ISO 13485 certification starting from scratch takes between 12 and 24 months in a standard SME. What follows is a realistic timeline, month by month, for an SME of 15 to 30 people that allocates serious resources to the project. This is not the optimal timeline — it is the probable timeline.
Months 1-2: diagnostic and action plan
The diagnostic audit assesses the current situation against the requirements of ISO 13485:2016 and the applicable MDR requirements. It produces a gap dashboard with a prioritisation: critical (blocking for certification), important (to be addressed before the audit), and minor.
This diagnostic takes 3 to 5 days of actual work on site and remotely. The detailed action plan that follows from it — with the deliverables, the owners and the milestones — is the roadmap for the next 12 to 18 months.
Months 3-6: building the core of the QMS
Drafting the quality policy and the quality objectives. Process mapping. Drafting the mandatory procedures (document control, record control, non-conformities, CAPA, internal audit). Defining the performance indicators per process.
This is the most intense phase in terms of documentary output. It requires strong involvement from the internal process owners — not just the quality manager. A purchasing management procedure that does not reflect the reality of purchasing at this manufacturer will have to be rewritten.
Months 7-9: deployment and training
The drafted procedures must be deployed, understood and applied. Training the teams on the new procedures. First real records of non-conformities, CAPAs and incoming inspections.
This is the slowest phase to embed. Teams need time to change their working habits.
Months 10-12: running in the QMS
Carrying out the first complete internal audits covering all processes. First management review with all the inputs of section 5.6.2. Handling and closing the first CAPAs arising from the internal audits. Adjusting the procedures on the basis of the first experiences.
The minimum running-in period for a notified body to consider the QMS as operational is generally 3 to 6 months.
Months 13-15: certification preparation and selection of the certification body
Selecting the certification body. Mock audit (audit simulation) to identify the residual gaps. Correcting the last points before the audit.
Months 15-18: certification audit and issuance of the certificate
Stage 1 (document review): 2 to 4 weeks. Correcting any observations. Stage 2 (on-site audit): 2 to 5 days depending on the size of the organisation. Handling any non-conformities. Issuance of the certificate.
What systematically extends the timeline
Underestimating the deployment and training phase. Delays in the internal audits (always pushed back). Open and untreated CAPAs that pile up. And the temptation to submit for certification before the QMS is genuinely run in.