Certification - The Standards Navigator

ISO Training for AS9100, 13485 & 50001: Avoid Costly Gaps

ISO training for AS9100, ISO 13485, and ISO 50001 each demand a different course level, not one generic ISO training course. This guide breaks down who needs awareness, internal auditor, or lead auditor training for AS9100, ISO 13485, and ISO 50001 — plus where to get accredited training for each standard.

A role-by-role training pathway guide for aerospace, medical device, and energy management systems

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Training Gap Nobody Budgets For

If you’re looking for ISO training for AS9100, ISO training for ISO 13485, or ISO training for ISO 50001, you’ve probably already run into the problem: most ISO training is built for ISO 9001 and doesn’t translate cleanly to these three standards. Manufacturers get ISO 9001 training right, then add AS9100 for an aerospace contract, ISO 13485 for a medical device line, or ISO 50001 for an energy initiative — and send the same people to the same generic “ISO awareness” course they used for quality management.

That’s a mistake, and it shows up fast. AS9100 auditors expect your team to speak to AS9101 audit requirements and IAQG OASIS supplier expectations — not generic quality-speak. ISO 13485 auditors expect design controls and CAPA competency, not general QMS awareness. ISO 50001 auditors expect your team to understand energy performance indicators, not just environmental basics.

Each of these standards has its own competency requirement and its own training hierarchy — and AS9100 adds a formal auditor authentication scheme on top, though that scheme applies specifically to certification body auditors rather than every internal auditor. Sending the wrong person to the wrong course doesn’t just waste a training budget. It leaves a documented competence gap that shows up the moment an auditor interviews the person responsible for that system.

I’ve built training matrices from the ground up during ISO 9001 implementation at a 500-employee valve and energy manufacturing operation, and the lesson translates directly to every management system standard: auditors don’t just check whether training happened. They check whether the person trained can actually explain the requirement in their own words, in their own work area. A certificate on file means nothing if the person can’t demonstrate the competency behind it.

👉 If you’re building out training for a new standard, confirm where your system already stands before you spend on courses → Download the Manufacturing Compliance Checklist

Quick Answer: Which Training Level Do You Need?

Your Role	Recommended Training Level
Executive Sponsor / Leadership	Awareness
Quality Manager / System Owner	Lead Implementer
Internal Auditor	Standard-specific Internal Auditor course
Certification / Third-Party Auditor	Lead Auditor (with AS9104/3 authentication for AS9100)
Production Supervisor / Department Head	Foundation / Requirements-level
Shop Floor / All Personnel	Awareness

In This Guide:

Why AS9100, ISO 13485, and ISO 50001 each need standard-specific training — not generic ISO training
Training levels and who needs them for each standard
AS9100’s unique auditor authentication requirement (AS9104/3)
ISO 13485 training and its connection to FDA QMSR competence requirements
ISO 50001 training and energy performance indicator competency
Where to get accredited training for each standard
Common training mistakes specific to these three standards

👉 Start Here (Top Resources)

AS9100 & Aerospace Training — BSI Group — Probitas Authentication-recognized AS9100 training from awareness through lead auditor
ISO 13485 Training — BSI Group — Medical device QMS training with deep regulatory context
ISO 50001 Training — ISOQAR — Energy management awareness through lead auditor
AS9100 Rev D Gap Assessment Checklist — Confirm where your QMS stands before you invest in training
ISO 13485 Gap Assessment Checklist — Assess your medical device QMS against ISO 13485 requirements before scheduling training

Why These Three Standards Need Dedicated Training

ISO 9001, ISO 14001, and ISO 45001 share a harmonized high-level structure, which is why one training framework can reasonably cover all three — see ISO Training for Manufacturing Teams if that’s what you’re building. AS9100, ISO 13485, and ISO 50001 break from that pattern in three distinct ways:

Standard	What breaks from the ISO 9001 pattern
AS9100	Adds aerospace-specific clauses (configuration management, FAI, counterfeit parts) plus a formal auditor authentication scheme for certification auditors
ISO 13485	Replaced “continual improvement” with maintaining effectiveness, and now has to align with FDA QMSR, which made ISO 13485:2016 the operative regulation as of February 2, 2026
ISO 50001	Sits outside the quality/safety/environmental family — requires energy performance indicators and baseline methodology that don’t appear in any QMS or EMS course

If you’re evaluating certification bodies rather than training providers, see BSI vs ISOQAR for a full registrar comparison.

AS9100 Training: What Aerospace Suppliers Actually Need

AS9100 training carries a wrinkle the other standards on this list don’t have: a formal auditor authentication scheme. Under AS9104/3, certification body auditors seeking IAQG recognition must complete training through a Probitas Authentication-certified course. That requirement applies specifically to third-party certification auditors — internal auditors aren’t formally bound by it, but AS9104/3-aware training still benefits them, since it’s built around the same audit methodology customers and registrars expect to see reflected in your internal audit program.

A common scenario: a machine shop lands its first aerospace subcontract and assigns its existing ISO 9001-trained internal auditor to prep the QMS. The auditor knows the clause structure cold but has never worked with first article inspection requirements or configuration management controls — so the internal audit misses exactly the areas the customer’s supplier quality team will scrutinize first.

What AS9100 Training Covers Beyond ISO 9001

Configuration management and product safety requirements unique to aerospace
First article inspection (FAI) requirements under AS9102
Counterfeit parts prevention controls
Special requirements, critical items, and key characteristics
Risk management specific to aerospace supply chains
OASIS database requirements and supplier flow-down obligations

Who Needs AS9100 Training

Quality Manager / AS9100 Program Owner — Needs lead auditor or lead implementer training that specifically includes AS9104/3 authentication content. A generic ISO 9001 lead auditor credential typically does not provide sufficient coverage of aerospace-specific requirements such as AS9101, configuration management, product safety, and counterfeit parts prevention.

Internal Auditors — Need AS9100-specific internal auditor training. Formal AS9104/3 authentication isn’t required for internal auditors, but Probitas-recognized coursework still gives them the audit methodology customers and registrars expect to see — particularly useful if your organization plans to grow its internal audit program.

Production and Program Management — Need foundation-level AS9100 training covering configuration management, FAI, and counterfeit parts controls — the areas aerospace auditors probe hardest during a floor walkthrough.

All Personnel Touching Aerospace Work — Need awareness training covering product safety culture and counterfeit parts recognition, both explicit AS9100 requirements.

For a full breakdown of AS9100’s aerospace-specific clauses, see What Is AS9100? and Aerospace Supplier Compliance Standards.

Where to Get AS9100 Training

→ BSI Group AS9100 Training — BSI’s AS9100 catalog covers requirements through lead auditor training, with courses built around ISO 19011 audit methodology and Probitas Authentication recognition for the lead auditor level. BSI is the strongest option for AS9100 given their aerospace sector depth.

Purchase the official AS9100 standard through the ANSI Webstore before training begins — your team needs the current Rev D text in hand during coursework.

⚠️ Most common finding in aerospace audit prep: internal auditors trained only on generic ISO 9001 methodology, with no exposure to AS9104/3-aware audit practices or AS9101 audit reporting format. Formal authentication isn’t required for them, but when a customer or registrar reviews an internal audit program built entirely on ISO 9001 methodology, the gap surfaces fast.

Professional infographic mapping organizational roles to recommended ISO training levels for AS9100, ISO 13485, and ISO 50001, including executive sponsors, quality managers, auditors, supervisors, and shop floor personnel. — Assigning the appropriate ISO training to each organizational role builds competency, strengthens compliance, and improves certification readiness.

ISO 13485 Training: Meeting FDA QMSR Competence Expectations

ISO 13485 training has to accomplish something ISO 9001 training doesn’t: bridge a quality standard with an active regulatory framework. Since FDA QMSR incorporates ISO 13485:2016 by reference as the operative regulation for device manufacturers, training records now need to demonstrate competence against both the standard’s clauses and the regulatory context surrounding them.

A common scenario: a medical device startup trains its quality team on general ISO 9001 principles, assuming the overlap between the two standards covers the gap. The team performs fine on document control and internal audits — then struggles the first time a design history file review comes up, because ISO 9001 training never covered design control traceability or how a DHF ties back to risk management under ISO 14971.

What ISO 13485 Training Covers

Design and development controls, including design history file requirements
CAPA (Corrective and Preventive Action) process ownership and documentation
Risk management integration with ISO 14971
Regulatory requirements specific to device classification
Documentation and record retention aligned with FDA QMSR expectations
Internal audit methodology focused on maintaining effectiveness rather than continual improvement language

Who Needs ISO 13485 Training

Quality/Regulatory Affairs Lead — Needs requirements-level or lead implementer training that explicitly covers the FDA QMSR transition, not a course built solely around the ISO 13485 text in isolation.

Design and Development Personnel — Need training on design control requirements and design history file documentation — an area auditors and FDA reviewers scrutinize closely.

Internal Auditors — Need ISO 13485-specific internal auditor training. An ISO 9001 internal auditor credential does not adequately prepare someone to audit CAPA effectiveness or design control records.

Production and CAPA Owners — Need foundation-level training on nonconformance handling, CAPA documentation, and how “maintaining effectiveness” differs from the continual improvement language used in ISO 9001.

For deeper context on this terminology distinction, see Common Mistakes in ISO 13485 QMS and CAPA Requirements in ISO 13485.

Where to Get ISO 13485 Training

→ BSI Group ISO 13485 Training — BSI’s medical device training reflects direct regulatory experience across FDA, EU MDR, and global device markets — training only, not standard purchases.

Purchase the official ISO 13485:2016 standard from the ANSI Webstore — BSI does not pay commission on standards purchased directly, so route standard purchases through ANSI.

👉 Design controls and CAPA competency don’t build themselves from a training certificate alone. Pair training with a structured gap assessment before your next audit cycle → Download the ISO 13485 Gap Assessment Checklist

ISO 50001 Training: Building Energy Management Competency

ISO 50001 training is frequently treated as an extension of environmental management training. It isn’t. Energy management systems require a distinct competency set built around measurement and performance tracking rather than aspect/impact analysis.

A common scenario: a plant installs energy monitoring equipment and starts tracking consumption, assuming that satisfies the standard’s data requirements. During certification, the auditor asks how the energy performance indicators were established and what baseline period they’re measured against — and the team can’t answer, because nobody was trained on EnPI methodology specifically. The monitoring data exists; the defensible baseline behind it doesn’t.

What ISO 50001 Training Covers

Energy review methodology and identifying significant energy uses (SEUs)
Establishing energy baselines and energy performance indicators (EnPIs)
Legal and regulatory energy requirements
Data collection systems for energy monitoring
Internal audit methodology specific to energy management systems
Integration considerations with ISO 14001 for organizations running both systems

Who Needs ISO 50001 Training

Energy Manager / EnMS Owner — Needs lead implementer or requirements-level training covering EnPI methodology and energy baseline development. This is the most technical role on this list and benefits most from dedicated coursework rather than a generalist environmental credential.

Facilities and Maintenance Personnel — Need foundation training on how energy performance indicators connect to equipment operation and maintenance practices.

Internal Auditors — Need ISO 50001-specific internal auditor training. Auditing an EnMS requires evaluating energy data integrity and EnPI tracking — skills a generic management-systems auditor doesn’t automatically have.

For how ISO 50001 fits alongside other environmental and safety systems, see ISO 14001 vs ISO 50001.

Where to Get ISO 50001 Training

→ ISOQAR ISO 50001 Training — Awareness through internal and lead auditor courses covering EnMS audit methodology.

→ BSI Group ISO 50001 Training — Full training suite including on-demand eLearning fundamentals and IRCA-certified lead auditor coursework.

Purchase the official ISO 50001 standard from the ANSI Webstore before implementation training begins.

Training Level Comparison Across All Three Standards

Professional infographic showing two ISO training pathways, implementation and audit tracks, for AS9100, ISO 13485, and ISO 50001 with role-based competency progression. — Implementation and audit training follow different competency pathways, helping organizations assign the right ISO training to the right people.

Standard	Foundation Level	Internal Auditor	Lead Auditor / Implementer	Unique Requirement
AS9100	Configuration mgmt, FAI, counterfeit parts	AS9104/3-aware internal audit training	Probitas Authentication-recognized lead auditor	Auditor authentication scheme
ISO 13485	Design controls, CAPA basics	13485-specific audit training (not ISO 9001 credential)	Requirements/lead implementer with FDA QMSR context	Regulatory bridge to FDA QMSR
ISO 50001	Energy review, SEU identification	EnMS-specific audit training	EnPI methodology, lead auditor (IRCA)	Data/measurement-based competency

Where to Get Training for Each Standard

Per your affiliate priority mapping and BSI’s sector depth, BSI Group is the primary training provider for AS9100 and ISO 13485. ISOQAR is primary for ISO 50001, with BSI as a secondary option for organizations wanting a single training provider across systems.

⚠️ Always purchase the standard itself through the ANSI Webstore rather than through your training provider — BSI does not pay commission on standards purchased directly through their site, and ANSI consistently offers the most competitive pricing with coupon CC2026 for 5% off through December 31, 2026.

If you’re evaluating certification bodies rather than training providers specifically, the decision criteria differ — see BSI vs ISOQAR: Which ISO Training and Certification Body Is Right for You? for a full registrar-selection comparison across all three standards.

Professional infographic comparing implementation and audit training pathways with a role-based ISO training matrix for AS9100, ISO 13485, and ISO 50001 organizations. — This role-based training matrix helps organizations match ISO training levels to specific responsibilities while distinguishing implementation and audit career pathways.

Common Training Mistakes Specific to These Standards

1. Treating AS9100 training as “ISO 9001 plus a little extra.” The auditor authentication requirement alone makes this a fundamentally different training investment, not an add-on.

2. Training ISO 13485 teams on “continual improvement” language. If your training materials use ISO 9001 terminology instead of “maintaining effectiveness,” your team will misstate a core requirement to an auditor.

3. Assuming an ISO 14001-trained environmental manager can run an EnMS. Energy performance indicators and baseline methodology are a distinct skill set that environmental training doesn’t cover.

