ISO published ISO 9001:2026 (Edition 6) on 16 September 2026, and ISO 9001:2015 is now listed as withdrawn. ISO 13485:2016 (Edition 3) went through systematic review and was confirmed on 31 October 2025, so it remains the current edition. In the US, 21 CFR Part 820, the Quality Management System Regulation (QMSR), has incorporated ISO 13485:2016 by reference since 2 February 2026.
A new ISO 9001 edition prompts many software and device companies to ask which certificate regulators actually rely on. This article compares the two standards on edition status, purpose, structure and regulatory standing in the EU and the US.
Editions and status
| Standard | Current edition | Status on iso.org |
|---|---|---|
| ISO 9001 | ISO 9001:2026 (Edition 6) | Published 16 September 2026; ISO 9001:2015 and its Amd 1:2024 withdrawn |
| ISO 13485 | ISO 13485:2016 (Edition 3) | Confirmed after systematic review on 31 October 2025 |
Sources: iso.org, ISO 9001:2026 and ISO 13485:2016.
For ISO 9001, ISO states that certified organisations will have to transition to the new edition within the timeframe set by their certification cycle, and should contact their certification body. The new ISO 9001 edition does not change ISO 13485:2016.
Purpose: general quality versus regulatory purposes
ISO 9001 applies to organisations of any size and sector. Its emphasis is on meeting customer and applicable statutory and regulatory requirements, customer satisfaction and continual improvement.
ISO 13485 is titled "Medical devices — Quality management systems — Requirements for regulatory purposes". ISO's own FAQ explains that, compared with ISO 9001, it contains additional requirements specific to organisations involved in the life cycle of medical devices, while elements of ISO 9001 that are not relevant as regulatory requirements are not part of ISO 13485.
In our view, that is the core of the comparison. For a device manufacturer, ISO 13485 is the regulatory QMS standard. ISO 9001 adds value mainly for non-device business lines, or where a customer asks for it.
Structure
According to the ISO/TC 210 practical guide, ISO 13485:2016 follows the format of ISO 13485:2003 and ISO 9001:2008. It does not use the High Level Structure of Annex SL on which ISO 9001:2015 was built.
| ISO 9001 | ISO 13485:2016 | |
|---|---|---|
| Framework | Common management system structure | Format of ISO 13485:2003 and ISO 9001:2008 |
| Main topics | Context of the organisation, leadership, planning, support, operation, performance evaluation, improvement | 4 Quality management system, 5 Management responsibility, 6 Resource management, 7 Product realization, 8 Measurement, analysis and improvement |
| Link to the other standard | — | Annex B cross-references ISO 9001:2015 |
Sources: iso.org; ISO/TC 210 practical guide.
Annex B of ISO 13485 maps its clauses to ISO 9001:2015, not to ISO 9001:2026. An organisation that holds both certificates should therefore carry out its own gap analysis against the new ISO 9001 edition, rather than relying on that table.
What ISO 13485 adds for device manufacturers
The TC 210 guide points to several areas where ISO 13485 goes beyond a general QMS:
requirements for identified product types, such as sterile and implantable medical devices;
improvement driven by complaint handling, post-market surveillance, nonconformities and corrective and preventive action;
definitions in Clause 3 that differ from those in ISO 9000, so familiar quality terms do not always carry the same meaning.
Design and development requirements sit in Clause 7.3 of ISO 13485. For SaMD and AI-enabled devices, this is where software lifecycle evidence, design reviews and change control connect to the QMS. An ISO 9001 certificate from earlier IT or software services work shows that structured processes exist; it does not show that these device-specific controls are in place.
The EU: what the MDR recognises
Article 10(9) of the MDR requires manufacturers to establish, document, implement, maintain, keep up to date and continually improve a quality management system. Points (a) to (m) list what it must address, including the regulatory compliance strategy, management responsibility, risk management, clinical evaluation, product realisation, post-market surveillance, vigilance, and corrective and preventive action.
EN ISO 13485:2016 with AC:2018 and A11:2021 is a harmonised standard under the MDR, referenced through Implementing Decision (EU) 2022/6 (OJ L 1, 5 January 2022). ISO 9001 is not on the Commission's list of harmonised standards for medical devices.
Under MDR Article 8, conformity with a harmonised standard gives a presumption of conformity only for the requirements that standard covers. EN ISO 13485 supports the QMS part of Article 10(9); it does not cover every obligation in the Regulation. Our article on CE marking for medical devices explains where the QMS fits in the wider conformity assessment.
