Is ISO 13485 required for FDA 510(k) clearance?

ISO 13485 certification is not required for FDA 510(k) clearance. What is required is compliance with the FDA's Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference. Building your QMS to ISO 13485 will contribute to QMSR compliance, but formal third-party certification is not a prerequisite for the 510(k) pathway or for U.S. market access.

What is the difference between 21 CFR Part 820 and ISO 13485?

21 CFR Part 820 is the FDA's quality system regulation for medical device manufacturers. As of the February 2, 2026 compliance date, Part 820 is the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference. The two frameworks cover similar content (design and development, document control, CAPA, complaints, supplier management, production controls) but with different numbering. Under the QMSR, compliance with ISO 13485:2016 (plus FDA-specific provisions such as records and labeling controls) is the governing standard.

When should a medical device startup build its QMS?

Start building your QMS before you begin design and development work. Design and development controls under the QMSR apply during the design phase, not only during manufacturing. If you begin engineering without a documented design plan, design input process, and design review structure, you will have no design and development file to show an FDA inspector and no documented basis for the design decisions in your 510(k). Many startups underestimate QMS lead time and face a compressed scramble before their first regulatory submission.

Do I need ISO 13485 certification to sell in the EU?

Yes, in practice. The EU Medical Device Regulation (MDR, Regulation (EU) 2017/745) requires a quality management system as part of the conformity assessment process for CE marking, and for most device classes the QMS must meet a notified body assessment that maps to ISO 13485 or equivalent. Any device company planning to sell in the European Union will need ISO 13485 certification or an equivalent third-party QMS assessment. Canada's Medical Devices Regulations have a similar requirement for Class II, III, and IV devices.

What is a CAPA and why does it matter?

CAPA stands for Corrective and Preventive Action. It is the QMS mechanism for identifying, investigating, and correcting quality problems, and for taking preventive action to stop potential problems from occurring. CAPA is a frequently cited area in FDA Form 483 observations and warning letters for device manufacturers, because a weak CAPA system signals that the manufacturer is not systematically learning from failures. Startups should build CAPA processes early and practice them on internal quality events before their first FDA inspection.

Can I use a QMS template to get started?

Template QMS documentation is commercially available and can be a useful starting point for a startup that has not built a QMS before. The risk with templates is that they are generic and must be tailored to your specific device, manufacturing processes, and facilities. FDA inspectors are experienced at identifying boilerplate documentation that does not reflect actual operations. Templates can scaffold the structure, but the procedures, records, and processes must reflect how your organization actually operates. Work with a qualified regulatory consultant to review and adapt any template-based QMS before your first FDA inspection or ISO 13485 certification audit.

ISO 13485 and FDA Quality Management: What Medical Device Startups Need to Know

Direct answer: ISO 13485 is the internationally recognized quality management system (QMS) standard for medical device organizations. FDA's domestic quality system requirement is the Quality Management System Regulation (21 CFR Part 820), which as of its February 2, 2026 compliance date incorporates ISO 13485:2016 by reference and applies to manufacturers of devices intended for U.S. commerce. Startups do not need ISO 13485 certification to receive FDA 510(k) clearance, but they must comply with the QMSR before marketing any device in the United States. ISO 13485 certification also unlocks key international markets, including the EU and Canada. (As of July 2026.)

Quality management is the regulatory area that surprises most device founders. The pathway strategy (510(k) or PMA) gets attention. The QMS gets treated as paperwork until an FDA inspection reveals it as a product. Building a functioning quality management system is not administrative overhead; it is the operational infrastructure that makes sustainable device commercialization possible.

This article explains what ISO 13485 requires, how it connects to FDA's quality system requirements, when certification matters, and what the practical implications are for a startup approaching its first clearance or market launch.

What ISO 13485 Is

ISO 13485 is published by the International Organization for Standardization (ISO) and specifies requirements for a quality management system in which a device organization must consistently design, develop, produce, install, and service medical devices that meet applicable regulatory requirements and customer needs.

