Quality leadership: running ISO 9001 and ISO 13485 as one system, not two.
ISO Cloud Consulting editorial teamCompanies holding both ISO 9001 and ISO 13485 should run one system, not two. Build one process for each shared element written to the stricter standard, add medical-specific steps that apply only to medical product, keep one manual, one audit program and one management review, and ask for a combined certification audit.
Why do companies end up with two quality systems?
Many companies hold both ISO 9001 and ISO 13485, because they serve industrial and medical customers from the same sites. Too many of them run two quality systems to do it: two manuals, two sets of procedures, two management reviews.
It usually happens by accident. ISO 9001 came first. Then a medical customer arrived, a consultant built an ISO 13485 system alongside, and nobody joined them up. The result is duplicated effort, procedures that contradict each other, and people unsure which version applies to the job in front of them.
What is the common core of the two standards?
The two standards share most of their structure in practice. Document control, records, management responsibility, resources, competence, purchasing, production, measurement, nonconformance, corrective action, internal audit and management review all exist in both. Build one process for each, written to satisfy both standards.
How do you handle the differences?
Handle them inside the same processes. ISO 13485 requires more documented procedures and records, regulatory requirements built in, product risk management under ISO 14971, validation of processes and of software, stricter traceability for some devices, complaint handling with reporting decisions, and medical device files.
ISO 9001:2026 places more emphasis on context, opportunities, quality culture, planned change and continual improvement. The practical approach is to write each process to the stricter of the two, with medical-specific steps that apply only to medical product.
What does a combined process look like?
One nonconformance procedure for all products, with an extra step for medical product: assess whether the issue affects safety or must be reported. One purchasing procedure, with supplier criticality that includes medical risk. One complaint process, with a reportability decision triggered for medical devices.
How should documents and records be organized?
One quality manual that meets ISO 13485's requirements and also covers the ISO 9001 themes. One master document list. Records that carry a flag for medical product where traceability or retention rules differ.
Can audits and reviews be combined?
Yes. One internal audit program covering both standards, with the audit checklists cross-referenced. One management review, with the inputs of both standards on the agenda. That alone saves days a year.
What about certification?
Many certification bodies can audit both standards together, as a combined audit, which reduces audit days and disruption. Ask for it.
The benefits are real: less duplication, fewer contradictions, and a simpler story for your people. This is how we work, and for medical product, these extra steps apply.
Which templates help you combine the two systems?
The ISO 13485 Gap Assessment Workbook will show you what your ISO 9001 system needs to add. If you are starting the ISO 9001 side fresh, the ISO 9001:2026 Complete QMS Documentation Kit is the base. See also the ISO 13485 templates and our consulting page.
