ISO 9001:2015 and ISO 13485:2016 are not the same standard with different labels. ISO 9001 is the general quality management standard. ISO 13485:2016 is a standalone medical-device QMS, built on an older ISO 9001 structure, with tighter rules for documentation, design, and traceability. If a device OEM or a regulator named one of them, that name is the requirement.
Six to nine months is typical for a first certification. That range is a planning figure for building and running a QMS, then sitting Stage 1 and Stage 2 with an accredited certification body. It is not a promise that a given registrar will issue a certificate, and it does not convert an ISO 9001 system into ISO 13485.
This guide contrasts the two standards on the clauses shops ask about most — ISO 13485:2016 clauses 4.2.3, 7.3, and 7.5.9 — and how a component manufacturer should read the contract before spending.
Two standards, not an upgrade path
AS9100 reprints ISO 9001 and adds aerospace requirements. ISO 13485 does not work that way. It is written against the ISO 9001:2008 clause layout, keeps a required quality manual, and keeps preventive action. ISO 9001:2015 uses Annex SL, dropped the mandatory manual, and folded preventive action into risk-based thinking. You cannot "add a few device procedures" to an ISO 9001:2015 system and call it 13485.
Finished-device manufacturers are usually in ISO 13485 territory, especially where the FDA Quality Management System Regulation incorporates ISO 13485 by reference. A shop that machines housings, molds parts, or supplies non-implantable components may be asked for ISO 9001, ISO 13485, or a customer quality agreement that names selected 13485 controls without the certificate. The purchase order decides.
ISO 13485 clause 4.2.3 — medical device file
ISO 13485:2016 clause 4.2.3 requires a medical device file for each device type or family. The file holds the description, specifications, manufacturing procedures, quality-control procedures, and installation or servicing methods as applicable. ISO 9001:2015 has no equivalent clause. Clause 4.2 in ISO 9001 is about interested parties, not a device file.
If you do not design or manufacture a finished device, you may not own a 4.2.3 file. The OEM might. What you will own are the records that feed their file: approved drawings, process validations they required, inspection results, and change notices. Write that boundary into your scope so you do not promise a device file you cannot produce.
ISO 13485 clause 7.3 — design and development
ISO 13485:2016 clause 7.3 is design and development for medical devices. It is more prescriptive than ISO 9001:2015 clause 8.3: design stages, review, verification, validation, transfer, and control of design changes, with retained records at each step. Device design history is a regulatory artifact, not a nice-to-have project folder.
A build-to-print component shop often has no 7.3 activity under 13485 and no 8.3 activity under ISO 9001. That exclusion is legitimate when it is true, and it must be justified in the scope. If you change a geometry, a material, or a process that affects the OEM's device, you may have stepped into design or into a change-control duty the OEM's quality agreement already named. Do not discover that at Stage 2.
ISO 13485 clause 7.5.9 — traceability
7.5.9.1 requires documented procedures that define the extent of traceability according to applicable regulatory requirements and the records to keep; 7.5.9.2 (implantable medical devices) adds records of components, materials and work-environment conditions that could cause the device not to satisfy requirements, plus distribution records (names/addresses of shipping-package consignees) — and the inspection/test personnel identity is part of the 7.5.9.2 record set. ISO 9001:2015 clause 8.5.2 requires identification and, where needed, traceability — but it does not write implantable-device distribution rules.
Component shops still feel 7.5.9 when the OEM flows lot, heat, or serial traceability into the PO. You meet that through receiving identification, in-process identity, and shipping records. That is still not a 13485 implantable-traceability system. Name what you can trace and what you cannot.
| Topic | ISO 13485:2016 | ISO 9001:2015 |
|---|---|---|
| Device file | Clause 4.2.3 medical device file per type or family | No equivalent; 4.2 is interested parties |
| Design | Clause 7.3 with staged records, transfer, and change control | Clause 8.3; can be excluded if you do no design |
| Traceability | Clause 7.5.9, with extra rules for implantables | Clause 8.5.2 identification and traceability where required |
| Quality manual | Still required (4.2.2) | Not required; many shops keep a short one anyway |
| Nonconforming product | Clause 8.3 in 13485 | Clause 8.7 control of nonconforming outputs |
How to read the customer requirement
- Find the named standard and revision on the PO, quality agreement, or supplier manual.
- Ask whether they require an accredited certificate or a documented system that they will audit themselves.
- If they named ISO 13485, ask whether it applies to your scope (finished device, critical component, or selected controls only).
- If they named ISO 9001, do not volunteer ISO 13485 unless a later contract will demand it.
Registrars accredited under ISO/IEC 17021-1 issue ISO 9001 certificates. ISO 13485 certificates come from bodies competent for that standard; some programs also sit under MDSAP where a regulator requires it. The conformity decision stays with the certification body. A documentation provider does not issue either certificate.
What to build first
If the written requirement is ISO 9001:2015, build that system. Six to nine months is typical for a first certification. A $500 Readiness Report maps ISO 9001 shall-statements to how you work. Full documentation is the $8,000 set of manuals and policies, procedures, work instructions, and forms, sized to how your company runs. The free Public-surface scan shows what your public site already supports against ISO 9001.
If the written requirement is ISO 13485:2016, ISO Delivered's ISO 9001 documentation is not that system. Use it only if the OEM accepted ISO 9001 for your scope. For 13485 you need a 13485-competent consultant or registrar path, including the medical device file, design records if you design, and the 7.5.9 traceability rules that apply to your product.
Frequently asked questions
Is ISO 13485 just ISO 9001 for medical devices?
No. ISO 13485:2016 is a standalone standard with its own clause layout. It keeps a quality manual, a medical device file (4.2.3), prescriptive design records (7.3), and device traceability (7.5.9). ISO 9001:2015 does not contain those device rules.
Can a component shop stay on ISO 9001?
Often, if the OEM's written requirement is ISO 9001 or a quality agreement that does not name ISO 13485 certification. Implantable or finished-device work is a different answer. Ask the OEM in writing which standard, which revision, and whether a certificate is required.
Does the FDA require ISO 13485?
The FDA Quality Management System Regulation incorporates ISO 13485 by reference for device manufacturers in the US market. That is a regulatory fact about finished devices, not a blanket rule that every machine shop in a device supply chain must hold a 13485 certificate. Your contract and your product type decide.
Which clause numbers should we put on procedures?
Cite the standard with the number. ISO 13485 4.2.3, 7.3, and 7.5.9 are device-file, design, and traceability. ISO 9001:2015 uses 8.3 for design and 8.5.2 for identification and traceability, and 8.7 for nonconforming outputs. Never write a bare "8.3" without the standard name.
How long should we plan for a first ISO 9001 certificate?
Six to nine months is typical for a first certification. That covers documentation, months of operating records, internal audit, management review, and the registrar's two-stage audit. It is a planning range, not a registrar decision.