The US: what the QMSR incorporates
According to FDA's QMSR page and QMSR FAQ:
Part 820 incorporates ISO 13485:2016 and Clause 3 of ISO 9000:2015 by reference;
where ISO 13485 conflicts with the FD&C Act or FDA's other regulations, the Act and those regulations prevail;
FDA no longer uses QSIT and inspects under Compliance Program 7382.850;
FDA does not require or issue ISO 13485 certificates, and a certificate does not exempt a manufacturer from inspection;
a future revision of ISO 13485 would only apply in the US after FDA amends the regulation through rulemaking.
ISO 9001 is not incorporated into the QMSR. Note that Clause 3 of ISO 9000:2015 (vocabulary) is incorporated, which is a different document from ISO 9001. Our article on 21 CFR Part 820 covers the QMSR section by section.
The Medical Device Single Audit Program (MDSAP) allows one regulatory audit of a manufacturer's QMS for the participating authorities of Australia, Brazil, Canada, Japan and the United States. FDA may accept MDSAP audit reports as a substitute for routine inspections, and participation is voluntary.
Side-by-side comparison
| Aspect | ISO 9001 | ISO 13485:2016 | Source |
|---|---|---|---|
| Current edition | ISO 9001:2026 (Edition 6) | ISO 13485:2016 (Edition 3), confirmed 2025 | iso.org |
| Intended users | Any organisation, any sector | Organisations involved in the medical device life cycle | iso.org |
| Structure | Common management system structure | Format of ISO 13485:2003 / ISO 9001:2008 | ISO/TC 210 guide |
| Regulatory focus | Customer and applicable statutory and regulatory requirements | Requirements for regulatory purposes | iso.org |
| Product-type requirements | None | For example, sterile and implantable devices | ISO/TC 210 guide |
| EU harmonised status (MDR) | Not listed | EN ISO 13485:2016 + AC:2018 + A11:2021 | European Commission |
| FDA QMSR | Not incorporated | Incorporated by reference | FDA |
Sources: iso.org; ISO/TC 210 practical guide; European Commission; FDA.
A hypothetical example
Hypothetical example: a Dutch SaMD start-up holds an ISO 9001:2015 certificate from earlier IT services work and now plans CE marking and US market entry.
EU: MDR Article 10(9) applies to its QMS. ISO 9001 gives no presumption of conformity under the MDR; EN ISO 13485 can, for the requirements it covers.
US: the QMSR requires a QMS that complies with ISO 13485:2016 and the additional Part 820 requirements. The ISO 9001 certificate does not count towards this.
ISO 9001: whether to transition to ISO 9001:2026 is a separate business decision, for example if IT services customers still ask for the certificate.
The company's device QMS needs to be built on ISO 13485, whatever it decides about ISO 9001.
Conclusion
For a medical device manufacturer, ISO 13485:2016 is the standard regulators rely on: it is harmonised under the MDR and incorporated into the FDA QMSR. ISO 9001 remains useful for non-device business lines or customers who ask for it, and its 2026 edition changes nothing in ISO 13485 or the QMSR.
In our view, a certificate is evidence, not compliance. FDA neither requires nor issues ISO 13485 certificates, and in the EU the presumption of conformity covers only what the standard addresses. Our overview of the ISO 13485 quality management system covers the standard itself, and our article on medical device regulatory strategy for the EU and US explains how the QMS fits into a dual-market plan.
If you need help setting up or adapting your quality management system, our management system team can help, or contact MedQAIR.
Frequently asked questions
Does ISO 9001 satisfy the MDR?
No. ISO 9001 is not a harmonised standard under the MDR, so it gives no presumption of conformity. EN ISO 13485:2016 is harmonised, and gives a presumption only for the requirements it covers.
Do medical device manufacturers need both standards?
Not for regulatory purposes. ISO 13485 is the standard relevant to the MDR and the QMSR. ISO 9001 may still be useful for non-device business lines or where customers ask for it.
Does ISO 9001:2026 affect my ISO 13485 certificate?
No. ISO 9001:2026 does not change ISO 13485:2016 or the QMSR. If you also hold an ISO 9001 certificate, your certification body sets the transition timeframe within your certification cycle.
Does FDA accept ISO 13485 certificates?
FDA does not require or issue ISO 13485 certificates, and a certificate does not exempt a manufacturer from FDA inspection. FDA may, however, accept MDSAP audit reports as a substitute for routine inspections.
Is ISO 13485 being revised?
ISO 13485:2016 was confirmed after systematic review on 31 October 2025, so it remains the current edition. In the US, any future revision would only apply after FDA amends Part 820 through rulemaking.
