ISO 9001 for Medical Devices: A Straight Guide

In short: ISO 9001 for medical devices depends on what you make. If you design or manufacture the regulated device itself, regulators and customers expect ISO 13485, so that accredited route is the one to take. If you supply components, services or products to the medical trade, plain ISO 9001 is very often exactly the certificate your customers want. Use our ISO 9001:2026 Certification-Ready System to win the medical-trade supply contracts that demand it.

I'll be straight with you: I have never made a medical device, though I served my apprenticeship as a fitter and turner and later ran a production line, so precision, inspection and traceability are second nature to me. Medical devices is another sector where I have to be honest up front, because if you are making the regulated product itself, ISO 9001 on its own is not the standard you will be judged by. The device world runs on ISO 13485, and I would far rather tell you that now than sell you the wrong certificate. So I won't dress it up; I'll show you exactly where plain ISO 9001 is right for a business in this sector, and where you genuinely need the specialist one, one business owner to another.

The honest split: ISO 9001 or ISO 13485

This is the one thing worth getting right before you spend a penny, so let me lay it out plainly.

• If you design or manufacture the finished medical device, the standard the sector and its regulators expect is ISO 13485, the quality management standard written specifically for medical devices. It shares its foundations with ISO 9001 but adds a great deal of device-specific and regulatory requirement, and it is what your notified body, your regulator and your device customers will look for.
• If you supply the medical trade without making the finished regulated device, plain ISO 9001 is very often the right certificate. Component suppliers, contract services, packaging, distribution, calibration and maintenance firms, and businesses selling non-device products into healthcare and medical settings all sit comfortably here.

So the rule of thumb is simple: making the regulated device itself means ISO 13485; supplying the trade around it is usually genuine ISO 9001 territory. If a customer or a regulator specifically names ISO 13485, that is what they mean, and we will tell you so rather than sell you the wrong thing.

Where ISO 9001 is exactly right for a business in this sector

For the businesses that supply the medical trade rather than making the regulated device, ISO 9001 does a real and valuable job. It gives you a recognised quality mark that device makers, distributors and healthcare buyers understand and often require of their own suppliers, and it puts the controls in place that stop quality problems costing you money. The parts that earn their keep are the ones that matter in any precise, quality-critical operation:

• Control of production and processes. A defined way of doing the work so it comes out the same every time, which is exactly what a demanding medical customer is checking for in a supplier.
• Inspection and checking. Evidence that work is verified at the right points, so a fault is caught before it reaches a customer who cannot tolerate one.
• Control of nonconforming product. A firm way of dealing with anything that is not right, so a reject never gets shipped by mistake into a supply chain where it really matters.
• Traceability. Being able to trace a batch back through its materials and process, which a medical customer will very often demand of you directly.
• Supplier control. Managing who you buy from, so a weak supplier does not quietly become your quality problem, and your customer's.

For the wider shop-floor picture, see ISO 9001 for manufacturing.

It makes the operation easier, not harder

The fear with any quality system is that it buries a busy operation in forms nobody has time for. Done badly, it does. Done properly, it does the opposite, because the controls are simply the good habits your best people already have, written down where everyone can use them.

When the method is defined and the checks are built in, your people are not guessing, not reinventing a job each time, and not firefighting the same problem twice. Less confusion, less waste, and fewer arguments about who was meant to check what. The paperwork earns its place only where it saves time or money, and everything else stays out.

The commercial payoff

• More customers, because device makers and healthcare buyers increasingly require a recognised quality certificate from their suppliers before they will place work.
• Less scrap and rework, because problems are caught at the right stage instead of at the end.
• Fewer costly returns and complaints, because bad product does not reach a customer who will not forgive it.
• Less wasted time, because people work to a known method instead of working it out each time.

Lower costs inside and more work coming in: that is more profit from two directions at once, which is the whole point of getting certified.

Doing it without a consultant

If you already supply into the medical trade, you understand your own processes, your own tolerances and your own customers, which is most of the work. You can adapt a system yourself rather than pay for one to be written. What you need is plain-English documents that fit a quality-critical business and a route to a genuine certificate.

Our templates are written in plain English to the current ISO 9001:2026 standard and adapt readily to a business supplying the medical sector. When your system is running, we assess it remotely and, if it meets the standard, certify it. We are an unaccredited certification body and we say so plainly; for most trade and business-customer requirements an honest unaccredited ISO 9001 certificate does the job. Where you make the regulated device itself and ISO 13485 is required, that is a specialist accredited medical route through a different body, and we will tell you so straight.

See the whole journey in plain business language with the free guide to certification, then decide with a clear head whether ISO 9001 is your certificate. Or go straight to the complete ISO 9001 pack, ready to adapt.

Get the free guide

Frequently asked questions

Is ISO 9001 enough for medical devices?

It depends what you make: if you design or manufacture the finished medical device, ISO 9001 is not enough on its own, because regulators and device customers expect ISO 13485, the quality standard written specifically for medical devices, which shares its foundations with ISO 9001. If you supply components, services or non-device products to the medical trade, plain ISO 9001 is very often exactly the certificate your customers want.

What is the difference between ISO 9001 and ISO 13485?

ISO 9001 is the general quality management standard used across all industries, while ISO 13485 is the quality standard written specifically for medical devices, built on the same foundations as ISO 9001 but with extensive device-specific and regulatory requirement. Makers of the finished regulated device are expected to hold ISO 13485. ISO 13485 shares its foundations with ISO 9001, and ISO 9001 is the right standard for many businesses that supply the medical trade.

Do I need ISO 13485 or ISO 9001?

You need ISO 13485 if you design or manufacture the finished medical device, because that is what your regulator and device customers will require. You need ISO 9001 if you supply the medical trade without making the regulated device, such as components, contract services, packaging, distribution or non-device products, where a recognised general quality certificate is what customers ask for. If a customer or regulator names ISO 13485, that is what they mean; otherwise ISO 9001 usually covers it.

How much does ISO 9001 cost for a business supplying medical devices?

For an SME doing it sensibly, ISO 9001 certification with Plain Standards is $1,497 for the initial remote assessment, then $497 for each annual surveillance check and $997 to recertify at year three. That is far below the consultant-and-accredited route. ISO 13485, where you make the regulated device and it is required, is a separate and considerably more involved accredited certification, which is exactly why it is worth knowing which one you actually need before you start.

Get the right certificate for what you actually make or supply, without a consultant. Start with the free readiness quiz.

About the author

Written by Mike Armstrong, senior ISO consultant, former company director, and founder of Plain Standards. In over 30 years running companies at director level, Mike built his own management systems to drive profit long before he adopted ISO 9001, so he comes at this from the owner's side, not the auditor's. Plain Standards helps small and medium sized businesses get ISO certified without a consultant.