoing improvement of the quality system.
An organization may be required to operate in accordance with those requirements even when it is not required to hold a third-party ISO certificate. This distinction is particularly important in the United States. Effective February 2, 2026, the FDA’s Quality Management System Regulation, or QMSR, incorporates ISO 13485:2016 by reference. Manufacturers subject to 21 CFR Part 820 must document a quality management system that complies with the applicable ISO 13485 requirements, along with additional FDA-specific provisions.
However, the FDA explicitly states that it does not require ISO 13485 certificates, does not issue them, and does not exempt certified companies from FDA inspection. A certificate demonstrates that a third-party auditor assessed the organization against the standard. It does not replace compliance with the Federal Food, Drug, and Cosmetic Act, FDA reporting obligations, registration and listing requirements, labeling rules, or other applicable regulations.
This is why the real decision is broader than whether a certificate is mandatory. Medical device companies should evaluate:
- Markets Where the Device Will Be Sold
Quality system and certification expectations vary by jurisdiction. - Device Classification
Higher-risk devices generally face greater regulatory and conformity assessment scrutiny. - Stage of Development
Feasibility prototypes have different documentation needs than verification, clinical, or commercial units. - Manufacturing Responsibilities
The legal manufacturer remains accountable even when production is outsourced. - Customer and Investor Requirements
Strategic partners may require certification before approving a supplier or transaction. - Intended Use of Manufacturing Data
Builds supporting submissions or validation require stronger controls and traceability than exploratory prototypes.
A company that focuses only on the certificate may miss the more important issue: whether its development and manufacturing records can demonstrate that the device was designed and produced consistently, under controlled conditions, using approved materials, processes, equipment, and suppliers.
When ISO 13485 Becomes Necessary
ISO 13485 should not be treated as a milestone that appears suddenly at commercial launch. Its relevance increases progressively as a device moves from early experimentation into regulated development and manufacturing.
For commercial manufacturing in the United States, finished device manufacturers intending to commercially distribute medical devices are generally subject to the FDA QMSR unless a specific exemption applies. The regulation now uses ISO 13485:2016 as its foundational quality management system framework. Manufacturers must therefore meet the applicable requirements incorporated into 21 CFR Part 820, even though obtaining a separate ISO certificate is not an FDA prerequisite. Certain device types may be exempt from some current good manufacturing practice requirements, but exemptions should always be confirmed through the applicable FDA classification regulation rather than assumed from device class alone.
For the Canadian market, certification is more explicit. Canada’s Medical Devices Regulations require Class II licence applications to include a certificate covering the quality system under which the device is manufactured. Class III and IV applications require a certificate covering the system under which the device is designed and manufactured. These certificates must demonstrate conformity with CAN/CSA-ISO 13485 and are accepted through Health Canada’s Medical Device Single Audit Program framework.
For the European Union, Article 10 of the Medical Device Regulation requires manufacturers to establish, document, implement, maintain, update, and continually improve a quality management system that is proportionate to the device’s risk class and type. Notified body assessment is required under common conformity assessment routes for Class IIa, IIb, and III devices, as well as for certain aspects of Class I sterile, measuring, and reusable surgical devices. European standards remain voluntary as a legal matter, but ISO 13485 is widely used to structure the quality system that notified bodies assess.
Basic Class I devices that are not sterile, do not have a measuring function, and are not reusable surgical instruments may generally be self-declared under the EU MDR. In those circumstances, third-party ISO 13485 certification may not be legally required. The manufacturer must still comply with applicable MDR obligations, maintain technical documentation, control production, manage risk, address post-market responsibilities, and establish an appropriate quality management system. The absence of a notified body certificate is not the absence of quality system responsibility.
ISO 13485 also becomes functionally necessary when a company enters into a commercial agreement that requires it. Established device manufacturers frequently require contract manufacturers and critical suppliers to hold ISO 13485 certification as part of supplier qualification. Investors, acquirers, distributors, and strategic partners may also view certification as evidence that the organization has moved beyond informal development practices and established repeatable operational controls.
The certificate’s scope deserves close attention. A certificate covering only distribution or servicing does not establish that the organization has been certified for medical device design or manufacturing. The certified sites, product categories, and covered activities should match the work the organization is expected to perform.
When Certification May Not Yet Be Required
Not every early-stage manufacturing activity must occur under a fully certified ISO 13485 system.
During early feasibility work, teams may produce proof-of-concept models, benchtop assemblies, engineering samples, or nonclinical prototypes primarily to evaluate technical principles. These units may be built through rapid, flexible processes because their purpose is learning, not demonstrating final product conformity.
The distinction is not simply whether something is called a prototype. What matters is how the unit and the resulting data will be used.
A prototype used to explore geometry, materials, user interaction, or basic functionality may not need commercial-level production controls. A unit used for formal design verification, biocompatibility testing, packaging validation, sterilization validation, shelf-life testing, clinical investigation, or regulatory submission carries a very different evidentiary burden. The organization may later need to show exactly which design revision was built, which materials and suppliers were used, how deviations were handled, and whether the manufacturing process was representative of the intended device.
