{"id":3625,"date":"2026-08-05T15:24:17","date_gmt":"2026-08-05T15:24:17","guid":{"rendered":"https:\/\/sanyangmedical.com\/iso-13485-vs-iso-9001-which-certificates-matter\/"},"modified":"2026-08-23T19:55:47","modified_gmt":"2026-08-23T19:55:47","slug":"iso-13485-vs-iso-9001-which-certificates-matter","status":"publish","type":"post","link":"https:\/\/sanyangmedical.com\/id\/iso-13485-vs-iso-9001-which-certificates-matter\/","title":{"rendered":"ISO 13485 vs ISO 9001: Sertifikasi Mana yang Penting"},"content":{"rendered":"

The Core Difference: General QMS vs Medical Device QMS<\/h2>\n

ISO 9001 is a general quality management system standard applicable to any organization, from software companies to food processors. ISO 13485<\/a> is a quality management system standard written specifically for medical device manufacturers. The relationship between the two is not a choice between alternatives. ISO 13485 incorporates the process approach and customer satisfaction principles of ISO 9001, then layers on requirements that address the specific risks of medical device manufacturing: design controls, sterilization, biocompatibility, traceability, and post-market surveillance. See also the CE marking for medical devices<\/a> guide for related specifications.<\/p>\n

For a medical equipment buyer, the distinction matters because it determines what the supplier’s quality system actually controls. A factory with only ISO 9001 has a documented quality system, but that system does not require medical-device-specific processes like design validation, risk management files, or adverse event reporting. A factory with ISO 13485 has all of those, plus the general quality framework that ISO 9001 provides. Sanyang Medical holds both certifications, which means the quality system covers general manufacturing processes (ISO 9001) and medical device-specific requirements (ISO 13485) simultaneously.<\/p>\n

\"Benchtop<\/p>\n

What Each Standard Requires: Side-by-Side<\/h2>\n

The two standards share a common structure based on the Plan-Do-Check-Act cycle, but the depth of documentation and the scope of control differ substantially. ISO 9001:2015 contains approximately 30 documented information requirements. ISO 13485:2016 contains over 80. The additional requirements in ISO 13485 address the regulatory and safety obligations that medical device manufacturers must meet to place products on the market in the European Union, the United States, and most other regulated jurisdictions.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Requirement Area<\/th>\nISO 9001:2015<\/th>\nISO 13485:2016<\/th>\n<\/tr>\n<\/thead>\n
Quality manual<\/td>\nNot required (documented information)<\/td>\nRequired, with defined scope including exclusion justification<\/td>\n<\/tr>\n
Design controls<\/td>\nGeneral design and development planning<\/td>\nDetailed design inputs, outputs, review, verification, validation, and transfer<\/td>\n<\/tr>\n
Risk management<\/td>\nRisk-based thinking encouraged<\/td>\nMandatory risk management process per ISO 14971 throughout product lifecycle<\/td>\n<\/tr>\n
Traceability<\/td>\nGeneral product identification<\/td>\nFull traceability for each device lot, batch, and component<\/td>\n<\/tr>\n
Sterilization<\/td>\nNot applicable<\/td>\nValidation and process controls for sterilization methods<\/td>\n<\/tr>\n
Post-market surveillance<\/td>\nCustomer feedback and complaints<\/td>\nSystematic feedback, adverse event reporting, and corrective action to regulators<\/td>\n<\/tr>\n
Clinical evaluation<\/td>\nNot applicable<\/td>\nClinical evaluation data required to support device claims<\/td>\n<\/tr>\n
Software validation<\/td>\nGeneral validation<\/td>\nValidated software per defined quality objectives, including production and QMS software<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The additional requirements in ISO 13485 are not bureaucratic overhead. Each one maps to a specific failure mode that has caused patient harm in the past. Design controls exist because inadequate design caused device failures. Sterilization validation exists because unsterilized devices caused infections. Post-market surveillance exists because defects not caught in design review were discovered only after widespread clinical use.<\/p>\n

Why a Supplier with Only ISO 9001 Is a Risk<\/h2>\n

Some Chinese medical equipment manufacturers hold ISO 9001 but not ISO 13485. The ISO 9001 certificate allows them to claim a quality management system, which looks credible on a quotation. But the scope of that quality system does not require medical-device-specific controls. A factory with only ISO 9001 can produce surgical lights, hospital beds, or trolleys without a formal design control process, without risk management files, and without a post-market surveillance system that feeds adverse events back into design improvements.<\/p>\n

For distributors importing into regulated markets, this creates a specific problem. The EU Medical Device Regulation (MDR)<\/a> requires that manufacturers have a quality management system that meets the requirements of ISO 13485, not just ISO 9001. A supplier with only ISO 9001 cannot serve as the legal manufacturer for CE-marked devices in the EU. The importer, not the supplier, becomes the responsible party. For buyers in less regulated markets, the risk is different: the factory’s quality system does not include the controls that would catch design defects or material failures before they reach the patient.<\/p>\n

\"Surgical<\/p>\n

How to Verify a Supplier’s ISO 13485 Certificate<\/h2>\n

Asking a supplier for their ISO 13485 certificate is not sufficient. Three verification steps should follow the request. First, check the certificate’s scope. The scope should explicitly name the medical device categories the factory manufactures, not just the general phrase “medical devices.” A certificate with a scope of “manufacturing of operating tables, surgical lights, hospital beds, and medical trolleys” is specific. A scope of “manufacturing of medical devices” is vague and may indicate a certificate obtained for a different product line.<\/p>\n

Second, check the certificate number against the issuing body’s database. Major ISO 13485 certifying bodies include TUV SUD, TUV Rheinland, BSI, SGS, and DNV. Each maintains a public database where certificate numbers can be verified. A certificate that does not appear in the database, or that appears with a different company name, is invalid.<\/p>\n

Third, check the certificate validity dates. ISO 13485 certificates are valid for 3 years with annual surveillance audits. An expired certificate means the factory has not maintained its quality system. For a detailed verification procedure including what to look for in the audit report, the ISO and CE certification verification guide<\/a> provides a step-by-step checklist.<\/p>\n

CE Marking, ISO 13485, and Free Sale: How They Fit Together<\/h2>\n

Buyers frequently confuse three separate documents: CE marking, ISO 13485 certification, and Free Sale Certificate. They serve different purposes and are issued by different authorities. Understanding the relationship helps buyers verify that their supplier has the complete documentation package required for import registration in most jurisdictions.<\/p>\n