ISO 13485 Certification for Medical Device Makers
ISO 13485:2016 is the international quality management standard written for medical devices. In India it sits right next to the Medical Devices Rules, 2017, which make every licensed manufacturing site follow the Quality Management System in the Fifth Schedule. We prepare your QMS documents, coordinate with an accredited certification body and keep your records audit-ready.
What it is
ISO 13485 is a quality management system standard built only for organisations that work with medical devices. Its full title is “Medical devices — Quality management systems — Requirements for regulatory purposes”. The current version is ISO 13485:2016, the third edition, and ISO lists it as current. It covers design, production, storage, installation and servicing, with close attention to risk and traceability.
Unlike ISO 9001, it is about showing a regulator that your device is made the same safe way every time. In India, the Medical Devices Rules, 2017 (MDR) under the Drugs and Cosmetics Act, 1940 require every licensed manufacturing site to comply with the Quality Management System in the Fifth Schedule (rule 22). An ISO 13485 certificate is issued separately, by a certification body accredited for that standard.
Who it applies to
You make medical devices in India
Makers of Class A to D devices, from syringes and dressings to diagnostic kits and implants. Your MDR licence needs a working QMS; ISO 13485 gives that QMS an independent stamp. If you are still setting up, registering a private limited company first keeps licences and certificates in one name.
You export or make devices for others
Overseas buyers commonly ask for ISO 13485 before they place orders. Contract manufacturers making devices for brand owners hear the same question.
You import, store or service devices
The standard also covers distribution and servicing, so MD-15 licence holders and service firms often certify their own operations.
Why it matters
It supports your CDSCO licence
Under rule 20(3), a licence application to make Class A or B devices must carry an undertaking that the Fifth Schedule QMS has been complied with. A system built to ISO 13485 makes that undertaking easy to stand behind.
It opens export and tender doors
Overseas buyers and regulators often expect ISO 13485 as evidence of quality control.
It keeps notified-body audits calm
For Class A and B devices, a registered Notified Body audits your site. Records already kept to ISO 13485 discipline mean fewer surprises when the auditor arrives.
ISO 13485 and the Fifth Schedule side by side
One is a private certificate; the other is the law.
| Point | ISO 13485:2016 | MDR 2017 Fifth Schedule |
|---|---|---|
| Nature | Voluntary international standard | Legal requirement for licensed manufacturing sites |
| Who checks it | Accredited certification body | State or Central Licensing Authority and, for Class A/B, a Notified Body |
| Proof you hold | ISO 13485 certificate | MD-5 / MD-9 manufacturing licence |
| Validity | Three years, with yearly surveillance | Licence in perpetuity, with a retention fee every five years |
The Fifth Schedule requirements are broadly aligned with ISO 13485, though India adds its own expectations, such as environmental and clean-room conditions. In practice, one system built carefully can serve both. Take a Faridabad unit moulding plastic disposables for hospitals: the same batch records and supplier files that satisfy the licensing inspector also satisfy the ISO auditor.
Documents required
Business and licence papers
- Certificate of incorporation, partnership deed or other constitution document
- GST registration and factory or premises papers
- CDSCO manufacturing or import licence, if already held
- List of devices with their risk class
Quality system documents
- Quality manual and quality policy
- Documented procedures and work instructions
- Risk management file for each device
- Device master file and plant master file
Records and evidence
- Design and development records
- Supplier approval and purchase records
- Calibration, training and complaint records
- Internal audit report and management review minutes
How it works
Map your devices and processes
We list your devices, their MDR risk class and every process from purchase to dispatch. That tells us which clauses apply and which you can justify excluding.
Draft and roll out the QMS
We prepare the quality manual, procedures and formats, and help your team start keeping records. Here is the catch: documents alone do not pass an audit. The auditor wants to see weeks of real records. Technical work such as validation, sterilisation studies and testing stays with your engineers and accredited labs.
Run the internal audit and management review
Before the certification body visits, the system needs a full internal audit and a management review. We help you plan both and close the gaps.
Book an accredited certification body
We help you shortlist a body accredited for ISO 13485, for example by NABCB, and check its scope on the accreditation directory. The body runs a two-stage initial audit.
Close findings and receive the certificate
You correct any nonconformities with evidence. The body then decides and issues the certificate; we diarise surveillance and renewal.
Timelines
Three-year certificate cycle
Under ISO/IEC 17021-1, the certification cycle runs three years from the certification decision. Recertification must be completed before the certificate expires.