FDA guidance on the QMSR confirms that investigational devices are not exempt from applicable design and development requirements. As a result, teams should not assume that clinical or investigational status allows them to postpone design controls until commercialization.
A practical stage-based approach is:
- Concept and Feasibility
Formal certification may not be necessary, but design decisions and risks should still be documented. - Engineering Prototypes
Basic configuration control, approved requirements, and traceable changes become increasingly important. - Design Verification Builds
Controlled documents, approved materials, trained personnel, traceability, and deviation management should be in place. - Process and Packaging Validation
A functioning quality system is essential because the evidence must support repeatability and regulatory review. - Clinical Manufacturing
Applicable design controls, risk controls, manufacturing records, and investigational requirements must be addressed. - Commercial Manufacturing
Regulatory quality system requirements apply, subject to jurisdiction and device-specific exemptions.
One common mistake is allowing development builds to continue informally for too long. The device may become technically mature while the documentation remains fragmented across spreadsheets, emails, handwritten notes, and individual engineers’ computers. When the company reaches verification or transfer, it discovers that it cannot clearly establish the approved bill of materials, design revision, inspection criteria, supplier status, or manufacturing history.
The opposite mistake is overbuilding the quality system too early. A startup may purchase a large document library or enterprise software platform before its organization, device architecture, regulatory pathway, and manufacturing model are sufficiently defined. This often produces procedures that no one follows because they were written for a much larger or fundamentally different business.
The better approach is a staged quality system. Early controls should be simple but real. As the device matures, those controls should expand to cover document approval, design reviews, supplier qualification, training, nonconformance, corrective action, equipment, calibration, process validation, production records, complaints, and post-market activities.
Pathway’s low-volume medical device manufacturing model is designed for this transition point, where teams need flexibility for controlled iteration but must also begin generating traceable, submission-ready manufacturing evidence. Pathway publicly describes support for engineering builds, design verification, process refinement, early commercialization, quality documentation, and production transfer within an ISO 13485 environment.
What Outsourcing Changes
Outsourcing manufacturing does not outsource accountability.
A medical device company may rely on a contract manufacturer for procurement, assembly, molding, machining, testing, packaging, sterilization coordination, labeling, or final release activities. Even so, the organization placing the device on the market generally remains responsible for ensuring that outsourced processes are appropriately selected, controlled, monitored, and documented.
This is a frequent source of misunderstanding. A startup selects an ISO 13485-certified contract manufacturer and assumes that the manufacturer’s certificate automatically makes the product compliant. It does not.
The contract manufacturer’s quality system governs its operations, but the device company must still establish the requirements the manufacturer is expected to meet. Those requirements normally include approved specifications, drawings, bills of materials, inspection methods, acceptance criteria, process requirements, traceability expectations, change notification rules, deviation authority, complaint escalation, record retention, and responsibilities for regulatory reporting.
The quality agreement should clarify who is responsible for activities such as:
- Supplier approval and ongoing supplier monitoring
- Design changes and manufacturing changes
- Nonconformance review and disposition
- Process validation and equipment qualification
- Device release and record approval
- Complaint investigation and corrective action
- Regulatory inspection support
- Record retention and document access
These responsibilities should not be assigned solely through assumptions, purchasing terms, or informal email exchanges. Ambiguity tends to surface at the worst possible time, such as during a failed validation, supplier disruption, complaint investigation, regulatory inspection, or product recall.
Another mistake is choosing a contract manufacturer based only on whether it has an ISO certificate. Certification is an important screening criterion, but it does not establish technical fit. A manufacturer may be certified and still lack experience with the device’s materials, cleanliness requirements, joining methods, inspection technologies, sterilization pathway, packaging configuration, or production volume.
The manufacturer should be evaluated for both quality system maturity and process capability. The audit should examine how the company actually controls documents, trains operators, approves suppliers, handles nonconformances, validates processes, maintains equipment, investigates failures, and implements changes. The goal is to determine whether the manufacturer’s real operating system matches the process described in its procedures.
Pathway supports design, regulatory planning, pilot and verification builds, packaging and sterile barrier activities, process validation, cleanroom assembly, and production transfer. This integrated structure can help reduce the gaps that occur when engineering, quality, and manufacturing are handled by separate organizations with poorly defined handoffs.
Building the Right System at the Right Time
An effective ISO 13485 quality system should make work more controlled and understandable. It should not create documentation simply for the sake of documentation.
The strongest systems are built around the organization’s actual products, risks, responsibilities, and workflows. Procedures should be detailed enough to produce consistent results but practical enough that employees can follow them under normal operating conditions.
Several areas deserve attention before regulated manufacturing begins.
Define the intended markets and regulatory pathway. Quality system scope should be driven by where the device will be sold, its classification, the applicable conformity assessment pathway, and the organization’s role. A United States-only strategy, a Canadian licence strategy, and a combined United States and EU commercialization strategy may create different certification and audit requirements.
