ISO 13485 certification is a de facto condition for manufacturers seeking access to the European market under the MDR. Timelines and costs are systematically underestimated, which generates delayed projects and overrun budgets. Here is an honest schedule.
Phase 1: gap analysis (4 to 6 weeks)
Before building anything, an assessment of the current state is essential. Which procedures already exist? Which processes are documented? Which records are retained? What is the organisation’s real maturity against the requirements of the standard?
The gap analysis produces a prioritised gap dashboard: critical (blocking for certification), important (to be addressed before the audit), and minor (improvements to be planned). This dashboard is the work plan for the following phases.
Do not skip this step. A certification project that begins by drafting procedures without a prior gap analysis produces procedures that do not match reality and that will have to be rewritten.
Phase 2: building the QMS (3 to 6 months depending on size)
Drafting or updating procedures, putting processes in place, training teams, deploying document management tools. This is the most variable phase: it depends on the starting state, the number of processes to create or overhaul, and the internal resources available.
A point often overlooked: building the QMS cannot be done entirely “from the outside”. A consultant can draft the procedures and structure the processes. But the internal teams must take ownership of the system. A QMS imposed from the outside without internal ownership collapses at the first surveillance audit.
Phase 3: running in the QMS (3 to 6 months)
The standard requires the QMS to be operational before the certification audit. Running in covers at least one complete cycle of internal audits (all QMS processes), at least one management review with all its inputs and outputs, and the handling of the first non-conformities and CAPA.
This is the phase that manufacturers in a hurry try to shorten. This is a mistake. A certification body that finds a QMS put in place two weeks before the audit is not fooled. And a QMS that has not been run in generates major non-conformities at the certification audit.
Phase 4: certification audit (1 to 3 months of planning lead time)
The certification audit takes place in two stages: a documentation review (Stage 1) followed by an on-site audit (Stage 2). In the event of major non-conformities at Stage 2, a follow-up audit is scheduled before the certificate is issued.
Planning lead times with the certification body vary according to the time of year and the certifier chosen. Allow 6 to 12 weeks between the application and the audit.
Realistic total timelines
For an SME of 10 to 50 people that allocates sufficient resources to the project, the total time between launch and obtaining the certificate is 12 to 18 months. Aiming for less than 12 months is possible when starting from an existing base (ISO 9001, documented processes). Claiming to do it in 6 months starting from scratch is misplaced optimism.
Indicative budget ranges
External support. A consultant covering the gap analysis, building the QMS and preparing for the audit typically mobilises 20 to 40 days of service for a standard SME. At the daily rate of a senior medical device consultant, the range is 20,000 to 45,000 euros.
Certification audit. The certification body charges according to the number of audit days, calculated on the size of the organisation. For an SME of fewer than 50 people: 2 to 4 audit days, i.e. 5,000 to 12,000 euros excluding travel expenses.
Internal cost. This is the cost that most manufacturers forget in their calculation. A quality manager who devotes 40 to 50% of their time over 12 to 18 months is a real cost. It must appear in the project budget.
The total cost of an ISO 13485 certification starting from scratch, taking all these items into account, is typically between 40,000 and 80,000 euros for a standard SME. It is a significant investment. It is also the condition of access to a demanding market.