Yearly surveillance audits
Surveillance audits happen at least once each calendar year. The first one falls within 12 months of the certification decision.
MDR dates to diarise
For Class A devices, the Notified Body audit is due within 120 days of the licence being granted (rule 20(4)). Manufacturing licences stay valid only if the retention fee is paid every five years (rule 29).
What happens if your quality system slips
A major finding holds up the certificate
A major nonconformity must be corrected before the certification or recertification decision. Until then, no certificate is issued or renewed.
A missed renewal can mean starting over
If recertification is not finished before expiry, the body can restore the certificate only within six months of expiry, and only after outstanding activities are done. After that, it is a new initial audit.
Your MDR licence comes under scrutiny
The licensing authority and Notified Bodies check the Fifth Schedule QMS. Serious lapses found at inspection can lead to action against your manufacturing licence, which hurts far more than a lost certificate.
Frequently asked questions
Is ISO 13485 mandatory in India?
No, the certificate itself is voluntary, but the quality system behind it is not. Rule 22 of the Medical Devices Rules, 2017 requires every licensed manufacturing site to follow the Fifth Schedule QMS, and the licence application carries an undertaking to that effect. Many manufacturers build that QMS to ISO 13485 and then certify it. You get one system that serves your licence, your buyers and your export markets.
Which version of ISO 13485 is current?
ISO 13485:2016, the third edition, is the current version. ISO published it in 2016 and lists it as current, with no amendments. Certification bodies audit against this edition. Every new system should be built to the 2016 text, and we will flag any revision to you the moment ISO publishes one.
How is ISO 13485 different from ISO 9001?
ISO 13485 is written for regulatory compliance in medical devices, while ISO 9001 suits any business. ISO 13485 asks for more documentation, risk management across the product life cycle, traceability and handling of complaints and recalls. It does not include ISO 9001’s focus on customer satisfaction and continual improvement in the same way. Device makers usually need ISO 13485; some hold both certificates.
Who issues the ISO 13485 certificate?
An accredited certification body issues it after a two-stage audit, not ISO and not Taxhint. In India, NABCB accredits certification bodies for the QMS for medical devices (ISO 13485) scheme. Before you sign with a body, check that its accreditation scope covers ISO 13485 and your type of device. We shortlist bodies and verify their scope for you.
How long does the certificate stay valid?
The certificate runs for three years from the certification decision, under ISO/IEC 17021-1. During those three years the body visits for surveillance at least once a calendar year, with the first visit within 12 months. A recertification audit before expiry starts a fresh three-year cycle. We keep these dates on our calendar so you get reminders well in advance.
Does ISO 13485 replace the Notified Body audit under the MDR?
No, the two audits are separate. For Class B devices, a registered Notified Body audits your site before the licence is granted; for Class A, within 120 days after grant. The ISO 13485 audit is a private certification. A well-run ISO 13485 system usually makes the Notified Body audit smoother, because the same records answer most questions.
Do importers need ISO 13485?
Importers apply for an import licence in Form MD-14 and receive it in Form MD-15, with the documents listed in the Fourth Schedule. Quality system certificates for the overseas manufacturing site form part of that dossier, and ISO 13485 is the certificate most device makers hold. Importers that store and distribute devices may also certify their own operations. We help you assemble what the authority asks for.
Can a small unit get ISO 13485 certified?
Yes, size does not matter; the system just has to fit what you actually do. Think of a two-room unit in an industrial area packing one Class A product. It needs far fewer procedures than a multi-plant implant maker, but the same core records. A unit registered on Udyam as an MSME follows the same audit rules. We scale the documents to your operation, so you are not buried in paperwork.
What does Taxhint do, and what does the certification body do?
We handle documentation, records set-up, internal audit support, certification body coordination and ongoing compliance. The certification body does the audit and issues the certificate; accredited labs and your engineers handle testing, validation and technical files. This split keeps the audit independent. You get one point of contact for the paperwork and deadlines, from first draft to renewal.
What it costs
Our fee plus the government fee that applies to your case, quoted before you commit. Tell us the situation and we will price it exactly.
ISO 13485 has no government fee. The certification body charges its own audit fee, based on headcount, sites and device range. MDR licence and retention fees are separate.
Ready to begin?
Tell us your devices and their class, and we will map out the ISO 13485 and MDR paperwork you need.