How to Verify ISO 13485 Certification
A medical device QMS certificate is not regulatory clearance. Where the register lives, what the scope line has to say, and which questions ISO 13485 never answers.
Introduction
A contract manufacturer sends over a PDF: ISO 13485:2016, a certificate number, a registrar's logo, an expiry date two years out. The buyer reads it as "this supplier is FDA-cleared" and stops looking. That reading is wrong, and it is the most expensive misunderstanding in this market right now, because the US rule covering device quality systems just changed shape underneath it.
ISO 13485 is a quality management system (QMS) certificate — proof that an independent auditor checked a defined set of processes against a standard. It is not proof that any government agency has approved anything. Knowing how to verify a medical device supplier's iso 13485 certificate means checking it the way you would check any management-system certificate, plus a harder second pass: does the scope on the page cover what you are actually buying, and does the certificate answer the regulatory question you think it answers. Most of the time, it does not answer that question at all.
This article covers both passes.
What ISO 13485 covers
ISO 13485:2016, "Medical devices — Quality management systems — Requirements for regulatory purposes," is a QMS standard for organizations anywhere in the medical device life cycle. That includes design, production, installation, and servicing of devices, and it reaches further than just the company whose name sits on the finished product.
A contract manufacturer, a component supplier, a sterilization service, or a distributor can each hold its own ISO 13485 certificate, scoped to what that company actually does. The standard explicitly covers organizations supplying components, raw materials, or services that a device maker's QMS depends on, not only whoever assembles the finished device. A certificate from a bolt supplier or a sterilization contractor is a real, separate document, not a secondhand reflection of a customer's certificate.
ISO 13485 against ISO 9001
People often assume ISO 13485 is ISO 9001 with medical paperwork bolted on. It is not, and the difference is structural, not cosmetic.
When ISO 9001 was revised in 2015, most management-system standards were rebuilt on Annex SL, a common high-level structure ISO uses to keep its standards consistent with each other. ISO/TC 210, the committee responsible for 13485, decided against that rebuild. It judged that the generic structure did not fit a standard built around device safety and regulatory submissions, so the 2016 edition of ISO 13485 stayed standalone, developed in alignment with the 2008 edition of ISO 9001 rather than the 2015 one.
The practical consequence: holding one certificate never implies the other. They are separately scoped, separately audited, and issued as separate documents, even when the same registrar issues both to the same company. A supplier can be a fully certified ISO 9001 shop and hold nothing under ISO 13485, or the other way around.
| Dimension | ISO 13485 | ISO 9001 |
|---|---|---|
| Current edition | 2016 | 2015 |
| Structure | Standalone, not built on Annex SL | Built on Annex SL high-level structure |
| Primary driver | Regulatory compliance and patient safety | Customer satisfaction and process effectiveness |
| Risk management | Required throughout the QMS and product life cycle | General risk-based thinking, less prescriptive |
| Design controls | Explicit requirements tied to regulatory submissions | Present, but general and not regulation-specific |
| Traceability | Deep device- and lot-level traceability through the supply chain | General, where applicable, less prescriptive |
| Sterile and implantable provisions | Specific clauses for sterile and implantable devices | None |
| Customer satisfaction clause | De-emphasized or absent | Explicit, required clause |
| Does one imply the other | No | No |
Who issues the certificate, and who accredits them
The chain behind an ISO 13485 certificate is the same chain behind any accredited management-system certificate. The International Accreditation Forum (IAF) sits above national accreditation bodies — ANAB in the US, UKAS in the UK — which accredit certification bodies, often called registrars, which then audit companies and issue certificates. IAF CertSearch is the global register fed by that network, with the same coverage gaps that apply to any standard it covers: a missing listing is not proof of a fake certificate.
What is specific to 13485 is that accreditation is scope-specific. A registrar accredited for ISO 9001 is not automatically accredited for ISO 13485 — ANAB, for instance, runs a separate "ISO 13485 Medical Device" accreditation program apart from its general QMS program. Before trusting a 13485 certificate, confirm through the accrediting body's own directory that the registrar's accreditation explicitly names ISO 13485, not just a general quality-management scope.
Check the certificate against the registrar's register
Once the registrar's accreditation is confirmed for ISO 13485, the lookup itself works the same way it does for any management-system certificate: find the registrar's own public register if one exists, search by certificate number or company name, and confirm the certificate number, company name, site, and status match what you were sent. Cross-check in IAF CertSearch as a second, independent source, keeping in mind the same data-feed gaps that apply there for any standard.
What differs is what you check the result against — not a generic quality scope, but a device-specific one, which is the next section.
