ISO 13485 Certification: Process, Timeline and Cost

Last updated: 2026-10-27 · By Ishan Maharaj, founder of ISO Cloud Consulting

What are the steps to ISO 13485 certification?

1. Define scope and your regulatory role (manufacturer, contract manufacturer, distributor, importer) and the markets you sell into. The scope statement on your certificate will follow this decision, and any exclusions or non-applications need a justification under clause 4.2.2.
2. Gap analysis against ISO 13485:2016 and applicable regulations. Score each clause, list missing procedures and records, and turn the gaps into a dated plan.
3. Build the QMS: procedures, the medical device file, design controls (if in scope), purchasing, production and process validation, complaint handling and CAPA. Keep documents short and written for the people who use them.
4. Integrate ISO 14971 risk management across product realization so that design inputs, supplier controls, process validation and post-market data all feed the risk file.
5. Train staff and run the system to produce records. Auditors look for evidence that processes have operated, so most certification bodies expect a few months of records before stage 2.
6. Internal audit and management review. Audit every process at least once and hold a management review that covers all required inputs before the certification audit.
7. Stage 1 and stage 2 audits by an accredited certification body, or by an MDSAP auditing organization.

How long does each phase usually take?

The timeline depends mostly on whether design and development is in scope, how many processes are new and how much time your team can give the project. The table below shows a typical pattern for a small manufacturer starting from limited documentation.

What happens in the stage 1 and stage 2 audits?

Stage 1 is a readiness review. The auditor checks your scope, documentation, regulatory role and whether you are prepared for stage 2. It often identifies documents or records that need attention before the main audit. Stage 2 tests whether the system is implemented and effective. Auditors sample records, interview staff, walk production areas and follow trails such as a complaint through investigation, CAPA and risk file update.

Nonconformities are graded. Major findings normally need corrective action and verification before a certificate can be issued; minor findings need an accepted action plan. After certification, surveillance audits run each year and a recertification audit takes place before the three-year certificate expires.

What drives the cost?

• Number of employees, sites and shifts (audit days).
• Whether design and development is in scope.
• Sterile or implantable products and special processes.
• MDSAP versus ISO 13485 only.
• Internal time to build and run the system, and any training or consulting support.

Audit days are set by the certification body using accreditation rules for medical device audits, so ask two or three accredited bodies for a written quote that shows the days for stage 1, stage 2 and each surveillance year. Internal time is usually the largest cost: someone has to write procedures, train staff and keep records flowing. Templates shorten the writing work, and outside help is most useful for the gap analysis, a pre-certification internal audit or a process you have never built before, such as sterilization validation. Our ISO 13485 consulting page lists remote options and starting prices.

How do ISO 13485 certification and regulatory approval differ?

ISO 13485 certification is not a market approval. In the EU, conformity assessment under the MDR is carried out by a notified body. In the US, the FDA's Quality Management System Regulation incorporates ISO 13485 by reference but FDA does not issue ISO certificates. Read our guide to the FDA QMSR.

Under MDSAP, one audit by a recognized auditing organization covers ISO 13485 plus the specific requirements of the participating regulators, which can reduce separate inspections. Check with your target regulators whether MDSAP is accepted or required for your device class.

What are the most common reasons companies are not ready?

• Procedures exist, but there are too few records to show they operate.
• Risk management sits in a separate file and is not linked to design, suppliers or complaints.
• Process validation is missing for processes whose output cannot be fully verified (clause 7.5.6).
• Outsourced processes and critical suppliers lack quality agreements and monitoring.
• The internal auditor audited their own work, or management review skipped required inputs.

New to the standard? Start with our clause-by-clause guide to ISO 13485, then run the ISO 13485 Gap Assessment Workbook to size the work. For the documents, start with the ISO 13485 Starter Kit or the Complete QMS Kit.

Frequently asked questions

How long does ISO 13485 certification take?

Typically 9 to 18 months for a company building its QMS, depending on design scope, product risk and resources.

Is ISO 13485 certification mandatory?

Not by itself in every market, but many regulators, notified bodies and customers expect it, and it supports EU MDR, MDSAP and FDA QMSR compliance.

What is MDSAP?

The Medical Device Single Audit Program, which lets one audit by a recognised auditing organization satisfy several regulators, including the US, Canada, Brazil, Japan and Australia.

About our courses: ISO Cloud Consulting courses award a certificate of completion. We are a new training provider and our certificates are not yet accredited by an external body; we plan to apply for international recognition before the end of 2027.