4. Skipping FDA QMSR context in ISO 13485 training. Since QMSR made ISO 13485:2016 the operative regulation in February 2026, training that treats the standard as a standalone quality framework — without regulatory context — leaves a competence gap.

5. Using generic ISO 9001 methodology for AS9100 internal audits. Formal authentication isn’t required internally, but if your auditors have never worked with AS9104/3-aware methodology or AS9101 reporting, a customer supplier-quality audit will notice the gap.

Quick Training Readiness Checklist

✅ Quality/program owner has standard-specific lead auditor or lead implementer training — not a generic ISO 9001 credential

✅ Internal auditors have completed training specific to the standard being audited

✅ AS9100 internal auditors have exposure to AS9104/3-aware audit methodology

✅ ISO 13485 training materials use “maintaining effectiveness” language, not continual improvement

✅ ISO 50001 program owner has completed EnPI and energy baseline methodology training

✅ Training records document competence — not just attendance

✅ Training effectiveness has been evaluated, not just completed

FAQ

Can I use my ISO 9001 lead auditor credential to audit AS9100?

For internal audits, yes — with gaps. Your credential covers the shared clause structure, but AS9100 audits also require familiarity with AS9101 audit reporting and aerospace-specific clauses like configuration management and FAI. For third-party certification auditing, formal IAQG authentication under AS9104/3 is required and an ISO 9001 credential alone doesn’t satisfy it.

Does ISO 13485 training need to reference FDA QMSR specifically?

Yes, if you manufacture for the US market. Since FDA QMSR became effective February 2, 2026 and made ISO 13485:2016 the operative regulation, training that doesn’t bridge the standard to QMSR competence expectations leaves a documentation gap auditors and FDA reviewers will notice.

Is ISO 50001 training the same as ISO 14001 training?

No. ISO 50001 requires competency in energy performance indicators, energy baselines, and significant energy use identification — concepts that don’t appear in ISO 14001’s environmental aspect/impact framework.

How long does AS9100 lead auditor training take?

Most Probitas Authentication-recognized AS9100 lead auditor courses run five days, combining classroom instruction with practical audit exercises and a written examination.

Who needs the AS9104/3 authentication specifically?

Formal AS9104/3 authentication applies to certification body auditors seeking IAQG recognition — it’s not a requirement for internal auditors within your own organization. That said, internal auditors benefit from AS9104/3-aware training, since it reflects the same audit methodology your customers and registrar will expect to see.

What’s the difference between an ISO 13485 internal auditor course and an ISO 9001 internal auditor course?

An ISO 13485 course trains auditors to evaluate design controls, CAPA effectiveness, and risk management integration with ISO 14971 — none of which appear in a standard ISO 9001 internal auditor course.

Do I need separate ISO 50001 training if my team already has ISO 14001 training?

Yes. While both are environmental/sustainability-adjacent, ISO 50001’s technical focus on energy measurement and EnPI tracking requires dedicated training your ISO 14001 course won’t cover.

Where do I purchase the AS9100, ISO 13485, or ISO 50001 standards my training is based on?

Purchase all three directly from the ANSI Webstore. Use coupon code CC2026 for 5% off through December 31, 2026.

📥 Free Resources

ISO 9001 Roadmap — Step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — Practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — Evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
ISO 13485 Gap Assessment Checklist — Free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification

Not Sure What to Do Next?

🔹 Still researching which standard applies to you — Read What Is AS9100? or Medical Device Compliance Standards for a foundational overview before committing to a training path.

🔹 Ready to schedule training now — BSI Group’s AS9100 and ISO 13485 training catalog covers awareness through lead auditor. ISOQAR’s ISO 50001 training covers energy management specifically.

🔹 Need to purchase the standard your training is based on — Get AS9100, ISO 13485, or ISO 50001 directly from the ANSI Webstore. Use code CC2026 for 5% off through December 31, 2026.

🔹 Deciding between certification bodies, not just training providers — See BSI vs ISOQAR for a full registrar comparison.

The Standards Navigator covers training, certification, and implementation guidance across every major manufacturing standard — not just the ones with the most search volume. If your operation is expanding into aerospace, medical device, or energy management work, get your team’s competency built on standard-specific training before your first surveillance audit tests the gap.

Stay Ahead of Specialized Compliance Training

Manufacturers expanding into aerospace, medical device, or energy management work don’t usually get caught by the standard itself. They get caught because they trained their team like the new standard was just a variation on ISO 9001.

Organizations that certify cleanly recognize each standard’s distinct competency requirements early and train accordingly — an AS9100 program owner who understands AS9104/3, an ISO 13485 quality lead who speaks FDA QMSR fluently, an energy manager who can build a defensible EnPI baseline.

The Standards Navigator covers training pathways, certification body selection, and implementation guidance across every standard your operation touches — not just the most common ones.

👉 Get updates on specialized ISO training across aerospace, medical device, and energy management 👉 Be first to access new gap assessment checklists as they’re released

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

How to Audit a Medical Device QMS: The ISO 13485 Internal Audit Process (2026 Guide)

This guide walks medical device manufacturers through the ISO 13485 Clause 8.2.4 internal audit requirement — including audit program design, the six-step audit process, and the five most common findings auditors cite. It also covers what changed under the FDA QMSR and the new ISO 19011:2026 audit guidance.

A clause-by-clause guide to planning, conducting, and closing out ISO 13485 internal audits under the new FDA QMSR

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Internal Audit That Used to Be Private Isn’t Anymore

For years, medical device manufacturers treated the internal audit report as an internal document — useful for finding problems, but shielded from FDA inspectors under the confidentiality provision in the old 21 CFR 820.180(c). That protection is gone.

Since February 2, 2026, the FDA’s Quality Management System Regulation (QMSR) has been in effect, and it incorporates ISO 13485:2016 by reference rather than running a parallel U.S.-specific standard alongside it. FDA’s own Final Rule FAQ is direct about what that means for audits: “The QMSR gives the FDA the authority to inspect management review, quality audits, and supplier audit reports. The exceptions that existed in the QS regulation at § 820.180(c) are not maintained in the QMSR.” That’s not a third-party interpretation — it’s FDA’s own published position.

So this isn’t limited to internal audit reports. Management review minutes and supplier audit reports lost the same protection. A checklist you run through once a year to satisfy Clause 8.2.4 on paper is no longer a low-risk approach — it’s now a document an inspector may read line by line, and so are the meetings where leadership reviewed it.

From the Floor: I’ve built and run internal audit programs at facilities with 500-plus employees, and the finding that costs organizations the most isn’t a missing procedure — it’s a corrective action that gets closed on paper before the root cause is actually fixed. As a certified ISO 9001 Internal Auditor, I’ve sat across the table from auditors who catch that in about ninety seconds. Whether you’re auditing to ISO 9001 or ISO 13485, the internal audit only works if it’s harder on you than the external one will be.

Before your next surveillance audit, most quality teams don’t fail because they misunderstand Clause 8.2.4 — they fail because their audit program looks complete on paper but hasn’t been stress-tested against real objective evidence. Run your QMS through the free ISO 13485 Gap Assessment Checklist before an inspector or a Notified Body does it for you.

In This Guide

What ISO 13485 Clause 8.2.4 actually requires
How internal audits differ from supplier and certification audits
What Clause 6.2 actually requires of your auditors — and what “competent” really means
Building a risk-based annual audit program
The audit process: planning, evidence, reporting, and CAPA follow-up
A real finding-to-CAPA example, start to finish
The five most common internal audit findings — and how to avoid them
What changes if you’re audited under MDSAP
What changed under the FDA QMSR and ISO 19011:2026
Whether you need outside help or can run this internally

👉 Start Here (Top Resources)

9001Simplified — Build Your Audit Program Without a Consultant — documentation and procedure templates you can adapt for a Clause 8.2.4 internal audit program without hiring outside help.
ISO 13485:2016 — ANSI Webstore — the official standard, which every internal audit checklist should be built against directly, not from a secondhand summary. Use code CC2026 for 5% off your order through December 31, 2026.
ISO 13485 Training — BSI Group — formal internal auditor training if you need documented Clause 6.2 competence records for your audit team.

What Clause 8.2.4 Actually Requires

ISO 13485 requires internal audits under Clause 8.2.4 to verify that QMS processes are implemented and effective, catch nonconformities, and surface QMS deficiencies early enough that they don’t become product-safety or regulatory problems. That sounds close to ISO 9001’s internal audit clause, and it is — but ISO 13485 asks for more.

Clause 8.2.4 requires that internal audits determine conformity to planned arrangements, the requirements of the standard, the organization’s own QMS requirements, and applicable regulatory requirements — and unlike ISO 9001, ISO 13485 explicitly requires the audit program to account for regulatory requirements such as FDA 21 CFR Part 820, EU MDR, or MDSAP alongside the standard itself. Teams that build their audit program purely off the ISO 13485 clause structure, without folding in the regulatory layer, are the ones who get flagged.

Most common finding: auditors treat Clause 8.2.4 as a documentation-review exercise and skip the regulatory cross-reference entirely. If your audit checklist doesn’t ask “does this also satisfy 21 CFR Part 820 or MDR Article 10?” it isn’t finished.

Audits must assess conformity across critical processes — design and development under Clause 7.3, corrective action under Clause 8.5.2, preventive action under Clause 8.5.3, production under Clause 7.5, and document control under Clause 4.2 — using objective evidence like device history records, audit trails, and validation records. Auditors must be trained, qualified, and independent of the area they’re auditing, with that competence documented under Clause 6.2.

If you are already ISO 9001 certified → your internal audit infrastructure transfers directly, but your checklist needs a regulatory column added for every process area, not just a conformity column.

Internal Audits vs. Supplier Audits vs. Certification Audits

Comparison infographic showing internal audits, supplier audits, and certification audits under ISO 13485. — Understanding the differences between internal, supplier, and certification audits improves audit planning and regulatory compliance.

Manufacturers frequently conflate these three, and an auditor will notice immediately if your procedure does too.

Audit Type	Governing Clause	Performed By	Primary Purpose
Internal Audit	Clause 8.2.4	Trained internal personnel, independent of the area audited	Verify your own QMS conforms to the standard and your own procedures
Supplier Audit	Clause 7.4.1	Quality or supplier quality personnel	Verify external providers meet quality and regulatory requirements
Certification Audit	ISO/IEC 17021-1	Accredited third-party Notified Body or registrar	Determine whether the full QMS meets ISO 13485 for certification

ISO 13485 requires internal audits, just as its sister standard ISO 9001 does, and they exist for two reasons: to confirm the QMS meets the standard’s requirements, and to confirm the organization actually follows its own rules. A strong internal audit program is what makes a certification audit uneventful instead of a fire drill.

Auditor Competence: What Clause 6.2 Actually Requires

This is the section most audit programs get thin on, and it’s where a surprising number of otherwise solid internal audit programs fall apart under scrutiny.

Clause 6.2 requires that anyone doing work affecting product quality — and that includes auditors — be competent based on appropriate education, training, skills, and experience. ISO 13485 doesn’t spell out a fixed list of required knowledge areas the way a checklist would, but three areas consistently show up when a Notified Body reviews auditor files:

The standard itself. A working knowledge of ISO 13485:2016 clause structure, not just the SOPs written to satisfy it.
Audit methodology. Understanding of the audit cycle — planning, evidence gathering, reporting, follow-up — along with the difference between a minor observation and a major nonconformity. ISO 13485’s own note under Clause 8.2.4 points auditors toward ISO 19011 for this.
Applicable regulatory context. Basic familiarity with the regulations that apply to your product and markets — 21 CFR Part 820, EU MDR, MDSAP — not full legal mastery, but enough to recognize when a finding also touches a regulatory requirement.

Competence is not the same thing as certification. ISO 13485 does not require a certified internal auditor credential, and ISO 19011 doesn’t mandate formal training either — the standard’s actual requirement is that the audit process ensure objectivity and impartiality, and that competence be evaluated and documented. In practice, though, “read and understand the internal procedure” is not evidence Notified Bodies accept as sufficient. An auditor who can’t produce a training record, a completed course certificate, or documented on-the-job evaluation showing how their competence was assessed is a finding waiting to happen — even if that person is, in fact, good at the job.

What acceptable training records look like in practice:

A certificate of completion from an ISO 13485 internal auditor course (typically covering the standard itself plus ISO 19011 audit methodology) — see BSI vs. ISOQAR if you’re deciding where to send your team for that training
Internal on-the-job qualification records — a documented mentored audit or two, signed off by a qualified lead auditor
A training matrix that ties each auditor to the specific processes and clauses they’re qualified to audit, refreshed when the QMS or the standard changes

Auditor independence gets checked alongside competence. The most frequent failure here isn’t a skills gap — it’s a quality manager who owns a process auditing that same process, or an auditor rotation that never actually rotates the highest-risk areas like design controls.

If you are not confident your auditor files would hold up to this list → that’s a fifteen-minute file review, not a project, and it’s worth doing before your next Notified Body visit rather than during it.

Building a Risk-Based Audit Program

The audit program must cover every process, department, and site within your QMS scope, with audit frequency determined by the status and importance of each process along with the results of prior audits. High-risk processes — design and development, production, CAPA, and complaint handling — typically need at least annual coverage, while lower-risk support functions can be audited less frequently if previous results were consistently clean.

Most manufacturers get the frequency question backwards. They audit everything on a flat annual calendar instead of weighting toward where the last audit found something. If your CAPA process had a finding last year, auditing it again on the same twelve-month clock as your HR training records is a scheduling decision an inspector will question.

If you are preparing for your first surveillance audit under the new QMSR → build your program around the regulatory cross-reference first, then layer the standard’s clause structure on top of it — not the other way around.

The Internal Audit Process, Step by Step

Infographic illustrating the ISO 13485 internal audit process from planning through CAPA verification for medical device quality management systems. — The six-step ISO 13485 internal audit process helps medical device manufacturers identify nonconformities and verify corrective actions.

Prepare a checklist based on the relevant clauses of ISO 13485, your documented procedures, and applicable regulatory requirements — a good checklist prompts investigation rather than simply confirming what’s already assumed to be true.