Determine which builds must be production-representative. Before formal testing begins, teams should decide whether the tested units must reflect the final design, final materials, qualified suppliers, manufacturing processes, packaging, sterilization method, and inspection approach. Using exploratory prototypes for formal verification can create questions about whether the results apply to the marketed device.
Control the product definition. Drawings, specifications, software versions, bills of materials, work instructions, test methods, labeling, and packaging requirements must agree. A manufacturer cannot consistently produce a device when the approved product definition is incomplete or contradictory.
Apply risk management to manufacturing. ISO 13485 uses a risk-based approach throughout quality system processes, and the FDA’s incorporation of the standard makes risk management an explicit part of the current U.S. framework. Manufacturing risk analysis should connect potential process failures to device hazards, risk controls, inspection methods, validation needs, and monitoring plans.
Qualify suppliers according to risk. Not every supplier requires the same level of scrutiny. A supplier providing a commercially available office item should not be controlled in the same way as a supplier producing a patient-contacting component, sterile barrier material, critical electronic assembly, or custom molded part. Supplier controls should reflect the effect a failure could have on device safety, performance, availability, or regulatory compliance.
Validate processes whose results cannot be fully verified later. Final inspection cannot compensate for every manufacturing weakness. Processes such as sealing, sterilization, bonding, welding, molding, coating, cleaning, and certain software-controlled operations may require validation when their output cannot be fully confirmed through subsequent inspection or testing.
Establish change control before changes become expensive. A seemingly minor material, supplier, tooling, software, packaging, or process change can affect risk documentation, verification, validation, shelf life, sterilization, labeling, regulatory submissions, or existing approvals. Change control should evaluate those downstream effects before implementation.
Prepare for objective evidence. Under the FDA’s current inspection model, investigators may review management review records, internal quality audits, and supplier audit reports that were previously protected from routine review under the former Quality System Regulation. Manufacturers should therefore ensure that these records are complete, accurate, and consistent with actual quality system performance.
A production readiness assessment can identify gaps before the company commits to validation tooling, inventory, a regulatory submission, or a large manufacturing transfer. Pathway’s production readiness and gap analysis evaluates manufacturing procedures, assembly repeatability, tooling, controlled documentation, inspection methods, and readiness for scale.
Quality as a Manufacturing Readiness Advantage
ISO 13485 is sometimes viewed as an administrative requirement that slows innovation. Poorly designed quality systems can certainly create unnecessary friction. A well-designed system does the opposite.
It clarifies what must be built, which version is approved, who may perform the work, how the product will be inspected, how deviations will be evaluated, and what evidence must be retained. That structure reduces dependence on tribal knowledge and makes manufacturing more transferable, scalable, and resilient.
It also protects the value of development work. A successful test is far more useful when the organization can demonstrate which device was tested, how it was manufactured, whether the equipment was controlled, whether the operators were trained, and whether deviations could have affected the result.
For many companies, the right question is therefore not, “How long can we avoid ISO 13485?” It is, “At what point will uncontrolled work create more risk and rework than a structured quality system would?”
The answer is usually before the first major evidence-generating build. Once a program is approaching design verification, clinical manufacturing, process validation, packaging validation, sterilization validation, regulatory submission, or commercial transfer, quality system controls should already be operating. Certification timing can then be planned around market requirements, customer expectations, notified body availability, and the scope of manufacturing activities.
Pathway Medtech can support this progression through integrated medical device development, quality and regulatory support, controlled low-volume manufacturing, verification and validation builds, packaging support, process development, and commercial manufacturing preparation. Its public capabilities emphasize continuity between engineering, quality, and manufacturing, which is particularly valuable when a device is moving from a functional prototype into a repeatable regulated product.
The objective is not certification for its own sake. The objective is a manufacturing system that can repeatedly produce a device that meets its approved requirements, protects patients, withstands regulatory scrutiny, and supports sustainable commercialization.
References
- FDA, Quality Management System Regulation: Current FDA overview of the QMSR, its February 2, 2026 effective date, applicability, incorporation of ISO 13485:2016, exemptions, and inspection framework.
- FDA, QMSR Frequently Asked Questions: Clarifies that the FDA does not require or issue ISO 13485 certificates and that certification does not exempt a manufacturer from inspection.
- Electronic Code of Federal Regulations, 21 CFR Part 820: Current regulatory text requiring covered manufacturers to document a quality management system that meets applicable ISO 13485 and FDA requirements.
- International Organization for Standardization, ISO 13485:2016: Official overview of the medical device quality management system standard and its intended application across design and manufacturing activities.
- European Union Medical Device Regulation: Establishes manufacturer quality management system and conformity assessment obligations for devices placed on the EU market.
- Health Canada Medical Devices Regulations: Specifies quality management system certificate requirements for Class II, III, and IV medical device licence applications.
- Health Canada Medical Device Single Audit Program: Explains Canada’s participation in MDSAP and its use for medical device quality system oversight.
