ISO 9001 vs ISO 13485: What's the Difference

Short answer: ISO 9001 is a general-purpose quality management standard any organization can use. ISO 13485 is a stand-alone standard specifically for medical device manufacturers and their suppliers. Most medical device companies implement ISO 13485 on its own — you don't need ISO 9001 first.

Who each standard is for

ISO 9001 applies to any organization, in any sector, that wants a documented quality management system built around customer satisfaction and continual improvement. It says nothing about medical devices specifically.

ISO 13485 is written for organizations involved in one or more stages of a medical device's life cycle — design, production, storage, distribution, installation, servicing, or supplying associated services. It is the standard regulators and notified bodies expect to see for CE marking (EU MDR) and is widely accepted by the FDA as evidence of a compliant quality system.

Do you need both?

No. ISO 13485 is deliberately structured so a medical device company can implement it as their only quality management system — it does not require you to also hold ISO 9001. That said, some larger organizations that make both medical and non-medical products maintain both certifications, one for each product line, or use ISO 9001 group-wide with ISO 13485 layered on top for the regulated business unit.

Where they differ in emphasis

• Customer satisfaction: ISO 9001 requires ongoing monitoring of customer satisfaction as a core input to improvement. ISO 13485 focuses more on meeting regulatory and customer requirements consistently, with less emphasis on satisfaction as a standalone metric.
• Risk management: Both standards are risk-based, but ISO 13485 requires risk management to run through the entire product life cycle, typically applied alongside ISO 14971 for medical device risk management specifically.
• Design controls: ISO 13485 has considerably more detailed requirements for design and development — design history files, verification, validation, and design transfer — that have no direct equivalent in ISO 9001.
• Traceability: ISO 13485 requires device-level traceability (often tied to UDI requirements), which goes well beyond what ISO 9001 asks for.
• Continual improvement: ISO 9001 frames continual improvement as an open-ended expectation. ISO 13485 is more focused on maintaining the effectiveness and suitability of the QMS, reflecting the reality that changes to a regulated medical device system need tighter control.

If you're moving between the two

Companies that already run ISO 9001 and are entering the medical device space usually find the general quality management habits transfer well — document control, internal audits, management review, corrective action — but need to build out the medical-device-specific layers: design controls, device master records, UDI/traceability, and post-market surveillance.

This page describes the two standards in our own words for orientation purposes. It is not a clause-by-clause reproduction of either standard, and it isn't a substitute for your own licensed copy or your certification body's guidance.