1. Scope and schedule. Define which processes, sites, and clauses are in scope for this audit cycle.

2. Documentation review. Analyze the quality manual, procedures, and prior audit reports before setting foot on the floor — this is where checklists get mapped to specific clauses.

3. Opening meeting. Confirm scope, objectives, and methodology with the auditee before evidence-gathering begins — this sets the tone for the entire audit.

4. Evidence gathering. Collect objective evidence through interviews, direct observation, and document/record review — no finding should be written down without evidence behind it.

5. Reporting. Findings get written up, classified by severity, and routed to the process owner and management.

6. CAPA follow-up. Every corrective action needs documented root cause analysis appropriate to the significance of the nonconformity, with effectiveness verified before the CAPA is closed.

Most teams execute steps 1 through 5 competently. Step 6 is where programs fall apart — a CAPA gets marked closed the day the immediate fix is implemented, with no verification that the fix actually held.

Trigger: If your last three internal audits found the same category of nonconformity in different words each time, that’s not three separate findings — that’s one root cause your CAPA process never actually reached.

Before your next audit cycle, check your CAPA closure process against what auditors actually verify — most teams don’t realize how thin their effectiveness checks are until someone else reviews them.

A Real Finding, Start to Finish

Steps on a page are easy to nod along with. Here’s what a properly closed finding actually looks like end to end, using one of the most common design-control gaps auditors find.

Stage	What It Looked Like
Finding	During a design and development audit, three of twelve design verification records sampled were missing the reviewer’s signature. Work was completed and dated, but sign-off wasn’t captured.
Objective Evidence	Design History File records DHF-114, DHF-119, and DHF-122, cross-referenced against the design review meeting minutes showing the reviews occurred.
Nonconformity Statement	“Design verification records DHF-114, DHF-119, and DHF-122 lack the required reviewer signature per QMS-SOP-014, Section 6.2. Design and development control per ISO 13485:2016 Clause 7.3.6 requires verification results, including necessary actions, to be recorded.”
Root Cause	Investigation traced it to a recent SOP revision that moved the sign-off step later in the workflow. Staff hadn’t been retrained on the updated sequence — the procedure changed, but the training that should have accompanied it under Clause 6.2 didn’t happen.
Correction	The three records were completed retroactively with the reviewer’s signature and a note explaining the delay, reviewed and accepted by the quality manager.
Corrective Action (CAPA)	Retrain design team on the revised sign-off sequence; add a mandatory signature field to the design review template so records can’t be filed incomplete.
Effectiveness Check	Sample the next ten design verification records over the following quarter. Zero missing signatures required to close the CAPA as effective.

Notice what makes this closeable rather than cosmetic: the root cause isn’t “people forgot” — it’s a training gap tied to a specific procedure change, and the corrective action addresses the system, not just the three records. That’s the difference between a finding that stays closed and one that reappears with different reference numbers next year.

The Five Most Common Findings

Infographic highlighting the five most common ISO 13485 internal audit findings in medical device quality management systems. — The most common ISO 13485 internal audit findings often involve documentation, CAPA effectiveness, auditor competence, and risk-based planning.

Incomplete audit records — missing reports, plans, or linked CAPAs — is one of the most frequently cited internal audit issues. A close second is failing to apply a risk-based approach to audit planning, or simply not maintaining the internal audit schedule at all. Beyond that, auditors regularly find no timely follow-up on actions from internal audits, no records showing auditor competence against the applicable regulations, and auditors who weren’t actually impartial — reviewing work they had a hand in.

Design and development controls remain the single most frequently cited nonconformity area globally — incomplete design inputs, missing verification or validation records, undocumented design changes, or no formal design transfer procedure. See Validation & Verification Requirements for how this plays out in practice.

⚠️ If your auditor rotation lets the same person audit design controls year after year without ever being audited themselves on that same process, that’s an impartiality gap that a Notified Body will flag before you do.

If you are not confident your last internal audit would hold up under this list → that’s exactly what a structured gap assessment is for, not a guess.

Check your program against these five findings before your next audit — most gaps take under 45 minutes to identify →

MDSAP: What Changes for Multi-Market Audits

If your devices sell into more than one of the five MDSAP markets — the U.S., Canada, Australia, Brazil, or Japan — your internal audit program needs to account for a different audit model, not just an extra regulatory reference.

The Medical Device Single Audit Program lets one audit by an accredited Auditing Organization satisfy the requirements of all five participating regulators at once, in place of separate national audits. It’s built on ISO 13485:2016, but it isn’t a straight overlay — MDSAP uses a process-based audit model with a defined sequence, rather than working straight down the ISO clause list, and it maps every audit task to both the relevant ISO 13485 clause and each country’s specific regulatory requirement.

The grading system is the biggest practical difference. Where an ISO 13485 certification audit typically classifies findings as minor or major, MDSAP uses a points-based Grade 1–5 scale: nonconformities affecting clauses with indirect QMS impact start lower, direct-impact clauses start higher, and points are added for repeat findings or for a nonconforming product that was actually released. Grade 4 and 5 findings must be resolved before a certificate is issued or maintained — there’s no ambiguity about severity once the math is run.

What this means for your internal audit program: if you’re pursuing or maintaining MDSAP, your internal audits should follow the MDSAP process sequence — not just walk through ISO 13485 clauses in order — so that gaps surface in the same structure an Auditing Organization will use. The recurring findings across published MDSAP audits track closely with the same weak points internal audits should already be hunting for: open CAPAs left unclosed past a reasonable window, supplier and purchasing controls that don’t demonstrate follow-through, and root cause analysis that’s thin enough to not survive a second look.

One benefit worth knowing about: MDSAP audit reports can substitute for the FDA’s routine biennial device inspections. A well-run MDSAP program isn’t just multi-market efficiency — it can reduce how often FDA shows up separately.

What Changed: QMSR and ISO 19011:2026

Two regulatory shifts affect how internal audits get run in 2026, and both are recent enough that older internal procedures may not reflect them.

Since February 2, 2026, the FDA’s QMSR has incorporated ISO 13485:2016 by reference, replacing the former Quality System Regulation, and FDA inspections now run under Compliance Program 7382.850 rather than the old QSR framework. As covered above, the practical effect for internal audits is direct: the confidentiality safe harbor that used to apply to internal audit reports, management review records, and supplier audit reports under the old 21 CFR 820.180(c) has been removed, and FDA’s own FAQ confirms it in plain language.

Separately, ISO published the fourth edition of ISO 19011 — Guidelines for auditing management systems — on May 27, 2026, replacing the 2018 edition that had guided audit programs for nearly eight years. ISO 13485 doesn’t mandate ISO 19011 compliance directly — Clause 8.2.4 references audit principles in its own language — but Notified Bodies and experienced auditors widely treat ISO 19011 as the authoritative reference for structuring an audit program, so if your internal audit SOPs still cite the 2018 edition, expect your Notified Body to ask why.

Neither change requires rebuilding your program from scratch. Both are reasons to review your internal audit SOP this year rather than next.

Quick Audit-Readiness Checklist

✅ Audit program covers every process, site, and department in your QMS scope ✅ Audit frequency is risk-weighted, not a flat annual calendar
✅ Every checklist item maps to a specific ISO 13485 clause and the applicable regulatory requirement
✅ Auditors are independent of the area they’re reviewing, with Clause 6.2 competence records on file — not just “read and understand” sign-offs
✅ Findings are backed by objective evidence — interviews, observation, or documented records
✅ CAPA effectiveness is verified before closure, not assumed
✅ If pursuing MDSAP, internal audits follow the MDSAP process sequence, not just the ISO clause order
✅ Internal audit SOP references ISO 19011:2026, not the 2018 edition
✅ Design and development records are current — this is the single most-cited finding category

FAQ

How often does ISO 13485 require internal audits?

The standard doesn’t specify a fixed interval — it requires audits “at planned intervals” based on process risk and prior audit history. Most manufacturers audit high-risk processes like design controls and CAPA annually at minimum, with lower-risk support functions audited less frequently if history is clean.

Can the same person who performs a process also audit it?

No. Clause 8.2.4 requires auditors to be independent of the area being audited. A quality manager who owns the CAPA process, for example, shouldn’t be the one auditing CAPA compliance.

Do internal auditors need a formal certification?

No. ISO 13485 requires documented competence — education, training, skills, and experience — but doesn’t mandate a specific certification. In practice, most Notified Bodies expect more than an internal read-and-understand sign-off, so a course certificate or documented mentored-audit record is the safer standard to work toward.

Does the FDA QMSR require a separate internal audit program from ISO 13485?

No. Since the QMSR incorporates ISO 13485:2016 by reference, there isn’t a separate U.S.-specific internal audit requirement layered on top — your Clause 8.2.4 program is the audit program the FDA now expects, with the regulatory cross-reference built in.

Are internal audit reports confidential from FDA inspectors?

Not anymore. FDA’s own QMSR Final Rule FAQ confirms the confidentiality exceptions under the old 21 CFR 820.180(c) — covering internal audits, management review, and supplier audits — are not maintained under the QMSR.

What’s the difference between an internal audit and a supplier audit under ISO 13485?

Internal audits (Clause 8.2.4) evaluate your own QMS. Supplier audits (Clause 7.4.1) evaluate external providers’ ability to meet your quality and regulatory requirements. Both are required, but they’re separate programs with separate scopes.

Does MDSAP replace our ISO 13485 internal audit requirement?

No, but it changes the structure. MDSAP is built on ISO 13485 and layers in country-specific regulatory requirements from up to five markets, using a process-based sequence and a points-based Grade 1–5 nonconformity system rather than the minor/major classification used in standard certification audits.

What’s the most common reason internal audit programs fail a certification audit?

Incomplete records — missing audit reports, plans, or linked CAPAs — combined with no evidence of a risk-based approach to scheduling. Both are findings a Notified Body catches quickly because they’re procedural gaps, not technical ones.

Should we hire a consultant to run our internal audits, or can we do it ourselves?

Either can work if the auditor is properly trained and genuinely independent of the process. Many manufacturers use in-house auditors for most cycles and bring in an outside auditor periodically to test whether their internal program is actually rigorous or just familiar with its own blind spots.

📥 Free Resources

ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification

Not Sure What to Do Next?

🔹 Still researching your audit obligations? Start with ISO 13485 Documentation Requirements to understand what your QMS needs on paper before you audit it.

🔹 Ready to build or strengthen your audit program? 9001Simplified’s documentation templates can shortcut the SOP-writing process without a consultant retainer.

🔹 Need the standard itself to build your checklist against? Get ISO 13485:2016 from ANSI Webstore — code CC2026 takes 5% off through the end of 2026.

An internal audit program that only exists to satisfy Clause 8.2.4 on paper was already a risk before the QMSR removed the confidentiality safe harbor. Now it’s a document an inspector can read directly. The Standards Navigator will keep tracking what QMSR enforcement and ISO 19011:2026 mean for how medical device manufacturers actually run their audit programs — not just what the clause says.

Most manufacturers don’t lose a certification over one bad audit finding — they lose it over a pattern of findings their own internal audit program should have caught first. Organizations that treat Clause 8.2.4 as a paperwork requirement get surprised at surveillance. Organizations that treat it as their first line of defense rarely do.

The Standards Navigator tracks how ISO 13485, the FDA QMSR, and the standards that govern medical device audits actually work in practice — not just what the clause text says.

👉 Get updates on ISO 13485 audit requirements and QMSR enforcement changes 👉 Be first to access new medical device compliance checklists and gap assessment tools

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

Biocompatibility Standards Explained: ISO 10993 Requirements for Medical Devices in 2026

This guide breaks down the ISO 10993 series and the sixth edition of ISO 10993-1, published in November 2025. It covers FDA’s partial recognition of the new edition in May 2026, the two clauses the agency excluded, and whether manufacturers need to revisit biological evaluation plans for devices already cleared.

What ISO 10993-1:2025 and FDA’s Partial Recognition Mean for Your Biological Evaluation Plan

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Standard Behind Your Biocompatibility Testing Just Changed — Is Your Documentation Still Defensible?

Biocompatibility standards for medical devices just changed in a way regulatory affairs teams can’t ignore. If your device has any contact with the human body, your biological evaluation plan rests on one standard: ISO 10993-1. For years, that meant the 2018 edition. That’s no longer the whole story.

ISO published a sixth edition, ISO 10993-1:2025, in November 2025. The FDA followed with recognition of that edition on May 25, 2026 — but only partial recognition. Two specific clauses were excluded outright. If your technical documentation, supplier certificates, or biological evaluation reports still cite the 2018 edition without addressing what changed, that’s a gap a reviewer or auditor will find.

This isn’t a cosmetic update. The reorganization ties biocompatibility more tightly to ISO 14971 risk management, and the FDA’s exclusions tell you exactly where the agency still wants you to lean on its own biocompatibility guidance instead of the standard’s language. This guide covers the current medical device biocompatibility testing requirements under both editions, what changed, and what FDA’s recognition decision actually means for your Biological Evaluation Plan (BEP).

I’ve been on the reviewing side of this problem before, just from the documentation control angle. As an ISO 9001 internal auditor, I’ve flagged design history files where a supplier’s certificate of conformance still referenced an outdated edition of a cited standard — the technical content hadn’t changed, but the paper trail no longer matched what the standard actually required. That’s the kind of finding that stalls a submission or an audit closeout, and it’s entirely avoidable if someone catches the edition mismatch before a reviewer does.

Before you touch a single test report, run a gap check on where your current documentation stands against the 2025 edition.

👉 Most teams don’t fail because their biocompatibility data is wrong — they fail because their documentation still points to the wrong edition of the standard. Run the ISO 13485 Gap Assessment Checklist before your next submission or audit →

In This Guide

What ISO 10993-1 covers and why it sits at the center of biocompatibility evaluation
The full ISO 10993 series, part by part
What actually changed in the 2025 edition
FDA’s partial recognition — and exactly what it excluded
Whether you need to retest devices already cleared under the 2018 edition
How biocompatibility documentation fits into your ISO 13485 QMS
A quick audit checklist for your next document review

👉 Start Here (Top Resources)

ISO 10993-1:2025 — ANSI Webstore — the current edition of the core biocompatibility standard, available as an individual purchase or bundled with related parts of the series.
ISO 10993 – Biological Evaluation of Medical Devices Package (bundled, ~45% off individual pricing) — the most cost-effective way to get ISO 10993-1, -5, -6, -7, and related parts together if you’re building out a complete biological evaluation file.
BSI Group ISO 13485 Training — for teams that need to train reviewers or auditors on how biocompatibility evidence fits into the broader QMS, not just the lab side.

