ISO 13485 vs ISO 9001: what changes when your quality system must serve medical devices?
Medical device and SaMD companies often start on ISO 9001, then find that a device quality system asks for more. ISO 13485 adds design controls, risk management across the life cycle, validation of the software that runs the quality system, and complaint and regulatory reporting records. In the US, the FDA's Quality Management System Regulation now points to it.
What is the difference between ISO 13485 and ISO 9001?
Quick answer
ISO 13485 vs ISO 9001 comes down to purpose. ISO 9001 is a general quality standard for any organization, while ISO 13485 is written for medical device regulation and adds design controls, life cycle risk management, QMS software validation and complaint reporting. Agnotic Technologies builds the QMS and device software that keeps those records traceable.
| Criterion | ISO 13485:2016 | ISO 9001 |
|---|---|---|
| Purpose | Quality management for the medical device life cycle, written to meet regulatory requirements | Quality management for any organization, focused on customer satisfaction and continual improvement |
| Design and development controls | Planning, inputs, outputs, review, verification, validation, transfer and changes, kept in a design and development file (clause 7.3). Software: each input linked to the output, test and review that closes it | Design and development is controlled, with no device file or design transfer step. Software: project and change tracking usually covers it |
| Risk management | Risk-based decisions across product realization; most device makers use ISO 14971 for the process. Software: a risk file whose hazards link to requirements, controls and tests | Risks and opportunities handled at the level of the quality system, with no product risk file |
| Software used in the QMS | Validated before first use and after changes, with effort scaled to risk. Software: intended use, test evidence and version history for the QMS tool itself | No matching validation requirement for quality system software |
| Medical device file | A file per device type or family that holds or references its specifications, labeling and procedures (clause 4.2.3). Software: one device record linking specs, labels, procedures and releases | No product file; documented information is kept as the organization decides |
| Complaints and regulatory reporting | Documented complaint handling and reporting to regulators when criteria are met (clauses 8.2.2 and 8.2.3). Software: intake, investigation, reportability decision and a link to CAPA | Customer feedback and satisfaction monitoring, with no regulatory reporting duty |
| Traceability | Identification and traceability, with added rules for implantable devices (clauses 7.5.8 and 7.5.9). Software: lot, serial and UDI capture tied to the device record | Identification and traceability where needed to ensure conforming outputs |
| Improvement | Maintain the effectiveness of the quality system, with changes controlled against regulatory requirements | Continual improvement of the quality system is a core requirement |
| US regulation | Incorporated by reference in 21 CFR Part 820, the QMSR, in force since February 2, 2026 | Not incorporated in the QMSR; only the ISO 9000 clause 3 definitions are |
| Current edition | ISO 13485:2016, last reviewed and confirmed by ISO in 2025 | ISO 9001:2026, the sixth edition, published 16 September 2026 |
What they are
What is ISO 13485:2016
ISO 13485:2016 sets quality management system requirements for organizations involved in the medical device life cycle, from design and production to installation and servicing. ISO describes it as tailored to the regulatory and safety requirements of the device industry, with more emphasis than ISO 9001 on regulatory requirements, risk management and process validation.
What is ISO 9001
ISO 9001 sets requirements for a quality management system that any organization, of any size or sector, can use to meet customer and applicable regulatory requirements and improve customer satisfaction. The sixth edition, ISO 9001:2026, was published on 16 September 2026.
Key differences
Why can't an ISO 9001 system simply be stretched to cover devices?
ISO 13485:2016 keeps a clause layout of its own, with product realization in clause 7 and measurement and improvement in clause 8, so its numbers do not line up with ISO 9001's. The bigger gap is intent: ISO 9001 rewards continual improvement and customer satisfaction, while ISO 13485 asks you to show that the system meets regulatory requirements and stays effective. Map every ISO 13485 clause to an owner and a record before you change a single tool.
What does the FDA QMSR change for US device makers?
Since February 2, 2026, 21 CFR 820.10 requires a manufacturer to document a quality management system that complies with the applicable requirements of ISO 13485:2016, which 21 CFR 820.7 incorporates by reference. FDA adds its own requirements on top, such as unique device identification, complaint records and reporting under 21 CFR Part 803. An ISO 9001 quality system does not meet the QMSR on its own.
Which devices need design controls under the QMSR?
21 CFR 820.10(c) applies the design and development requirements in ISO 13485 clause 7.3 to class II and class III devices, to class I devices automated with computer software and to a short list of other class I devices. For a SaMD company, the design and development file is part of the product, not paperwork after release. Software life cycle detail under IEC 62304 sits on our FDA SaMD page.
Why must the QMS software itself be validated?
ISO 13485 asks the manufacturer to validate the computer software it uses in the quality system, such as complaint, CAPA, document control and training tools, before first use and after changes, with effort scaled to risk. ISO 9001 has no matching requirement. When we build QMS software for a device company, we hand over the requirements, risk assessment, test evidence and release notes its quality team needs for that validation.
What does a device complaint record need that a customer complaint does not?
21 CFR 820.35(a) lists what to record for complaints that are reportable or investigated: the device name, the date received, any UDI or UPC, the complainant's name, address and phone number, the nature of the complaint, any correction or corrective action and any reply. A general ISO 9001 feedback log rarely holds all of these, so the intake form, the investigation and the reportability decision need their own fields.
When to use each
When to use ISO 13485
- You design, make, service or supply medical devices, including software as a medical device.
- You sell or plan to sell devices in the US, where 21 CFR Part 820 incorporates ISO 13485:2016 by reference.
- Your customers are device manufacturers who expect suppliers to work under a device quality system.
- You need design controls, a risk file and complaint reporting records that an inspector will read.
When to use ISO 9001
- Your product is not regulated as a medical device, such as scheduling or practice management software.
- You want a quality system recognized across sectors by customers and in tenders.
- You run services or manufacturing outside the medical device life cycle.
- You are building quality habits before a device product exists and plan to add ISO 13485 later.
How do you move a QMS from ISO 9001 to ISO 13485?
1. Run a clause gap review. Map each ISO 13485 clause to your current ISO 9001 process, owner and record. The usual gaps are the medical device file, the design and development file, the risk file and complaint reporting.
2. Pick one system of record per record type. Design history in the engineering tools, the risk file linked to requirements, complaints and CAPA in the QMS, and no copies kept by hand.
3. Validate the QMS software before you rely on it. Write its intended use, assess the risk, test the configured workflows and keep the evidence, then repeat for every change.
4. Link records by ID. Requirements, hazards, tests, releases, complaints and CAPAs should reference each other so an auditor can trace a change in either direction.
5. Migrate history with its audit trail. Move open CAPAs, complaints and controlled documents with their history, and keep the old system read-only until the transfer is checked.
Failure points we design around: complaints closed with no reportability decision on record; risk files that never link to tests; QMS tools updated without revalidation; and design changes released without the design and development file being updated.
Which sources does this comparison rely on?
- ISO 13485:2016, Medical devices: quality management systems, requirements for regulatory purposes (ISO)
- ISO 9001:2026, Quality management systems: requirements (ISO)
- 21 CFR Part 820, Quality Management System Regulation, including 820.7, 820.10 and 820.35 (eCFR)
- QMSR final rule, 89 FR 7496, effective February 2, 2026 (govinfo)
- ISO 14971:2019, application of risk management to medical devices (ISO)