The standard is structured around process-based QMS principles. Unlike ISO 9001 (the general business quality standard), ISO 13485 is purpose-built for the risk-based, regulatory environment of medical devices. It requires explicit documentation, risk management integration, validation of manufacturing processes, controlled post-market surveillance, and a set of records sufficient to demonstrate regulatory compliance.

ISO 13485 is maintained and periodically revised. The current version is ISO 13485:2016. The ISO publishes the standard; it is not freely available online but must be purchased from ISO or a national standards body.

FDA's Quality System Requirements: 21 CFR Part 820 and the QMSR

For U.S. market access, the controlling quality system requirement is federal regulation, not ISO certification. The FDA's quality system requirement lives in 21 CFR Part 820 (https://www.ecfr.gov/current/title-21/part-820). Part 820 applies to manufacturers of finished devices intended for commercial distribution in the United States and to manufacturers of components and accessories sold to finished device manufacturers.

On February 2, 2024, the FDA published a final rule amending 21 CFR Part 820, now titled the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference. The compliance date was February 2, 2026. As of that date, a manufacturer's quality management system must comply with ISO 13485:2016 as incorporated by 21 CFR 820.10. The Federal Register notice for the final rule is at https://www.federalregister.gov/documents/2024/02/02/2024-01709/medical-devices-quality-management-system-regulation-amendments. The regulatory intent is to harmonize FDA requirements with the international standard, reducing duplicative documentation for companies selling in multiple markets.

The FDA's QMSR page (https://www.fda.gov/medical-devices/postmarket-requirements-devices/quality-management-system-regulation-qmsr) describes what has changed from the historical Part 820 framework.

For startups building their QMS from scratch in 2026, building to ISO 13485:2016, as incorporated by the QMSR, is the recommended starting point, because it satisfies both the FDA and major international market requirements at once.

What ISO 13485 / QMSR Requires

The requirements span the full lifecycle of a device. Under the QMSR, ISO 13485:2016 is the operative standard: 21 CFR 820.10 requires the QMS to comply with ISO 13485:2016, and the clause numbers below are ISO 13485:2016 clause numbers, which are now the governing references.

Quality management system (Clause 4). Documented QMS scope, policies, and procedures. A quality manual (or equivalent documentation structure). Document and record control: every procedure, design record, specification, and test report must be controlled, version-tracked, and retained for defined periods.

Management responsibility (Clause 5). Top management must define quality policy, establish measurable quality objectives, conduct management reviews, and ensure adequate resources. In a startup context, this means the CEO or COO has documented quality responsibilities, not just the regulatory affairs hire.

Resource management (Clause 6). Competence, training, and awareness for personnel performing work affecting product quality. Infrastructure requirements (facilities, equipment, software) documented and maintained.

Product realization (Clause 7). This is the largest section and covers the end-to-end process of creating the device. Key subclauses include:

Design and development (7.3): Design planning, inputs, outputs, review, verification, transfer, changes, and the design and development file (historically called the Design History File). For most Class II devices, this is the core engineering documentation reviewed during FDA inspections.
Purchasing (7.4): Supplier qualification, evaluation, and incoming inspection requirements. Suppliers of critical components must be qualified and periodically re-evaluated.
Production and service provision (7.5): Process validation (especially for processes where output cannot be fully verified by subsequent inspection, per Clause 7.5.6), device identification and traceability, preservation, and cleanliness requirements for sterile devices.

Measurement, analysis, and improvement (Clause 8). Feedback systems (including customer complaint handling), internal audits, monitoring of product conformity, control of nonconforming product, corrective and preventive action (CAPA), and post-market surveillance.

Note that ISO 13485:2016 is not the whole of Part 820. FDA retained device-specific requirements in the QMSR, including control of records under 21 CFR 820.35 and device labeling and packaging controls under 21 CFR 820.45, plus UDI and Medical Device Reporting cross-references. A compliant QMS is ISO 13485:2016 plus those FDA-specific provisions.