What Is Biocompatibility, and Why ISO 10993 Matters

Biocompatibility is the assessment of whether a device’s materials — and the way those materials contact the body — create an unacceptable biological risk. ISO 10993-1 is the standard that governs how you plan, justify, and document that biocompatibility risk assessment. It doesn’t hand you a checklist of tests to run blindly; it requires you to build a risk-based Biological Evaluation Plan (BEP) that considers the device’s materials, manufacturing processes, intended anatomical contact, and exposure duration.

That risk-based framing matters because it’s the same language FDA reviewers and notified bodies expect to see. A BEP that reads like a 2009-era test list, rather than a risk justification tied to ISO 14971, is a common source of review questions and additional information requests.

If you’re still building out your risk management process, our guide on risk management in medical devices under ISO 14971 covers the foundation ISO 10993-1 now leans on even more heavily than before.

The ISO 10993 Series at a Glance

Infographic showing the ISO 10993 series for biological evaluation of medical devices, including ISO 10993-1, -5, -6, -7, -10, -12, -17, and -18. — The ISO 10993 series consists of multiple standards that together form a complete biological evaluation framework for medical devices.

ISO 10993-1 doesn’t stand alone — it’s the framework document for a series that covers specific test methods and evaluation categories.

Part	Covers	Status Note
ISO 10993-1	Overall evaluation and testing within a risk management process	Sixth edition (2025) now partially recognized by FDA
ISO 10993-5	In vitro cytotoxicity	2009 edition, still current
ISO 10993-6	Local effects after implantation	Updated 2026 edition
ISO 10993-7	Ethylene oxide sterilization residuals	Updated 2026 edition
ISO 10993-10	Irritation and skin sensitization	2021 edition
ISO 10993-12	Sample preparation and reference materials	2021 edition, amended 2025
ISO 10993-17	Toxicological risk assessment of device constituents	2023 edition, amended 2025
ISO 10993-18	Chemical characterization of materials	2020 edition, amended 2022

Most common finding: Manufacturers cite ISO 10993-5 or -10 correctly but leave the ISO 10993-1 reference in their design history file pointing to the 2018 edition without any documented rationale for why. If your BEP hasn’t been revisited since the 2025 edition published, that’s the first thing to check.

If your device is sterilized and you haven’t looked at how the 2026 edition of ISO 10993-7 interacts with your sterilization validation, our sterilization standards overview walks through ISO 11135, 11137, 17665, and 11607 alongside it.

What Changed in ISO 10993-1:2025

The sixth edition isn’t a light refresh. ISO’s technical committee reorganized the standard and changed its title to explicitly align with the ISO 14971 risk management framework. The practical changes:

More detailed guidance on calculating exposure duration — including how to treat foreseeable misuse, such as a device used longer than its labeled duration.
Expanded guidance on device characterization and biological hazard identification, intended to reduce reliance on generic test batteries.
Terminology aligned with ISO 14971, so if your team already knows that standard, the 2025 edition should read more consistently — though NAMSA and other industry commentators note there isn’t yet a technical report equivalent to ISO/TR 24971 to guide interpretation of the new edition.

Here’s how the two editions compare on the points that matter most for your Biological Evaluation Plan:

Topic	2018 Edition	2025 Edition
Risk Management Integration	Referenced ISO 14971	More explicitly aligned throughout
Exposure Duration	Limited guidance	Expanded methodology for calculating duration, including foreseeable misuse
Biological Hazard Identification	Less detailed	Expanded guidance on device characterization and hazard identification
Risk Estimation	Different treatment	New Clause 6.9 (excluded by FDA)

If you are preparing a Biological Evaluation Plan for a new device → start by confirming which edition your FDA reviewer or notified body expects to see referenced, since adoption isn’t uniform across regions. The EU has generally moved faster toward treating the 2025 edition as state of the art. Manufacturers should verify current adoption expectations directly with their notified body and applicable competent authorities, since implementation timing varies and is subject to change.

One shift worth flagging for regulatory teams building out a modern BEP: chemical characterization under ISO 10993-18 is playing a larger role than it used to. Rather than defaulting to a blanket biological test matrix for every device, more manufacturers are leaning on thorough chemical characterization data — extractables and leachables profiles, material composition analysis — to justify a narrower, risk-based testing strategy. ISO 10993-1:2025’s expanded hazard identification guidance reinforces this shift. A well-documented ISO 10993-18 characterization can reduce redundant biological testing, but only if the chemistry-driven rationale is documented clearly enough to withstand a reviewer’s scrutiny.

Comparison graphic showing the major differences between ISO 10993-1:2018 and ISO 10993-1:2025 for biological evaluation of medical devices. — The 2025 edition places greater emphasis on risk management integration, biological hazard identification, and exposure assessment.

ISO 10993 FDA Recognition: What’s Excluded and Why

🔑 Key FDA Takeaway FDA recognizes ISO 10993-1:2025, but excludes:

The “consumer products” language in Clause 6.5.11.3

Clause 6.9 on biological risk estimation

Manufacturers should document alternative justification using FDA guidance and ISO 14971.

On May 25, 2026, FDA updated its Recognized Consensus Standards database (Recognition No. 2-313) to include ISO 10993-1:2025 — but not in full. Two specific exclusions matter for your submissions:

The phrase “consumer products or” in Clause 6.5.11.3. This clause addresses low-risk, intact-skin-contacting devices. The standard allows manufacturers to point to a material’s history of safe use in consumer products as justification for reduced testing. FDA excluded this because it conflicts with Attachment G of its 2023 biocompatibility guidance, which defines specific materials with an accepted history of use — a consumer product history alone doesn’t automatically satisfy FDA’s expectations.
Clause 6.9 on biological risk estimation. FDA determined this clause conflicts with the risk estimation approach already established in the FDA-recognized ISO 14971:2019. Sponsors can’t rely on Clause 6.9 to claim conformity in a submission.

If you are under customer or notified body pressure to update your BEP quickly → prioritize reviewing these two clauses first. They’re the specific areas where citing the 2025 edition alone won’t satisfy FDA, and you’ll need to document your justification through existing FDA guidance instead.

Partial recognition means you cannot submit a clean Declaration of Conformity to the full 2025 edition. Your submission documentation needs to call out the partial recognition explicitly and show how you’re addressing the excluded clauses — silence on this point is what generates additional information requests.

Workflow illustrating FDA partial recognition of ISO 10993-1:2025 and the documentation required for excluded clauses during medical device submissions. — FDA recognizes ISO 10993-1:2025 with specific exclusions, requiring manufacturers to document alternative regulatory justifications.

Do You Need to Retest Already-Cleared Devices?

This is the objection I hear most from teams looking at this update: does a new edition mean I have to redo my biocompatibility testing on devices that already have clearance?

No — not automatically. FDA’s recognition of a newer edition doesn’t retroactively invalidate data or clearances based on the 2018 edition. If you already hold clearance under the 2018 edition → you don’t need to retest existing devices. What you do need is a documented rationale, at your next design change or periodic review, for why your BEP still reflects sound risk management even though a newer edition exists. That’s a documentation and justification exercise, not a lab exercise.

Where this becomes a live issue is new submissions and significant design changes going forward — those are where reviewers will expect to see the current edition addressed.

Where Biocompatibility Fits Into Your ISO 13485 QMS

Biocompatibility data doesn’t live in isolation — it’s part of your design and development file under ISO 13485, and it feeds directly into your risk management file under ISO 14971. If your ISO 13485 documentation structure doesn’t have a clear place for biological evaluation plans, reports, and the rationale behind edition changes, that’s a gap worth closing before your next internal audit — not after a nonconformance is written.

This also connects to supplier controls. If a component supplier’s certificate of conformance references ISO 10993-1 by edition, your incoming inspection and supplier qualification process needs a mechanism to catch when that reference goes stale — the same principle covered in our guide on common mistakes in ISO 13485 QMS implementation.

And if you’re managing devices sold in both the US and EU, the edition-adoption gap between FDA and the EU regulatory framework is one more reason to keep your MDR vs ISO 13485 documentation aligned rather than treating them as separate tracks.

👉 If your biological evaluation documentation hasn’t been reviewed since the 2025 edition published, don’t wait for a finding to tell you. Check where your QMS documentation actually stands →

Quick Audit Checklist

✅ Confirm which edition of ISO 10993-1 your current BEP references, and whether that matches what your reviewer or notified body expects
✅ Check whether your device’s biocompatibility justification relies on Clause 6.5.11.3 (consumer product history) or Clause 6.9 (risk estimation) — both need alternative justification for FDA submissions
✅ Verify supplier certificates of conformance cite current standard editions, not stale references
✅ Confirm your risk management file cross-references your BEP consistently ✅ If your device is sterilized, check the 2026 editions of ISO 10993-6 and -7 against your current validation data ⚠️ Don’t assume “FDA recognized” means “fully accepted” — verify the Supplementary Information Sheet for any standard before citing it as a full Declaration of Conformity

FAQ

What is biocompatibility testing for medical devices?

Biocompatibility testing evaluates whether the materials in a medical device, and the way those materials contact the body, could cause an unacceptable biological response. It covers areas like cytotoxicity, sensitization, irritation, and systemic toxicity, selected based on the device’s contact type and duration.

What is ISO 10993-1, and do I need to comply with it?

ISO 10993-1 is the framework standard that governs how you plan and justify a biological evaluation within a risk management process. If your device contacts the body directly or indirectly, FDA and most global regulators expect your biocompatibility strategy to follow its structure, even where full conformity isn’t feasible.

What changed between ISO 10993-1:2018 and ISO 10993-1:2025?

The 2025 edition reorganized the standard to align more closely with ISO 14971, added detailed guidance on calculating exposure duration and identifying biological hazards, and updated terminology throughout.

Has the FDA recognized ISO 10993-1:2025?

Yes, as of May 25, 2026, but only partially. FDA excluded the “consumer products” language in Clause 6.5.11.3 and all of Clause 6.9 on biological risk estimation, both of which conflict with existing FDA guidance and the FDA-recognized ISO 14971:2019.

Do I need to retest devices already cleared under the 2018 edition?

No. Existing clearances aren’t invalidated by a newer edition. You do need a documented rationale for your current approach at your next design change or periodic review.

Which parts of the ISO 10993 series apply to my device?

That depends on your device’s contact type (surface, external communicating, or implant) and contact duration (limited, prolonged, or permanent). ISO 10993-1 provides the matrix for selecting relevant parts of the series based on those two factors. We’ll be covering that contact-duration matrix in detail in an upcoming guide.

Is ISO 10993 the same as ISO 13485?

No. ISO 13485 governs your overall quality management system for medical devices. ISO 10993 is a series specifically about biological evaluation, and its outputs — your BEP and test reports — become part of the design and development records your ISO 13485 QMS requires you to maintain.

Where do I purchase ISO 10993 standards?

Individual parts and bundled packages are available through the ANSI Webstore, which also serves international buyers and offers documents in multiple languages. The ISO.org catalog describes each part but is not the recommended purchase channel.

📥 Free Resources

ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system.
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments.
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts.
ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements, including where biocompatibility documentation fits.
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification.

Not Sure What to Do Next?

🔹 Still researching how the 2025 edition affects your device category? Start with our breakdown of risk management under ISO 14971 — biocompatibility evaluation doesn’t stand apart from it anymore.

🔹 Ready to check where your documentation actually stands? Run the ISO 13485 Gap Assessment Checklist before your next audit or submission, not after.

🔹 Need to purchase the current standard? ISO 10993-1:2025 — ANSI Webstore, or get the full biological evaluation package bundled at roughly 45% off individual pricing if you’re assembling multiple parts of the series. Use code CC2026 for an additional 5% off through December 31, 2026.

The Standards Navigator will keep tracking how FDA recognition evolves on this standard as updates are published.

Documentation Gaps Don’t Show Up Until Someone’s Looking For Them

Teams that treat biocompatibility as a one-time lab exercise are the ones caught off guard when a standard’s edition changes underneath them. Teams that treat it as a living part of their design and risk management file catch the mismatch at their next internal review, not during an FDA question round — and it’s usually a citation that didn’t keep up, not the underlying science, that stalls a submission.

The Standards Navigator tracks these regulatory shifts as they happen — not months later when the transition deadline is already close. If ISO 10993-1:2025 affects your device, this is a good window to revisit your documentation rationale while the timeline is still in your control.

👉 Get updates on medical device compliance and biocompatibility standard changes
👉 Be first to access new gap assessment checklists and documentation tools for ISO 13485 and ISO 14971

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

ISO 15223 Symbols Overview: What Every Medical Device Label Actually Means (2026 Guide)

ISO 15223-1:2021 governs the pictograms on every medical device label. This guide breaks down the seven symbol categories, key reference symbols, and the 2026 EU REP amendment — including exact transition deadlines under MDR and IVDR.

A regulatory affairs guide to the pictograms your labels are required to carry — and the 2026 EU REP symbol change you need to track

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

This article is for general informational purposes and is not regulatory advice. Manufacturers should verify symbol requirements against the current version of ISO 15223-1 and applicable regulatory guidance.

ISO 15223-1:2021 is the internationally recognized standard that defines symbols used on medical device labels, packaging, and accompanying information to communicate critical safety and regulatory information without language-specific text.

The ISO 15223 Symbols That Trigger a Labeling Recall

A single wrong pictogram on a device label isn’t a cosmetic problem. It’s a labeling nonconformance that can hold up a shipment, trigger a Notified Body finding, or in the worst case, force a recall.