Reading the scope: devices, processes, and sites
A 13485 scope statement has to carry more than a 9001 one, because "quality management system" means little on its own in a device context. The scope names the specific device types or risk classes the audit covered — Class I, II, or III in the US framework, or an equivalent elsewhere. It names the specific regulated processes actually audited: sterilization, design and development of active implantable devices, or software as a medical device, for example. For a company with more than one facility, it also names which sites were covered.
Two suppliers can both describe themselves as "ISO 13485 certified" and mean very different things. One certificate might cover design, development, and sterile manufacture of implantable devices across three sites. Another might cover only distribution of finished devices from a single warehouse.
Before relying on either certificate, read the scope line for three things: which device type or class is covered, whether the specific process you need — sterilization, implantable design, software — is actually named, and whether the site you are sourcing from is the site listed on the certificate.
What the certificate does not prove
An ISO 13485 certificate is a QMS audit result. It is not a regulatory approval, a market clearance, or proof that any government agency has reviewed the company at all. Treating it as equivalent to clearance is the mistake that makes this certificate worth misreading.
It does not substitute for FDA establishment registration and device listing — two separate filings, not one. Registration covers the facility; listing covers each device that facility makes or distributes. Every US-marketing device establishment must complete both regardless of its ISO 13485 status. Holding the certificate registers nothing and lists no device.
It does not substitute for compliance with FDA's quality system regulation, known as the QMSR, which took effect February 2, 2026, two years after FDA issued the rule on February 2, 2024. QMSR replaces most of the old 21 CFR Part 820 by incorporating ISO 13485:2016 directly by reference, plus the definitions in clause 3 of ISO 9000:2015. That sounds like it should make an ISO 13485 certificate equivalent to QMSR compliance. It does not. FDA treats a private registrar's certificate as evidence toward QMSR compliance, not as proof of it, and enforces QMSR through its own inspections. FDA publishes no list of "QMSR-certified" companies — compliance is a finding from an FDA inspection, not a certificate a company holds.
It does not substitute for MDSAP, a government-recognized single-audit program covering the US, Canada, Brazil, Australia, and Japan, built on ISO 13485:2016 plus country-specific requirements. MDSAP is a different certificate from a different audit, even when the same auditing organization issues both.
It does not substitute for an EU notified-body certificate under the EU Medical Device Regulation (EU MDR), the separate conformity assessment required for CE marking and EU market access. A company can hold ISO 13485 without ever undergoing that assessment.
Where to check the regulatory questions instead
FDA's Establishment Registration & Device Listing database is public and searchable by firm name, registration number, or product code, updated weekly. Registration numbers are public; some device-listing detail is treated as more restricted, so do not assume a listing search returns everything a registration search does.
QMSR compliance has no equivalent public registry. FDA does not publish a list of QMSR-compliant firms, and it is not structured to — verify a supplier's regulatory posture through its FDA inspection history and establishment inspection reports, not through a certificate.
MDSAP has no confirmed public certificate registry either. FDA publishes an explanatory FAQ on the program, but that is not a searchable database of current MDSAP holders. Treat any MDSAP claim the way you would treat any other certificate claim: ask the supplier for the certificate and the name of the organization that issued it.
EU MDR notified-body certificates changed meaningfully this year. As of May 28, 2026, the EUDAMED Notified Bodies and Certificates module became mandatory, and its certificate data is publicly accessible — a real change from the prior state, where an outside buyer could not reliably check that data at all. Legacy certificates have until May 28, 2027 to be entered into the system, so a gap there is not automatically a red flag yet.
When the certificate does not match the supplier you are buying from
Sometimes the mismatch is obvious: the certificate names a different site, a device class you do not need, or a process — sterilization, say — that is not actually in scope for the part you are sourcing. That is not a forged certificate. It is a real certificate that does not answer the question you are asking.
Other times the registrar is not accredited for ISO 13485 at all, even though the certificate looks identical to one that is — same format, same logo placement, same confident bold text. That case is worth escalating. Ask the supplier directly for the registrar's name and the certificate number, then confirm through the accrediting body's own directory that the registrar's accreditation actually names ISO 13485, not just a general QMS scope.
A supplier who cannot produce a registrar name, or whose registrar will not confirm the certificate and its scope by phone, has told you something. A supplier whose certificate simply does not cover the device class or process you need is not lying to you — they just do not have what you need, and the certificate said so the whole time.
Conclusion
An ISO 13485 certificate tells you that an accredited registrar checked a defined scope of a device-related business against a device-specific QMS standard. Nothing else. It does not tell you the company is FDA-cleared, QMSR-compliant, MDSAP-certified, or holding an EU notified-body certificate — those are separate documents, issued under separate frameworks, checked in separate places. Read the scope line before anything else: device type, named process, named site. Then check the registrar's own accreditation, not just the company's certificate. The certificate on the wall and the regulatory file in the drawer are not the same thing, and a buyer who conflates them has skipped the only check that mattered.