Risk Management: The Intersection with ISO 14971

ISO 13485 requires risk management throughout the product lifecycle but defers the specifics of how to conduct risk management to ISO 14971 (Medical devices: Application of risk management to medical devices). The two standards are designed to work together. A startup building a QMS needs both: ISO 13485 for the system structure, and ISO 14971 for the risk analysis, risk evaluation, and risk control methodology that feeds into design inputs, design verification, and post-market surveillance. See our companion article on medical device risk management under ISO 14971.

ISO 14971 is not named as a mandatory standard in U.S. law, but FDA's guidance on applying human factors, software validation, and design and development all rely on risk-based principles consistent with ISO 14971, and ISO 13485 Clause 7.1 requires risk management across product realization.

Do Startups Need ISO 13485 Certification?

Certification and compliance are two different things. FDA compliance requires meeting the QMSR requirements. This is a legal obligation for manufacturers of devices marketed in the United States. FDA inspectors assess compliance against the QMSR during establishment inspections, whether or not a company is ISO 13485 certified.

ISO 13485 certification is a third-party audit process in which a certification body assesses your QMS against the ISO 13485:2016 standard and issues a certificate. It is not required by FDA for 510(k) clearance or PMA approval. However:

The EU's Medical Device Regulation (MDR) requires manufacturers to have a QMS certified to ISO 13485 (or equivalent) as part of the conformity assessment process for CE marking for most device classes. If your device will be sold in Europe, ISO 13485 certification is a practical necessity.
Canada's Medical Devices Regulations require a quality system certificate to ISO 13485 (or evidence of compliance with a recognized QMS standard) for Class II, III, and IV devices sold in Canada.
Some U.S. hospital system procurement processes and enterprise customers ask for ISO 13485 certification as a vendor qualification criterion.
ISO 13485 certification provides documented third-party evidence of QMS compliance, which can be useful in investor due diligence and as a commercial differentiator.

The practical answer for most medtech startups: if you are U.S.-only in the near term, build a QMSR-compliant QMS first, then layer on ISO 13485 certification when international markets become material or when customer procurement requires it. Trying to get certified before your QMS is functionally built is usually a waste of resources.

When the QMS Must Be in Place

This is a point of significant confusion for startups. The QMS is not something you set up after clearance. The QMSR applies to manufacturers of finished devices before commercial distribution begins. The design and development requirements in particular apply throughout the design and development phase, meaning a startup that begins engineering work without those controls in place will have difficulty reconstructing the design and development file required by the regulation.

A properly built QMS should be in place, functional, and operating before the device goes to market. The FDA expects to see records demonstrating the QMS was followed during design and development, not just a policy document written after the fact. FDA inspectors have authority to inspect any establishment registered under 21 CFR Part 807, and they assess whether the QMS is actually functioning, not just documented.

The design and development file (historically the Design History File) is often the first concrete QMS artifact a startup creates: the collection of records that demonstrates the device was designed in accordance with the approved design plan. It is not submitted to the FDA in a 510(k), but it must exist and be maintained by the manufacturer.

The Marketing Dimension

Quality system status affects marketing in two practical ways.

Regulatory claims accuracy. If your device is marketed under a 510(k) clearance, your QMS is part of what makes that clearance sustainable. A device that was cleared and is then found to be manufactured without adequate design controls or process validation can face enforcement action, including warning letters, injunctions, and mandatory recalls, regardless of whether the original clearance was valid.

Commercial differentiation. ISO 13485 certification is a verifiable, third-party validated credential. Some device companies include their ISO 13485 certificate number and certifying body name in their commercial materials as evidence of quality system maturity. When doing so, the claim must be accurate (the certificate must be current, not expired, and in scope for the relevant manufacturing activities). Never represent an expired or out-of-scope certificate as current.

Buzzbox Media has helped medical device companies communicate quality and regulatory credentials accurately and compellingly for over 15 years. If your QMS is coming into shape and your clearance is approaching, we can help you build a marketing program that uses your regulatory milestones as legitimate proof points. Start with a 30-minute call at https://www.buzzboxmedia.com/book.