ISO 15223-1:2021 is the standard behind nearly every symbol on a medical device label — manufacturer, batch code, sterile, use-by date, and dozens more. It’s not optional guidance. It’s the harmonized reference regulatory affairs teams are expected to follow for CE marking label symbols, and it just changed in a way that affects almost every CE-marked device on the market.

From the floor: I’ve reviewed label proofs where a well-meaning graphics team swapped in an old sterilization icon because it “looked close enough” to what the previous product used. It wasn’t the same symbol, and it wasn’t accompanied by the batch reference the standard requires next to it. Having reviewed manufacturing and quality documentation across multiple industrial environments, I’ve repeatedly seen labeling errors originate not from misunderstanding the requirements, but from uncontrolled template reuse. That kind of small mismatch is exactly what a label review process is supposed to catch before it reaches a Notified Body’s desk — not after.

👉 Before your next label revision goes to print, confirm every symbol still matches current guidance. Most labeling nonconformances aren’t due to unfamiliarity with the standard — they’re due to reusing an old label file without checking what changed. Get the ISO 13485 Gap Assessment Checklist and confirm your revision management process is catching this before a reviewer does.

In This Guide

What ISO 15223-1:2021 actually covers and why it’s harmonized under MDR/IVDR
The seven symbol categories and what each one communicates
The 2026 EU REP symbol change — what changed, when, and what it means for your labels
Common labeling mistakes that surface in document reviews
FAQ

👉 Start Here

ISO 15223 — Symbols for Medical Devices Package — bundles Part 1 (General Requirements) and Part 2 (Symbol Development, Selection and Validation) directly from ANSI Webstore. Use code CC2026 for 5% off through December 31, 2026.
ISO 13485 Gap Assessment Checklist — confirm your label review process is set up to catch labeling nonconformances before a Notified Body does.

What Is ISO 15223-1:2021?

ISO 15223-1:2021, Medical devices — Symbols to be used with information to be supplied by the manufacturer — Part 1: General requirements, is now in its fourth edition. It defines the standardized pictograms manufacturers use on labels, packaging, and accompanying documentation so a device can be understood across languages and markets without translation.

It was harmonized under both EU MDR and EU IVDR in January 2022 — one of a relatively small number of standards to hold that status — which means using it correctly carries a presumption of conformity with the corresponding MDR/IVDR labeling requirements. A companion standard, ISO 15223-2, covers how new symbols get developed, selected, and validated when nothing in the existing library fits.

Because ISO 15223-1 is harmonized under MDR and IVDR, proper symbol usage can support a manufacturer’s demonstration of conformity with labeling requirements. In practice, auditors and Notified Bodies routinely review symbol usage as part of labeling assessments — this isn’t a peripheral checklist item, it’s one of the more commonly reviewed elements of a technical file.

Why Manufacturers Use Symbols

Medical devices are distributed across multiple countries and languages. Standardized symbols reduce the need for translated label text while helping manufacturers meet labeling requirements consistently across global markets. A single symbol library means the same pictogram carries the same meaning whether a device ships to Germany, Japan, or Brazil — without a separate translated label for each market.

ISO 15223-1 Medical Device Symbols Explained

ISO 15223-1 organizes its medical device label symbols into seven functional groups:

Manufacturing — manufacturer identity, date of manufacture, country of manufacture
Storage — temperature limits, humidity limits, keep dry, keep away from sunlight
Safe use — single use, do not use if damaged, consult instructions for use
Sterility — sterile, sterilization method, do not resterilize
IVD-specific — symbols unique to in vitro diagnostic devices
Transfusion/infusion — symbols for blood and infusion-related devices
Other — symbols that don’t fit cleanly into the categories above but are still standardized

Every symbol in the standard comes with a defined title, a description of what it communicates, and any accompanying information it must be paired with — a batch code symbol without an actual batch number next to it isn’t a valid use of the symbol.

Most Common ISO 15223-1 Medical Device Symbols

Infographic illustrating the most common ISO 15223 symbols for medical device labeling, including manufacturer, LOT, REF, serial number, sterile, use-by date, consult instructions for use, and keep dry. — The most frequently used ISO 15223-1 symbols help communicate critical manufacturing, traceability, sterility, and safety information on medical device labels worldwide.

The following symbols represent some of the most commonly encountered markings in medical device labeling. This is not a complete list, but these symbols appear on a significant percentage of devices entering regulated markets.

Symbol Title	Clause	What It Communicates
Manufacturer	5.1.1	Identifies the legal manufacturer; name and address must accompany it
Date of manufacture	5.1.3	The date the device was produced
Use-by date	5.1.4	The date after which the device should not be used
Batch code (LOT)	5.1.5	Identifies the manufacturing batch or lot
Catalogue number (REF)	5.1.6	The manufacturer’s catalogue/model number
Serial number (SN)	5.1.7	Identifies a specific individual device
Importer	5.1.8	Identifies the entity importing the device into a given market
Sterile	5.2.1	Device has been through a sterilization process
Do not resterilize	—	Device is not to be resterilized after use
Do not use if package damaged	—	Consult instructions for use if packaging integrity is compromised
Single use	—	Device is intended for one use only

This is a reference sample, not the full symbol library — the standard runs well beyond these. For the complete set of ISO 15223 symbol meanings, always validate current symbol usage against the live ISO document rather than a saved reference sheet, since amendments do get issued.

The 2026 EU REP Symbol Change

The most consequential update to this standard in years just took effect. Amendment EN ISO 15223-1:2021/A1:2025 replaces the long-standing “EC REP” symbol for a medical device’s authorized representative in the EU with a new “EU REP” symbol, and introduces a generic “XX REP” framework where “XX” is swapped for the applicable country or jurisdiction code.

The change was requested by the European Commission in May 2024, specifically to eliminate confusion between “EC” as a regulatory abbreviation and “EC” as the ISO 3166-1 country code for Ecuador. ISO adopted the amendment in March 2025, and it was formally harmonized into the Official Journal of the European Union on June 17, 2026, through Commission Implementing Decision (EU) 2026/1231 (amending MDR-side Decision 2021/1182) and Commission Implementing Decision (EU) 2026/1313 (amending IVDR-side Decision 2021/1195).

The European Commission has been explicit that this is a purely editorial change — it does not alter the authorized representative symbol’s role, responsibilities, or the device’s safety or performance profile in any way. This amendment is now one of the more consequential updates among the current round of MDR harmonized standards, given how widely the symbol appears across the CE-marked device population.

Timeline infographic illustrating the transition from the EC REP symbol to the EU REP symbol under ISO 15223-1:2021 Amendment A1:2025, including key regulatory milestones through 2031. — The transition from EC REP to EU REP includes a five-year coexistence period, allowing manufacturers to update labeling during normal revision cycles before the 2031 deadline.

👉 Planning an upcoming label revision? Download the ISO 13485 Gap Assessment Checklist to verify your revision management process is capturing changes to standards before they become audit findings.

Do You Need to Update Your Labels Right Now?

The most common objection: “Do we need to reprint every label immediately?”

No. The Commission built in a five-year coexistence period. Manufacturers may continue using the legacy “EC REP” symbol under the original EN ISO 15223-1:2021, or transition to the new “EU REP” symbol under the amendment — both are valid during this window. The old standard’s reference isn’t withdrawn until June 15, 2031 under MDR and June 17, 2031 under IVDR. After those dates, only “EU REP” confers presumption of conformity.

In practice, this means:

If you are about to run a new label print or design revision anyway → use the new EU REP symbol now rather than reprinting again later.
If your current labels are compliant and not due for revision → there is no requirement to act immediately; plan the change into your next scheduled label update.
If you have a Notified Body conformity review coming up → confirm with them directly whether they expect the new symbol in your current submission, since individual Notified Body expectations can vary during a transition window.

Common ISO 15223 Labeling Nonconformances

Most common finding: inconsistent symbol usage across packaging levels — the outer carton uses one version of the authorized representative symbol while the inner unit label uses another, with no documented rationale for the difference.

Other recurring issues: sterilization method symbols that don’t match the actual method used (ethylene oxide vs. irradiation vs. steam each has a distinct symbol); batch code or serial number symbols placed on a label without the actual batch or serial data adjacent to them; and reused label templates that carry forward a superseded symbol simply because nobody flagged the amendment during change control review.

⚠️ None of these mistakes require a new symbol library to fix — they require a label governance process that actually checks current symbol validity before a label goes to print, not just before the first label was ever approved.

Quick Reference Checklist

Professional infographic showing a medical device label review checklist based on ISO 15223-1, including symbol verification, sterilization validation, traceability, packaging consistency, and revision control. — A structured label review process helps manufacturers verify ISO 15223-1 symbol compliance before medical devices move into production or distribution.

✅ Current label set reviewed against the live ISO 15223-1:2021 symbol library ✅ Sterilization method symbol matches the actual method used
✅ Batch code, catalogue number, and serial number symbols paired with real data
✅ EU REP transition plan documented, even if no immediate label change is required
✅ Packaging levels (outer carton, inner unit, IFU) checked for symbol consistency
✅ Change control process flags standard amendments, not just initial approvals

FAQ

What is ISO 15223-1:2021?

It’s the international standard defining the pictograms used on medical device labels, packaging, and accompanying information — covering everything from manufacturer identity to sterilization method. It’s currently in its fourth edition and harmonized under both EU MDR and IVDR.

Do I have to switch to the EU REP symbol immediately?

No. The European Commission built in a five-year coexistence period. The legacy EC REP symbol remains valid until the original standard’s reference is withdrawn — June 15, 2031 under MDR and June 17, 2031 under IVDR.

Is the EU REP change a safety-related update?

No. The Commission has described it as a purely editorial change, made to eliminate confusion with Ecuador’s ISO 3166-1 country code. It does not change the authorized representative’s role or responsibilities.

What’s the difference between ISO 15223-1 and ISO 15223-2?

Part 1 defines the actual symbol library and how symbols must be used. Part 2 covers the process for developing, selecting, and validating a new symbol when nothing in the existing library fits a specific need.

Does every medical device need every symbol in the standard?

No. Which symbols apply depends on the device — a non-sterile reusable device won’t carry sterilization symbols, for example. The standard defines what each symbol means and how to use it correctly; it doesn’t mandate that every device carry every symbol.

What’s the most common labeling mistake regulatory teams miss?

Inconsistent symbol usage across packaging levels — using an updated symbol on one layer of packaging while an older version persists on another, usually because a label template wasn’t fully reviewed during a revision.

Where can I find the actual symbol library?

ISO 15223-1:2021 and its companion ISO 15223-2 are both available for purchase through ANSI Webstore, either individually or as a combined package.

Should my Notified Body confirm which symbol version they expect?

During the transition period, manufacturers should confirm expectations directly with their Notified Body, particularly if a labeling review or conformity assessment is already underway.

📥 Free Resources

ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements, including the revision management processes that keep labeling current.
ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system from the ground up.
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements across production environments.

Not Sure What to Do Next?

🔹 Still researching how labeling symbols fit into your broader QMS? Start with ISO 13485 Documentation Requirements and Common Mistakes in ISO 13485 QMS to see where document control connects to labeling accuracy.

🔹 Ready to review your current label set? Check it against Sterilization Standards Overview and UDI Requirements Explained — both cover label-adjacent requirements that pair directly with ISO 15223-1 symbols.

🔹 Need to purchase the standard itself? Get the ISO 15223 Symbols Package from ANSI Webstore — available individually or bundled with Part 2, with code CC2026 for 5% off through December 31, 2026.

Symbols look like a small detail until one of them is wrong on a printed label already in circulation. The Standards Navigator will keep tracking the EU REP transition and any further ISO 15223 amendments as they’re published.

Don’t Let a Symbol Be the Reason for a Finding

Labeling nonconformances are some of the most avoidable findings in a Notified Body review — the standard is published, the symbols are defined, and the fix is almost always a revision management gap rather than a technical one.

The Standards Navigator tracks ISO 15223 amendments, MDR/IVDR labeling requirements, and medical device documentation standards so your labels don’t fall out of step with a standard that changed while nobody was watching.

👉 Get updates on ISO 15223, MDR/IVDR labeling changes, and medical device documentation requirements as they happen
👉 Be first to access new gap assessment tools built for medical device regulatory affairs teams

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

ISO 9001:2026 Is Coming — What Manufacturers Should Do Right Now

The ISO 9001:2026 FDIS ballot closes July 9, 2026, moving the revision closer to its expected September 2026 publication. This guide covers the confirmed timeline, the four biggest changes coming, and what certified and uncertified manufacturers should do right now — without touching a currently valid QMS.

What the FDIS Ballot Closing Means for Your Certification Timeline

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Ballot Just Closed. Here’s What That Actually Means for You.

On July 9, 2026, the Final Draft International Standard (FDIS) ballot for ISO 9001:2026 closed. That’s a real milestone — the technical content of the revision is now locked. No more comments, no more redlines. What’s left is a yes/no vote from ISO member bodies and, assuming approval, formal publication expected in September 2026.

Here’s what that milestone does not mean: it does not mean ISO 9001:2015 stopped being certifiable today. It does not mean your registrar is going to show up next quarter demanding a new QMS. And it does not mean you need to panic-rewrite your quality manual this week.

What it does mean is that the window to prepare — calmly, on your own schedule, instead of during a scramble — just opened wider. Manufacturers who start reviewing the coming changes now will walk into their transition audit in 2027 or 2028 with a head start. Manufacturers who wait for the “official” publication date to even look at what’s changing will be doing gap analysis under a deadline instead of on their own terms.

From the Floor: I helped a mid-size weld supply company navigate through the ISO 9001:2015 transition and saw firsthand what happens when a revision catches a QMS flat-footed. The technical changes weren’t the hard part. The hard part was cramming eighteen months of documentation review into six because nobody started early. That’s the mistake I’m not interested in watching manufacturers repeat with this revision.

If you are already ISO 9001:2015 certified and want a head start before your next surveillance cycle, run your current QMS against a structured gap check now — before the standard is even published →

👉 Get the ISO 9001 Roadmap — a step-by-step implementation and readiness guide built for manufacturers, updated for what’s coming in the 2026 revision.

