ISO 9001 vs ISO 13485: Key Differences Explained (2026)

ISO 9001 vs ISO 13485: the short answer

Both are ISO quality management system standards. ISO 9001:2026, published in September 2026, is the general standard used across every sector and the most widely certified management system standard in the world. ISO 13485:2016 is written for organizations involved in the life cycle of medical devices, from design and manufacture to distribution, installation and servicing, and is referenced by medical device regulators worldwide.

Side-by-side comparison

Dimension	ISO 9001:2026	ISO 13485:2016
Scope	Any sector	Medical devices and related services
Primary focus	Customer satisfaction and continual improvement	Safe, effective devices and regulatory compliance
Structure	Harmonized structure, clauses 4 to 10	Older structure, clauses 4 to 8
Improvement	Continual improvement required (10.1)	Maintain QMS effectiveness; changes controlled and validated
Risk	Risks (6.1.2) and opportunities (6.1.3) handled separately, proportionate actions	Risk-based approach to QMS processes plus product risk management, typically per ISO 14971
Design and development	Applies if you design; can be justified as not applicable	Full design controls and design files if you design devices
Documentation	Extent decided by the organization	Many explicitly required documented procedures and records
Management representative	Not required; responsibilities assigned under 5.3	Required
Culture and ethics	Quality culture and ethical behaviour required (5.1.1 i, 7.3 e)	Not addressed explicitly
Climate change	Relevance must be determined (4.1)	Not addressed
Regulatory use	Contractual and market requirement	Referenced by regulators (EU MDR, US FDA QMSR, MDSAP and others)
Sterile and implantable devices	Not specific	Specific requirements (7.5.7, 7.5.9.2)

Where the two standards overlap

Both require:

• a defined QMS scope, quality policy and objectives;
• defined processes and their interactions;
• control of documents and records;
• competence, training and suitable infrastructure and work environment;
• purchasing and supplier control;
• control of nonconforming product and corrective action;
• internal audit and management review.

An existing ISO 9001 system is a solid base for ISO 13485, but a clause-by-clause gap analysis is essential before assuming anything carries over.

Key differences explained

1. Structure

ISO 9001:2026 uses the harmonized structure shared with ISO 14001 and ISO 45001, which makes integration straightforward. ISO 13485:2016 keeps an older structure, so integrated systems need a cross-reference matrix.

2. Improvement vs maintaining effectiveness

ISO 9001 requires continual improvement, now consolidated in clause 10.1 of the 2026 edition. ISO 13485 asks you to maintain the effectiveness of the QMS, because uncontrolled change in a regulated process is itself a risk. Improvements still happen in medical device companies, but through change control and, where needed, revalidation.

3. Risk management

ISO 9001:2026 requires you to determine, analyse and evaluate risks, plan proportionate actions and evaluate their effectiveness, and to treat opportunities separately. ISO 13485 requires a risk-based approach to QMS processes and documented product risk management across the device life cycle, usually following ISO 14971: hazard analysis, risk acceptability criteria, risk controls and feedback from post-market data.

4. Design controls

Under ISO 9001 a company that does not design can justify clause 8.3 as not applicable. Under ISO 13485, design and development controls are extensive for anyone who designs devices: planning, inputs, outputs, reviews, verification, validation, transfer, changes and a design and development file.

5. Documentation

ISO 9001 leaves the extent of documentation largely to you. ISO 13485 explicitly requires many documented procedures and records, so a medical device QMS is typically far more document-heavy.

6. Culture, ethics and climate

ISO 9001:2026 added requirements on quality culture and ethical behaviour and on determining whether climate change is relevant. ISO 13485:2016 has no direct equivalent, so dual-certified organizations will need to cover these on the ISO 9001 side.

7. Regulatory linkage

ISO 13485 underpins medical device regulation in many markets, including the EU MDR and IVDR, MDSAP, and the US FDA Quality Management System Regulation, which has applied since 2 February 2026 and incorporates ISO 13485:2016 by reference. ISO 9001 has no regulatory role in medical devices.

Which one do you need?

Choose ISO 9001 if

• you work outside medical devices;
• customers or tenders ask for it;
• you want a flexible, improvement-driven framework.

Choose ISO 13485 if

• you design, manufacture, distribute, install or service medical devices;
• you supply components or services to device manufacturers who require it;
• you need EU MDR, FDA or MDSAP market access.

Choose both if

• you serve medical and non-medical markets;
• you want ISO 9001's improvement and culture focus alongside ISO 13485's regulatory rigour.

Many certification bodies can audit both together, which reduces total audit time compared with separate audits.

Migration path: ISO 9001 to ISO 13485

1. Run a clause-by-clause gap analysis against ISO 13485.
2. Set up product risk management per ISO 14971.
3. Implement design controls and design files if you design devices.
4. Write the documented procedures ISO 13485 requires.
5. Add complaint handling, regulatory reporting and post-market feedback.
6. Train internal auditors on ISO 13485.
7. Engage a certification body qualified for medical devices, and a notified body where product certification applies.

Frequently asked questions

Can ISO 13485 replace ISO 9001?

For a medical device scope, often yes, as customers and regulators ask for ISO 13485. If you also serve other sectors, keep ISO 9001 for that scope.

Is ISO 13485 harder than ISO 9001?

Generally yes: more required documentation, product risk management, design controls and closer regulatory scrutiny, which usually means a longer implementation.

Does ISO 9001:2026 change anything for ISO 13485 companies?

Only for organizations certified to both. Their ISO 9001 scope must meet the 2026 requirements, such as separate handling of risks and opportunities, the climate change determination and quality culture. ISO 13485:2016 itself is unaffected. See our ISO 9001:2026 guide for the full list of changes.

Does ISO 13485 give CE marking?

No. ISO 13485 certifies the QMS; CE marking concerns the device. ISO 13485 is, however, the practical foundation for conformity assessment under the EU MDR.

Which standard do the FDA and EU regulators reference?

ISO 13485:2016. The FDA QMSR incorporates it by reference, and it is the harmonized route to demonstrating QMS conformity in the EU.

Next steps

Start with the standard your customers and regulators require. For medical devices that is ISO 13485; for everything else, ISO 9001:2026. SmartISO supports ISO 9001 alongside ISO 14001 and ISO 45001 in one workspace, with document control, audits and CAPA mapped to each standard's clauses.