ISO 13485 for Medical Device Distributors

By Ishan Maharaj, Founder and Principal Consultant. Last reviewed 26 October 2026.

Short answer: a medical device distributor does not need ISO 13485 under EU MDR Article 14, but it does have legal duties for checking devices, storage and transport, complaints and records, and many hospitals, tender boards and manufacturers ask for ISO 13485 as evidence that those duties are controlled. If you relabel devices or sell them under your own name, Article 16 can make you responsible as a manufacturer. A certification scope limited to distribution can also need fewer audit days.

What does EU MDR require of distributors?

Article 14 of Regulation (EU) 2017/745 sets the general obligations. Article 14 does not require a distributor to have a quality management system; the QMS requirement in Article 10(9) applies to manufacturers. The practical duties map to controls you can build:

Duty (MDR Article 14)	What to build
14(2): before making a device available, verify CE marking and declaration of conformity, manufacturer information, importer duties, and UDI where applicable. Sampling is allowed for some checks.	Goods-in inspection procedure and checklist with a sampling rule.
14(2): do not make a non-conforming device available and inform the manufacturer, authorised representative and importer	Quarantine area and nonconforming product procedure.
14(3): keep storage and transport conditions within the manufacturer's conditions	Storage requirements per product, temperature monitoring where needed, carrier controls.
14(4): inform the manufacturer and others if you believe a device is non-conforming; cooperate on corrective action, withdrawal or recall	Escalation and recall procedure with contact list.
14(5): forward complaints and suspected incident reports; keep a register of complaints, non-conforming devices, recalls and withdrawals	Complaint form and register.
14(6): give competent authorities information and samples on request	Records retrievable by product and batch.

When does a distributor become a manufacturer?

Article 16(1) says a distributor takes on manufacturer obligations if it makes a device available under its own name, registered trade name or trademark, changes a device's intended purpose, or modifies a device in a way that may affect compliance. Providing or translating the manufacturer's required information, and changing outer packaging where necessary for marketing, are not treated as modifications that could affect compliance (Article 16(2)). If you are near this line, take advice before you relabel.

Which ISO 13485 processes does a distributor need?

ISO 13485:2016 is written for organisations in the medical device life cycle, and a certification scope can cover storage and distribution. Typical distributor scope:

Documented system: quality manual, document control and records. See the quality manual page.
Purchasing and supplier control: approving manufacturers and logistics providers. The Supplier Control Kit ($79).
Storage, handling and traceability: receiving, identification, batch tracking and dispatch records.
Complaints, incidents and recalls: the Complaint Handling, PMS & Vigilance Kit ($99).
Corrective action and internal audit: the CAPA kit and internal audit kit.
Design and development: usually not applicable if you do not design devices; record the reason in the manual.

The Starter Kit ($249) covers the six core kits; the Complete QMS Kit ($449) adds supplier, complaint and traceability kits.

Does the FDA QMSR apply to distributors?

FDA states the QMSR applies to finished device manufacturers who intend to commercially distribute devices, including accessory manufacturers. A pure distributor is not described as a manufacturer, but check how FDA treats your activities, for example relabelling, before relying on that.

Will certification cost less for a distribution-only scope?

It can. IAF MD 9 lists a scope that excludes manufacturing, such as wholesale, retail or transportation, as a factor that can reduce audit time, with combined reductions capped at 20%. If the scope covers only distribution or transportation services, time may be reduced by up to 50% in total. The base is 3 days for 1 to 5 people and 4 days for 6 to 10. The certification body decides; see ISO 13485 certification cost.

Worked example: receiving a batch of sterile dressings

Goods-in staff check the delivery against the purchase order and look for CE marking, the instructions for use and, where applicable, the UDI.
The batch passes the sampling rule and is moved to stock with its batch number recorded.
One carton is damaged. It goes to quarantine, is logged in the nonconforming register and the manufacturer is informed.
A month later a customer reports a torn pouch. The complaint is logged, forwarded to the manufacturer, and the batch is traced to affected customers.

This sequence is illustrative. A documented real-world system is described in the ISO 13485 case study (anonymised). For help building yours, see ISO 13485 consulting and the consulting page; a remote internal audit of a single process starts from $1,250.

Frequently asked questions

Is ISO 13485 mandatory for distributors?

Not under MDR Article 14, which sets no QMS requirement for distributors. National rules and customer requirements may differ, so check your market.

Can a distributor hold an ISO 13485 certificate?

Yes, with a scope written for its activities, such as storage and distribution.

Do I need clause 7.3 design controls?

Not if you do not design or develop devices. Document that decision in your manual.

Does a QMS replace my legal duties?

No. It helps you meet them consistently and evidence it.

Sources

This page is general information, not legal advice.

Online course

ISO 9001:2026 Foundations Course (Online, Self-Paced, Certificate of Completion)

Learn this topic properly: short lessons, worksheets with model answers, a 100% pass mark on every lesson quiz and a certificate of completion. Unlimited access for $79.

See the course All courses