In This Guide

What actually happened on July 9, 2026, and what stage the revision is at now
The confirmed publication and transition timeline
The four biggest changes coming in ISO 9001:2026
What to do right now if you’re already certified
What to do right now if you’re not yet certified
The most common mistake manufacturers make with standard revisions
Whether you need to take any action today (short answer: no — but read this anyway)

👉 Start Here (Top Resources)

Building or refining your QMS ahead of the transition? 9001Simplified’s ISO 9001 documentation kits give you a pre-built structure so your 2015-based system is already organized enough to absorb the 2026 changes without a rebuild.
Need the current standard to review against? Buy ISO 9001:2015 through ANSI Webstore — use code CC2026 for 5% off at checkout.
Want a structured read on what’s ahead? See our ISO 14001 / ISO 9001 / ISO 45001 2026 Transition Guide for the full harmonized-structure picture across all three standards.

What Happened on July 9, 2026

The FDIS is the last drafting stage before formal publication. Unlike the earlier Draft International Standard (DIS) stage — where technical content was still open to comment — the FDIS ballot is strictly a yes/no vote on the finished text. ISO member bodies can flag editorial issues, but the substance of the standard is done.

The ballot closing on July 9, 2026 marks the completion of the final approval stage before publication. Barring an unexpected outcome during ballot resolution, ISO 9001:2026 remains on track for publication in September 2026. Barring an unusual rejection at this stage — which is rare for management system standards this far along — ISO 9001:2026 is expected to publish in September 2026. ISO/TC 176/SC 2 — the ISO technical subcommittee responsible for ISO 9001 — is the authoritative source tracking the revision’s progress, and their committee updates confirm this timeline directly.

Most common finding: Organizations that assume “not published yet” means “nothing to do yet” consistently underestimate how much internal review time a revision actually takes — even a modest one.

The Confirmed Timeline

Infographic showing the ISO 9001:2026 revision timeline from the 2025 Draft International Standard through the July 2026 FDIS ballot, expected September 2026 publication, and anticipated three-year transition period. — A visual timeline of the ISO 9001:2026 revision process, highlighting key milestones from the Draft International Standard to the expected transition period for certified organizations.

Stage	Date	Status
Draft International Standard (DIS) published	August 27, 2025	Complete
DIS comment period closed, technical consensus reached	Early 2026	Complete
Final Draft International Standard (FDIS) ballot	Closed July 9, 2026	Complete
Formal publication of ISO 9001:2026	Expected September 2026	Pending
Transition period for ISO 9001:2015 certificate holders	~3 years from publication	Expected to run to approximately September 2029

⚠️ ISO 9001:2015 remains the only certifiable version of the standard right now. Nothing changes for audits, certifications, or QMS requirements until ISO 9001:2026 is formally published and your certification body confirms transition procedures. Don’t change your documented QMS based on the draft — change it once the transition guidance is confirmed.

What’s Actually Changing in ISO 9001:2026

Infographic highlighting the four biggest confirmed changes expected in ISO 9001:2026, including leadership and quality culture, risk and opportunity management, quality policy, and climate context. — This infographic summarizes the four key themes expected in the ISO 9001:2026 revision, helping manufacturers understand where to focus their transition planning.

The core clause structure — Plan-Do-Check-Act, the ten-clause Harmonized Structure, risk-based thinking — is not being rebuilt. This is an evolutionary revision, not a rewrite. The confirmed areas of change center on four themes:

Area	What’s Changing	Why It Matters on the Shop Floor
Leadership & quality culture	Top management must explicitly demonstrate and promote quality culture and ethical behavior, not just policy commitment	Auditors will start asking how culture shows up in behavior, not just in the quality manual
Risk and opportunity management	Clause 6.1 is being split into clearer sub-sections distinguishing risk treatment from opportunity pursuit	Your risk register may need a structural update, not just new content
Quality policy	Clause 5.2 requirements are tightened to explicitly connect policy to organizational context	Generic, boilerplate quality policies will be more exposed in audits
Climate context	Formal integration of climate-related considerations into Clause 4.1 context-of-the-organization requirements	Facilities with environmental exposure (fabrication, coatings, energy) should expect this to come up in context reviews

These four themes are drawn from the confirmed DIS/FDIS commentary tracked by ISO/TC 176/SC 2 and reflected in certification-body FDIS briefings; final wording won’t be public until formal publication, but the substance is locked at this stage.

Here’s what each one could actually look like on the floor:

Quality culture and leadership. This isn’t a new policy statement — it’s evidence. Think visible leadership participation in corrective-action reviews, quality KPIs discussed in leadership meetings (not just buried in a QMS report), and recognition tied to quality performance rather than just output. Auditors will likely start asking to see this, not just read about it.

Risk and opportunity management. If your risk register currently lumps “things that could go wrong” and “things we could improve” into one column, this is the change to watch. Splitting them means your CAPA-driven risk items and your strategic-opportunity items may need separate tracking and separate review cadence.

Quality policy. A generic policy statement — “we are committed to quality” — won’t hold up as well once policy has to explicitly tie to organizational context. A fabrication shop’s policy should read differently than a Tier 1 automotive supplier’s, and the revision is designed to expose the ones that don’t.

Climate context. For a coatings operation, a railcar service facility, or an energy-sector manufacturer, this likely means documenting how weather exposure, emissions requirements, or environmental permitting already shape your operations — not adding new environmental management requirements on top of ISO 9001.

None of these require you to touch your certified QMS today. They do tell you where your internal audit program should start paying closer attention over the next 12–18 months.

If You’re Already Certified to ISO 9001:2015

If you are already ISO 9001:2015 certified → your certificate remains fully valid. Nothing about your current status changes today. Your job right now is preparation, not action.

If you are heading into a surveillance audit in the next 6–12 months → this is the ideal window to start a light-touch internal review of how your quality policy, leadership commitment statements, and risk register would hold up against the themes above. You’re not rewriting anything — you’re identifying gaps early.

If you are under customer or contract pressure to show revision-readiness → get ahead of the conversation now. A documented internal gap review, even an informal one, is something you can point to if a customer or auditor asks what you’re doing about the upcoming revision.

Run a structured check against the coming changes before your next surveillance audit, not after your registrar flags something →

👉 Download the Manufacturing Compliance Checklist — a practical reference covering ISO, OSHA, and quality requirements manufacturers can use to spot gaps before they become findings.

Decision flow infographic helping manufacturers determine whether to prepare for the ISO 9001:2026 transition based on their current ISO 9001 certification status. — This decision guide shows the recommended next steps for both certified and non-certified organizations preparing for the upcoming ISO 9001:2026 revision.

If You’re Not Yet Certified

If you are not yet certified and are evaluating whether to start now or wait → start now. ISO 9001:2015 is still the only certifiable version, the transition window will run for roughly three years past publication, and the 2026 changes are evolutionary rather than structural. Building your QMS to 2015 requirements today puts you in a strong position to absorb the 2026 updates with minor adjustments rather than a second implementation project.

If you are choosing between a consultant and a documentation kit for your first build → this decision matters more with a revision on the horizon, because you want a foundation flexible enough to update rather than replace. See our ISO Implementation Packages vs. Consultants comparison for a full breakdown.

Most first-time QMS builds don’t fail because the standard is misunderstood — they fail because the documentation was never structured to be updated. Build it right the first time →

👉 Explore 9001Simplified’s documentation kits — built on the current 2015 structure and easier to adapt when the transition guidance is confirmed.

The Mistake Most Manufacturers Make With Standard Revisions

Every ISO 9001 revision cycle produces the same pattern: organizations wait for the “final” publication before doing anything, then compress 18 months of review into six once the transition clock starts. It happened with the 2015 revision. It’s likely to happen again here, even though this revision is smaller in scope.

The objection I hear most is some version of: “Why would I prepare for a standard that isn’t even published yet?” Fair question. The answer is that none of the confirmed changes require you to touch your certified system today — but reviewing your quality policy, leadership commitment language, and risk register against where the standard is heading costs you almost nothing now and saves real time later. You’re not implementing anything. You’re reading ahead.

Gap-Assessment Snapshot

Use this as a quick self-rating before your next management review. Score each area honestly — this isn’t a formal audit, just a starting point for where to focus first.

Area	Current Readiness (High / Med / Low)	Action Needed
Leadership & quality culture	—	Review how leadership commitment is demonstrated, not just documented
Quality policy	—	Align policy language explicitly to organizational context
Risk management	—	Separate risk-treatment items from opportunity items in your register
Climate context	—	Update context-of-the-organization analysis to reflect environmental exposure

Quick Readiness Checklist

✅ Confirm your certification body’s current guidance — some registrars will issue transition bulletins ahead of formal IAF confirmation
✅ Review your quality policy for generic language that doesn’t tie to organizational context
✅ Check whether your risk register separates risk treatment from opportunity pursuit
✅ Note where leadership commitment is documented — policy statement only, or observable practice too
✅ If your facility has environmental exposure, flag climate-related context for your next management review
✅ Do not revise your documented QMS based on the draft — wait for confirmed transition guidance

FAQ

Is ISO 9001:2026 published yet?

No. As of July 9, 2026, the FDIS ballot has closed but the standard has not been formally published. Publication is expected in September 2026.

Can I still get certified to ISO 9001:2015 right now?

Yes. ISO 9001:2015 is the only certifiable version of the standard until ISO 9001:2026 is published and certification bodies confirm transition procedures.

How long will the transition period be?

Based on the approach used for recent ISO management system revisions, a three-year transition period is expected, running to approximately September 2029 — though this will be confirmed once the standard is formally published.

Do I need to change my QMS documentation today?

No. Nothing in your certified quality management system needs to change based on the draft. Wait for confirmed transition guidance from your certification body.

What are the biggest changes coming in ISO 9001:2026?

Expanded leadership requirements around quality culture and ethical behavior, a clearer split between risk treatment and opportunity management in Clause 6.1, tightened quality policy requirements in Clause 5.2, and formal integration of climate-related context into Clause 4.1.

Is this a major rewrite of ISO 9001?

No. The core Plan-Do-Check-Act structure, the ten-clause Harmonized Structure, and risk-based thinking all remain intact. This is an evolutionary revision, not a restructuring.

Should I wait to start my first ISO 9001 certification until the 2026 version is out?

No. Building to ISO 9001:2015 now, with the three-year transition window ahead, puts you in a stronger position than waiting — and the 2026 changes are incremental rather than structural.

Where can I track official updates on the revision?

ISO’s own committee pages and your certification body’s published bulletins are the most reliable sources. Avoid making QMS changes based on secondhand summaries of the draft.

📥 Free Resources

ISO 9001 Roadmap — a step-by-step implementation guide for manufacturers building or improving a quality management system ahead of the 2026 transition.
Manufacturing Compliance Checklist — a practical compliance reference covering key ISO, OSHA, and quality requirements for production environments.
Supplier Quality Checklist — an evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts.

Not Sure What to Do Next?

🔹 Still researching what’s changing? Read our full ISO 14001 / ISO 9001 / ISO 45001 2026 Transition Guide for the harmonized-structure view across all three standards.

🔹 Ready to start a gap review of your current QMS? Grab the ISO 9001 Roadmap and work through it against your existing documentation.

🔹 Need to buy the current standard to review against? Purchase ISO 9001:2015 through ANSI Webstore — code CC2026 for 5% off.

🔹 Building or rebuilding your QMS documentation from scratch? 9001Simplified’s documentation kits give you a 2015-based structure built to adapt when transition guidance is confirmed.

The FDIS ballot closing is a procedural milestone, not a deadline. But it’s the clearest signal yet that ISO 9001:2026 is close, and the manufacturers who read ahead now will be the ones who aren’t scrambling in 2027. The companies that transition smoothly won’t necessarily be the ones with the best quality systems — they’ll be the ones that started preparing before the deadline forced them to. At The Standards Navigator, we’ll keep tracking this revision clause by clause as confirmed details land.

Stay Ahead of the ISO 9001:2026 Transition

Most manufacturers don’t lose ground on a standard revision because the changes are hard — they lose ground because they wait for the official publication date to even start looking. By then, the transition clock is already running and everyone else’s registrar is booked solid too.

Organizations that start reviewing their quality policy, leadership documentation, and risk register now will walk into their first 2026-based audit prepared. Organizations that wait will be doing the same work under pressure, competing for the same registrar time slots as everyone else.

The Standards Navigator tracks every confirmed development in the ISO 9001:2026 revision as it happens — no speculation, no secondhand summaries.

👉 Get updates on the ISO 9001:2026 transition as confirmed details are published
👉 Be first to access new gap-assessment tools built specifically for the 2026 changes

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

Validation & Verification Requirements: What ISO 13485 and the New FDA QMSR Actually Demand (2026 Guide)

ISO 13485 Clause 7.3 requires distinct verification and validation evidence — and the FDA’s new QMSR, effective February 2, 2026, makes the distinction matter more than ever. This guide breaks down design verification, design validation, process validation, and software validation requirements, and shows manufacturers how to build a traceability matrix that survives an audit or inspection.

ISO 13485 verification and validation requirements explained for medical device manufacturers navigating the QMSR transition

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Documentation Gap That Fails Design History Files

A design verification report that confirms the device meets its own specifications is not the same thing as a validation report that confirms the device meets the user’s actual needs. Auditors know the difference. Regulatory affairs teams sometimes don’t find out until an FDA inspector or notified body assessor pulls the Design History File and asks for both — and only one exists.

That gap has gotten more consequential, not less. The FDA’s Quality Management System Regulation took effect February 2, 2026, formally incorporating ISO 13485:2016 into 21 CFR Part 820 by reference. Verification and validation records that used to satisfy QSR expectations are now being evaluated against ISO 13485 Clause 7.3 directly — and the two frameworks don’t document V&V identically.

From the Floor: As a certified ISO 9001 Internal Auditor, I’ve sat across the table from teams who could produce a stack of test reports but couldn’t answer a simple question: which of these prove the design meets the specification, and which prove it meets the user’s need? Verification and validation get treated as interchangeable paperwork until an auditor separates them — and by then it’s a finding, not a conversation. The QMS documentation discipline that catches this before an audit is the same discipline that catches it before a submission.

