One question comes up in almost every SME going through compliance: “If we are ISO 13485 certified, are we MDR compliant?” The answer is no. And the misunderstanding is not trivial. A manufacturer who mistakes the certificate for regulatory compliance discovers the gap at the worst possible moment, in front of the notified body. Understanding where the boundary lies saves months of delay.
What ISO 13485 covers, and its limits
ISO 13485 is a quality management standard. It governs the way the manufacturer organises its internal processes: documentation, design, production, purchasing, non-conformities, audits, continuous improvement. The certification attests that this QMS conforms to the requirements of the standard.
What it does not certify: that the devices produced conform to the requirements of the MDR. The standard organises the “how”. The regulation sets the “what” on the product itself. To confuse the two is to mistake the tool for the result.
What the MDR requires in addition
The MDR sets requirements on the products and on the manufacturer’s regulatory obligations that ISO 13485 does not directly cover.
The technical file
The MDR requires technical documentation for each device (Annexes II and III): demonstration of conformity with the general safety and performance requirements of Annex I, clinical evaluation, risk management. ISO 13485 requires that the process for creating this documentation be controlled. It does not define the content of the MDR technical file.
The clinical evaluation
Article 61 of the MDR requires a documented clinical evaluation that is updated throughout the lifecycle, including post-market clinical follow-up (PMCF). ISO 13485 has no direct equivalent to this requirement.
Classification and conformity procedures
The rules of Annex VIII and the conformity assessment procedures (Article 52, Annexes IX to XI) are placing-on-the-market requirements, not quality system requirements.
EUDAMED, UDI, vigilance
These operational MDR obligations have no equivalent in ISO 13485. Registration in EUDAMED, the assignment of UDIs under Article 27, and the vigilance reports of Articles 87 to 92 fall under the regulation, not the standard.
Where the two meet: Article 10(9)
Article 10(9) of the MDR lists the aspects that the manufacturer’s QMS must cover. These elements overlap largely with the processes of ISO 13485: management responsibility, resource management, selection and control of suppliers and subcontractors, risk management, product realisation, corrective and preventive actions.
One point deserves attention. The QMS required by the MDR goes further than ISO 13485 on its own ground. Article 10(9) requires the QMS to include a strategy for regulatory compliance, the clinical evaluation and PMCF, verification of UDI assignments, the post-market surveillance of Article 83, and vigilance. In other words, even at the quality system level, the regulation asks for more than the standard.
That leaves the question of legal value. ISO 13485 certification provides a solid foundation, not an automatic presumption of MDR conformity. The harmonisation of EN ISO 13485 under the regulation is partial, with Z annexes that list the gaps. Notified bodies verify MDR conformity directly, never by delegating it to the certification.
In practice: building a QMS with two readings
Aiming for ISO 13485 certification as the finishing line is a sequencing mistake. It is a means, structuring and reproducible, not the proof of conformity with the regulation.
A manufacturer that meets the MDR requirements without a structured QMS may manage it once. It will not sustain it over time, nor under audit. Conversely, one that builds its QMS aiming simultaneously at ISO 13485 and the MDR requirements saves real time: a single documentary architecture, two readings, a single maintenance effort. Treating the two projects in parallel rather than in sequence is the difference between a QMS that endures the regulation and a QMS that carries it.
Are you building or revising your QMS and want it to hold both readings, ISO 13485 and MDR, without duplicate work? Talk to us.