If your last internal audit didn’t clearly separate verification evidence from validation evidence, that’s the gap worth closing first.

Run a clause-by-clause gap check before your next surveillance audit or FDA inspection — the ISO 13485 Gap Assessment Checklist below is built for exactly this kind of documentation review. Most teams miss the verification/validation split until it’s flagged.

👉 ISO 13485 Gap Assessment Checklist

In This Guide

What verification and validation mean under ISO 13485 Clause 7.3, and why they are not interchangeable
How process validation (Clause 7.5.6) differs from design validation
Software validation requirements for devices and manufacturing/QMS software
What changed under the FDA QMSR effective February 2, 2026
The most common V&V documentation failures found in audits and inspections
How to structure a verification and validation plan that survives scrutiny

👉 Start Here (Top Resources)

If you’re building or auditing a verification and validation process, these are the two resources worth starting with:

Get ISO 13485 training from BSI Group — BSI’s ISO 13485 training programs walk quality and regulatory teams through Clause 7.3 requirements in detail, including how design controls map to verification and validation evidence.
Purchase the official ISO 13485:2016 standard from ANSI Webstore — the authoritative source for Clause 7.3 language. ANSI Webstore serves international buyers and offers the standard in multiple formats. Use code CC2026 for 5% off.

Verification vs. Validation: The Core Distinction

Comparison infographic explaining the differences between ISO 13485 verification and validation requirements under ISO 13485:2016, including design inputs, intended use, testing methods, timing, applicable clauses, and common audit findings. — This comparison illustrates how verification and validation serve different purposes under ISO 13485 and why both are required for compliant medical device design controls.

Verification confirms that design outputs meet design inputs. Validation confirms that the finished device meets user needs and intended use. That one-sentence distinction is where most documentation failures start, because the two activities can look procedurally similar — testing, measuring, comparing results against criteria — while answering completely different questions.

Element	Design Verification	Design Validation
Question answered	Did we build the design correctly?	Did we build the correct design?
Compared against	Design inputs / specifications	User needs / intended use
Typical methods	Bench testing, inspection, analysis, comparison to similar designs	Clinical evaluation, simulated use testing, human factors studies
Timing	Throughout design and development	Under defined operating conditions, on initial production units or equivalent
ISO 13485 clause	7.3.6	7.3.7
Common failure	Testing against internal spec only, no traceability to input	Validating on prototypes instead of production-equivalent units

Most common finding: auditors and FDA investigators repeatedly cite validation performed on non-representative units — bench prototypes, early builds, or units built on equipment that doesn’t match production. ISO 13485 Clause 7.3.7 specifically requires validation on production or production-equivalent units, under defined operating conditions.

Verification and Validation in Practice: An Infusion Pump Example

Take a manufacturer developing an infusion pump. Design verification confirms the device meets its own engineering specifications:

✅ Flow rate accuracy within the specified tolerance
✅ Battery life meets the stated runtime under load
✅ Alarm volume meets the decibel specification

Design validation confirms something different — that the device works safely in the hands of the people who will actually use it:

✅ Nurses can operate the pump correctly and safely during simulated or actual clinical use
✅ The alarm is audible and distinguishable in a realistic hospital environment, not a quiet test lab
✅ Labeling and instructions for use are understood by the intended users without additional training

A pump can pass every verification test and still fail validation — accurate flow rate and long battery life mean nothing if a nurse under time pressure misreads the alarm or misinterprets the instructions. That’s the gap Clause 7.3.7 is built to catch, and it’s why validation has to happen on production-equivalent units under conditions that resemble actual use.

Design Verification Requirements

Clause 7.3.6 requires that design verification confirms outputs meet input requirements, with results and conclusions recorded, including the methods, dates, and individuals performing the verification. In practice, that means every design input needs a traceable verification activity — not a general statement that “the device was tested.”

If you are building a Design History File from scratch → start with a traceability matrix that maps every design input to its verification method and result before writing a single test protocol. Retrofitting traceability after testing is where most rework happens.

If you are already ISO 9001 certified and adding ISO 13485 → your existing design control process likely covers verification structurally, but it almost certainly lacks the input-to-output traceability rigor ISO 13485 auditors expect. That’s the gap to close first, not the documentation format.

👉 Before You Build Another Test Protocol

Most verification failures aren’t testing failures — they’re traceability failures. Run your design inputs against your current verification records now and find the gaps before an assessor does. →

Design Validation Requirements

Design validation under Clause 7.3.7 must be performed on production or production-equivalent units, under defined operating conditions, and must include risk analysis where applicable — which is where ISO 14971 risk management intersects directly with design controls. Validation isn’t complete until it addresses actual clinical or user-environment conditions, not lab conditions that approximate them.

Objection: “Our device is low-risk — do we really need formal simulated-use validation?” Even Class I and low-risk Class II devices need validation evidence proportional to risk, and “proportional” still means documented, traceable, and tied to intended use. A shorter validation plan is defensible. No validation plan is not.

Clinical evaluation, when required, and human factors/usability testing both fall under validation, not verification — a distinction that matters for regulatory submissions referencing FDA guidance on human factors engineering.

Process Validation Under Clause 7.5.6

Infographic explaining the three phases of process validation under ISO 13485, including Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ), with key activities, outputs, and compliance requirements. — This infographic explains the roles of IQ, OQ, and PQ in process validation, helping manufacturers understand how each qualification stage supports ISO 13485 and FDA QMSR compliance.

Separate from design validation, ISO 13485 Clause 7.5.6 requires validation of processes where the resulting output cannot be verified by subsequent monitoring or measurement — sterilization, certain sealing and bonding processes, injection molding parameters, and software used in production are the classic examples.

Process validation requires:

✅ Defined criteria for review and approval of the process
✅ Approval of equipment and qualification of personnel
✅ Use of specific methods, procedures, and acceptance criteria
✅ Requirements for records (Clause 4.2.5)
✅ Revalidation criteria, including criteria for triggering revalidation

Most auditors and FDA investigators expect this evidence structured around three stages: Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ).

Installation Qualification (IQ) confirms that equipment and supporting systems are installed correctly, according to the manufacturer’s specifications and the site’s own installation requirements — including verified utilities, calibration status, and documentation of the as-installed configuration, not just a checklist that the equipment arrived and was plugged in.

Operational Qualification (OQ) confirms that the equipment operates as intended across its full specified operating range, not just at a single nominal setting. For a sterilization process, that means testing at the upper and lower bounds of temperature, time, and pressure defined in the process specification — not only the target parameters.

Performance Qualification (PQ) confirms that the process consistently produces conforming output under actual production conditions, typically across multiple runs and, where risk warrants it, multiple operators, shifts, or lots. PQ is where most revalidation triggers get defined, since it establishes the baseline the process must continue to meet.

If you are validating a sterilization or bonding process for the first time → build your IQ/OQ/PQ protocol before ordering test units. Retrofitting an IQ after OQ testing has already started is a common finding, and it undermines the traceability an assessor is looking for.

If your process hasn’t changed but your equipment or facility has → IQ typically needs to be repeated even when OQ and PQ parameters stay the same, since IQ is tied to the specific installation, not the process design.

Skipping straight to PQ — running production and calling the passing output “validation” — is one of the most common shortcuts auditors flag, because it skips the evidence that the equipment itself is capable of consistently meeting the operating range the process depends on.

If you are outsourcing sterilization or bonding processes → your supplier controls documentation needs to show that you’ve verified the supplier’s process validation, not just received a certificate of conformance.

Software Validation Requirements

Software validation shows up in two places under ISO 13485, and conflating them is a recurring audit finding: software that is part of the device (or used in its production) versus software used for quality management purposes, such as electronic QMS platforms or CAPA tracking tools. Both require validation appropriate to their use, application, and risk — but the depth and method differ substantially, and design-control software validation should be traceable back to the same input/output structure as hardware verification.

What the FDA QMSR Changed for U.S. Manufacturers

The FDA’s Quality Management System Regulation replaced the legacy Quality System Regulation under 21 CFR Part 820, effective February 2, 2026, incorporating ISO 13485:2016 by reference rather than maintaining a separately worded U.S. regulation. For manufacturers who were already ISO 13485 certified, the operational impact on verification and validation practices is smaller than the documentation-mapping impact: DHF, DMR, and DHR content doesn’t necessarily need renaming, but it does need a clear mapping showing where ISO 13485 Clause 7.3 requirements are satisfied within existing U.S. records.

If you were operating under legacy QSR language only → this is the trigger to formally adopt ISO 13485 Clause 7.3 verification/validation terminology and structure, since FDA inspectors are now trained against the ISO clause structure, not the old Part 820 subparts.

Common V&V Documentation Failures

The same handful of gaps show up repeatedly in ISO 13485 QMS audits:

No traceability matrix linking design inputs to verification methods and results
Validation performed on prototypes rather than production-equivalent units
Missing revalidation criteria for processes that later change equipment, materials, or parameters
Software validation treated as one-size-fits-all instead of scaled to risk and application
Verification and validation dates, methods, and personnel not fully recorded, leaving conclusions without traceable support

👉 Before Your Next Notified Body Assessment

If you’re not confident your traceability matrix would hold up under document review, that’s the exact gap the ISO 13485 Gap Assessment Checklist was built to catch — in under 45 minutes. →

Building a Verification & Validation Plan That Holds Up

A defensible V&V plan starts with the traceability matrix, not the test protocols. Build it in this order:

List every design input and requirement
Map each input to a specific verification method and acceptance criterion
Identify which requirements also require validation evidence, and under what conditions
Define production-equivalent unit criteria before validation begins
Build revalidation triggers into the plan up front — not as an afterthought after a process change

This structure is what turns a stack of individual test reports into a Design History File that answers an assessor’s questions instead of prompting more of them.

Workflow infographic illustrating how verification and validation fit into the ISO 13485 design control process, from user needs and design inputs through production-equivalent units, validation, and Design History File documentation. — This workflow shows how verification and validation integrate into ISO 13485 design controls to produce a complete, traceable Design History File for regulatory compliance.

Quick Audit Checklist

✅ Every design input has a documented verification method and result
✅ Validation was performed on production or production-equivalent units
✅ Risk analysis is referenced in the validation rationale
✅ Process validation records include revalidation criteria
✅ Software validation is scaled to intended use and risk
✅ Verification and validation records include dates, methods, and personnel
⚠️ Watch for validation evidence copied from an earlier device without device-specific justification

FAQ

What is the difference between verification and validation in ISO 13485?

Verification confirms design outputs meet design inputs — did we build it correctly. Validation confirms the finished device meets user needs and intended use — did we build the correct thing. They require separate evidence and cannot substitute for each other.

Does ISO 13485 require validation on production units?

Yes. Clause 7.3.7 requires design validation on production or production-equivalent units under defined operating conditions, not on early prototypes or bench models that don’t reflect final manufacturing.

What processes require process validation under Clause 7.5.6?

Any process where output cannot be fully verified by later inspection or testing — common examples include sterilization, certain welding and bonding processes, injection molding, and adhesive curing.

How did the FDA QMSR affect verification and validation requirements?

The QMSR, effective February 2, 2026, incorporates ISO 13485:2016 into 21 CFR Part 820 by reference. Manufacturers now need documentation that maps clearly to ISO 13485 Clause 7.3, even if internal DHF/DMR/DHR naming stays the same.

Do low-risk devices still need design validation?

Yes, though the depth can scale with risk. A shorter, risk-justified validation plan is acceptable; skipping validation entirely is not.

Does software need separate validation from the device it’s part of?

Software validation is required both for software that’s part of or used in producing the device, and for software used for quality management purposes — but the required depth and method differ by application and risk.

What’s the most common finding auditors cite for validation?

Validation conducted on non-representative units — prototypes or early builds that don’t match production configuration or manufacturing conditions.

Where does risk management fit into verification and validation?

ISO 14971 risk management activities feed directly into what needs validation and how rigorously, particularly for design validation rationale and process revalidation triggers.

📥 Free Resources

ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements, including design control and V&V documentation gaps
ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification

Not Sure What to Do Next?

🔹 Still researching your V&V documentation gaps? Start with the ISO 13485 Gap Assessment Checklist — it maps directly to Clause 7.3 verification and validation requirements.

🔹 Ready to build a compliant V&V process? BSI Group’s ISO 13485 training covers Clause 7.3 requirements in the depth a design control rebuild needs.

🔹 Need the standard itself to build your traceability matrix against? Get ISO 13485:2016 from ANSI Webstore — code CC2026 takes 5% off, and international formats are available.

Verification proves your engineers met the specification. Validation proves your customers can safely use the product. Auditors expect both. Regulators require both. A complete Design History File demonstrates both through traceable evidence — not one comprehensive-sounding report that tries to do both jobs at once.

Stay Ahead of the Next V&V Finding

Design History File gaps rarely surface during routine work — they surface during an audit or inspection, when there’s no time left to fix them. Manufacturers who catch the verification/validation split early walk into assessments with a traceability matrix that answers questions before they’re asked. Manufacturers who don’t spend the assessment explaining why validation was performed on a prototype.

The Standards Navigator tracks ISO 13485, QMSR, and medical device compliance requirements as they develop — including changes that affect how verification and validation get documented.

👉 Get updates on ISO 13485 and QMSR compliance changes
👉 Be first to access new medical device gap assessment tools and checklists

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

ISO Implementation Packages vs. Consultants: Which Is Right for Your Manufacturing Business in 2026?

Manufacturers choosing between an ISO 9001 consultant and a documentation package face a real cost and timeline tradeoff. This guide compares both paths side by side — cost ranges, typical timelines, and which businesses fit each option — plus a hybrid approach for mid-sized operations, and the most common mistake that causes either path to fail an audit.

How small and mid-sized manufacturers can build a certifiable QMS without overpaying for help they don’t need

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

Picking the Wrong Path Costs You Months — Not Just Money

ISO implementation packages vs consultants? Most manufacturers don’t fail their ISO 9001 implementation because they picked a bad option. They fail because they picked the wrong option for their operation — a $30,000 consultant engagement for a 12-person shop, or a self-serve documentation kit for a 400-employee multi-site operation that actually needed hands-on guidance.

Either mistake burns budget and burns time. And in a manufacturing environment, time is the one thing you can’t buy back before a customer-mandated certification deadline.

There are really only two paths to a certifiable quality management system (QMS): hire a consultant, or use a structured implementation package. Both work. Neither is universally right. The decision comes down to your headcount, your process complexity, and how much internal quality bandwidth you already have.

From the Floor: I’ve lived both sides of this decision. At a five-person coatings company, we built our ANSI 51 certification entirely from a documentation package — no consultant, just someone on staff who understood our processes well enough to adapt the templates to how we actually manufactured coatings. At a mid-size weld supply company I worked with pursuing ISO 9001, a consultant wasn’t optional — building a certifiable QMS wasn’t a skill set anyone in that organization had, and no template was going to close that gap. Same certification goal, two completely different starting points — and the right path followed from that, not from company size alone.

If you are not sure about choosing if ISO implementation packages vs consultants fits your operation, run the ISO 9001 Roadmap first — it lays out exactly what your QMS needs before you spend a dollar on either option →

In This Guide

What ISO 9001 implementation actually requires, clause by clause
The real cost and timeline of hiring a consultant
The real cost and timeline of using a documentation/implementation package
A side-by-side comparison to help you decide
A cost reality check anchored to company size
A decision tree to point you to the right path in under a minute
Real failure modes when the wrong path is under-resourced
Common misconceptions about ISO implementation
A hybrid approach that works for mid-sized operations

👉 Start Here (Top Resources)

Build your QMS with a structured documentation package — 9001Simplified — Prebuilt manuals, procedures, and forms mapped to ISO 9001:2015 clauses, without a $20,000+ consulting invoice.
Purchase the official ISO 9001:2015 standard — ANSI Webstore — You need the actual clause text regardless of which implementation path you choose. Use code CC2026 for 5% off.
Built your documentation but dreading the ongoing tracking? Refer your company to QualityWeb 360 for straightforward ISO 9001 management software.

What Implementation Actually Requires

Before comparing routes, it helps to know what you’re actually building. ISO 9001:2015 requires a documented QMS covering ten clauses — but only clauses 4 through 10 require operational action; clauses 1–3 are scope, references, and terms.

Clause	Focus Area	Typical Documentation Needed
Clause 4–5	Context, leadership, scope	Quality policy, scope statement, org chart
Clause 6	Planning	Risk register, quality objectives
Clause 7	Support	Competence records, calibration program, document control
Clause 8	Operation	Work instructions, production controls, supplier evaluation
Clause 9	Performance evaluation	Internal audit program, management review records
Clause 10	Improvement	Corrective action (CAPA) log, nonconformance tracking

Whether you build this with a consultant sitting across the table or a documentation package on your desktop, the deliverable is the same. What differs is cost, speed, and how much of the thinking gets done for you versus by you.

For the full clause-by-clause breakdown, see our ISO 9001 Certification Guide.

The Consultant Route

Most common finding: Consultants earn their fee on complexity, not on paperwork. If your operation has multiple product lines, multiple sites, or a workforce that has never operated under a formal QMS, a consultant’s ability to translate the standard into your specific processes is worth the premium.

Typical cost: $8,000–$30,000+ depending on company size, number of sites, and scope. Larger multi-site manufacturers routinely see six-figure engagements.

Typical timeline: 4–9 months, driven by consultant availability and how much internal change management is required.

What you get: A dedicated point of contact, custom-built documentation reflecting your actual processes (not generic templates), on-site gap assessments, and — often — a working relationship through your first surveillance audit.

What you don’t get: Speed or budget predictability. Consultants bill by scope creep as often as by hours, and a mid-project change in facility leadership or production schedule can stretch a 4-month engagement into 8.

If certification body selection is also on your radar, our Best ISO Certification Bodies guide walks through registrar selection separately from implementation — they’re two different decisions many manufacturers conflate.

The Implementation Package Route

Most common finding: Documentation packages fail when a company treats them as “buy and forget.” They succeed when a company treats them as a structured starting point that still requires internal ownership — someone has to actually adapt the templates to real production processes.

Typical cost: $500–$2,500 for a complete kit, depending on scope and whether industry-specific templates (aerospace, automotive, medical device) are included.

Typical timeline: 6 weeks–4 months, depending on internal bandwidth. A dedicated quality manager can move faster than a plant manager doing it on nights and weekends.

What you get: Prebuilt manuals, procedures, forms, and audit checklists mapped directly to ISO 9001:2015 clauses — built to be edited, not started from a blank page.

If you are not 100% certain your current documentation covers every required clause, 9001Simplified’s documentation kits are built specifically to close that gap without a six-figure invoice →

What you don’t get: Someone else doing the thinking for you. A package gives you the structure; you still need someone internally who understands your production floor well enough to adapt it correctly. Skip that step and you end up with a manual that reads well but doesn’t match what actually happens on the shop floor — which is exactly what an auditor flags first.

We reviewed the platform in detail here: 9001Simplified Review (2026).

For manufacturers wondering whether the 2026 edition changes this calculus, see ISO 9001 Documentation Toolkit 2026: Buy Now or Wait?

Consultant vs. Package: Side-by-Side

Factor	Consultant	Implementation Package
Typical cost	$8,000–$30,000+	$500–$2,500
Typical timeline	4–9 months	6 weeks–4 months
Best fit	Multi-site, complex, or first-time QMS builds	Single-site shops with quality-literate staff
Customization	Fully custom to your processes	Template-based, requires internal adaptation
Ongoing support	Often included through first audit	Varies by provider
Internal effort required	Lower	Higher
Budget predictability	Lower (scope creep risk)	Higher (fixed cost)

If you are already ISO 9001 certified and are simply refreshing documentation ahead of a transition period, a package is almost always the more efficient choice — you’re not starting from zero, you’re updating what exists.

👉 There’s a third option beyond DIY and hiring a consultant: software that keeps you audit-ready after you’re certified. See if QualityWeb 360 fits your operation.

ISO 9001 implementation cost comparison infographic showing documentation packages, consultants, and hybrid approaches with typical costs, timelines, and best-fit scenarios for manufacturers. — Compare the costs, implementation timelines, and advantages of ISO documentation packages, consultants, and hybrid approaches to choose the best ISO 9001 implementation strategy.

Cost Reality Check

Cost comparisons only mean something once you attach them to your actual company size. Here’s the reality check most manufacturers skip before they sign anything.

If you’re a 20-person shop, a $30,000 consulting engagement is not just unnecessary — it’s a misallocation of capital. It delays certification without improving audit outcomes, and it ties up budget that could have funded a documentation package, a professional gap assessment, and two years of internal audit training, with money left over.

Flip it around: if you’re a 300-employee, multi-site operation, a $1,500 documentation kit alone is a false economy, not a cost-saving move. Without someone validating how the standard translates across facilities with different equipment, shifts, and process variations, you end up with a documentation set that reads consistently on paper and falls apart the moment a registrar audits more than one site.

The real question isn’t “which option is cheaper?” It’s “which option is cheaper for an operation my size, at my level of complexity?” Those are two very different answers — and the decision tree below exists to get you to the right one fast.

Which Path Fits Your Business

Use this decision tree first. It won’t cover every edge case, but it will get most manufacturers to the right starting point in under a minute.

Your Situation	Recommended Path
Single-site, under 100 employees, quality-literate staff	Documentation Package
Multi-site or multiple distinct product lines	Consultant
Hard customer deadline + no internal QMS experience	Consultant
Budget-sensitive + flexible timeline	Documentation Package
Internal bandwidth available but high process complexity	Hybrid

If you are a single-site shop under 100 employees with at least one person who understands your processes in detail → start with a documentation package. You have the internal knowledge; you just need the structure.
If you are under customer pressure to certify quickly and don’t have anyone internally who’s built a QMS before → a consultant’s speed and hand-holding is worth the premium, even at a higher price point.
If you are a multi-site operation or run several distinct product lines under one certificate → a consultant (or a hybrid engagement) will save you more in avoided rework than it costs upfront.

ISO implementation packages vs consultants decision tree infographic helping manufacturers determine whether a documentation package, consultant, or hybrid approach best fits their business. — Use this ISO 9001 implementation decision tree to determine whether your manufacturing business should choose a documentation package, consultant, or hybrid implementation strategy.

The Mistake Most Manufacturers Make

The most common failure point isn’t picking the “wrong” option — it’s picking the right option and then under-resourcing it. Shops buy a documentation package and hand it to whoever has the lightest workload that quarter, instead of someone who actually understands the production floor. Or they hire a consultant and assume the engagement replaces internal ownership entirely, so when the consultant leaves, nobody can maintain the system.

Either way, the audit finding looks the same: documentation that doesn’t match practice. Auditors don’t care which path you took to get there — they care whether what’s on paper matches what’s happening on the floor.

Two examples make this concrete:

A 35-person fabrication shop bought a documentation kit but never adapted the Clause 8 work instructions to match its actual production steps. The manual read well. The audit found a nonconformity in the first hour, because operators weren’t following procedures that never described what they actually did on the floor.
A three-site contract manufacturer tried to build its QMS entirely in-house, across all locations, with no outside validation. Documentation looked consistent on paper, but each site had quietly adapted its own version of the work instructions over time. The registrar cited major nonconformities for inconsistent document control across sites — exactly the failure mode a consultant’s cross-site validation exists to catch.

Before committing budget to either path, most operations managers miss this step — run a Manufacturing Compliance Checklist against your current state first, so you know exactly how big a gap you’re actually closing →

Split-screen infographic comparing ISO 9001 documentation with actual manufacturing practices, illustrating how auditors identify nonconformities when documented procedures do not match production. — Successful ISO 9001 audits depend on documented procedures matching what actually happens on the production floor, not simply having complete documentation.

Common Misconceptions

A few beliefs cause more bad decisions in this space than anything else. Worth naming directly:

“ISO requires you to use a consultant.” It doesn’t. The standard specifies what your QMS must accomplish, not how you build it. You can implement entirely in-house, provided the result is audit-ready.
“Documentation templates are plug-and-play.” They’re not. Every package — including a strong one — still requires someone internally to adapt the templates to your actual production steps. Skip that step and you’ve built a manual that describes a process you don’t actually run.
“Registrars care how you built your QMS.” They don’t. A certification body audits against the standard’s clause requirements. Whether your documentation came from a consultant, a package, or a blank Word document you wrote yourself makes no difference to the audit outcome — only whether it matches your practice.

The Hybrid Approach

For mid-sized manufacturers, this is usually the sweet spot — more risk reduction than a package alone, without paying for a full custom consulting build.

When hybrid works:

Roughly 100–300 employees, single site, moderate process complexity
Some internal quality knowledge, but not full confidence in audit readiness
No hard multi-site consistency problem to solve — just a need for validation before the audit
Budget that supports more than a package but doesn’t justify a full consulting engagement

What hybrid looks like in practice:

Use an implementation package for the documentation backbone — this is where 9001Simplified’s documentation kits do the heavy lifting at a fraction of consultant pricing.
Bring in a professional for a focused gap assessment against your actual production processes — not a full build, just validation.
Add a short, limited-scope consulting engagement (a few days, not a few months) focused specifically on training your internal auditor and reviewing documentation before your certification audit.

Typical combined cost: $3,000–$12,000 — a fraction of a full consulting engagement, with meaningfully more risk reduction than a package used on its own.

This gets you most of the cost savings of a package with a meaningful chunk of the risk reduction a consultant provides — without paying for a full custom build.

For a realistic sense of how long either path takes end to end, see How Long Does ISO Certification Take? and our broader ISO Implementation Timeline for Manufacturers.

Quick Decision Checklist

✅ Do you have someone internally who understands your production processes clause-by-clause?
✅ Do you have a hard certification deadline driven by a customer contract?
✅ Have you operated under any formal quality system before (even informally)?
✅ Is your operation single-site, or does it span multiple facilities?

⚠️ Have you budgeted for ongoing maintenance, not just initial certification? ⚠️ Have you confirmed your registrar’s audit timeline against your chosen implementation timeline?

FAQ

Is a documentation package enough to pass an ISO 9001 audit on its own?

No. A package gives you the framework, but auditors are checking whether your documentation reflects what actually happens in production. You still need someone internally to adapt the templates and run the system day to day.

How much cheaper is a package compared to a consultant?

Typically 80–95% cheaper on direct cost. A complete documentation kit runs $500–$2,500, while consultant engagements commonly range from $8,000 to $30,000 or more depending on company size and scope.

Can I switch from a package to a consultant partway through if I get stuck?

Yes, and it’s common. Many manufacturers start with a package, hit a specific gap — usually risk-based thinking under Clause 6 or internal audit program design under Clause 9 — and bring in limited consulting help for just that piece.

Do larger companies ever use documentation packages instead of consultants?

Occasionally, for single-site divisions within a larger corporate structure that already has quality expertise elsewhere in the organization. It’s less common for first-time, multi-site QMS builds.

Does ISO require me to use a consultant or an accredited implementation partner?

No. ISO does not mandate how you build your QMS — only that it meets the clause requirements. You can build one entirely in-house with no outside help at all, provided it’s audit-ready. See ISO.org for the standard’s official scope and intent.

What happens if I choose the wrong path and it doesn’t work?

You lose time, not certification eligibility. If a documentation package isn’t working, you can bring in a consultant mid-stream. If a consultant engagement stalls, you can supplement with a package for the sections still outstanding. Neither choice is permanent.

Will my certification body care which path I used?

No. Registrars and accreditation bodies — including those operating under ANAB accreditation — audit against the standard’s requirements, not against how you built your documentation.

Is a consultant worth it just for the first internal audit?

Sometimes. If nobody on staff has run an internal audit before, a short consulting engagement focused solely on training your internal auditor can be more cost-effective than a full implementation contract.

📥 Free Resources

ISO 9001 Roadmap — Step-by-step implementation guide for manufacturers building or improving a quality management system.
Manufacturing Compliance Checklist — Practical compliance reference covering key ISO, OSHA, and quality requirements for production environments.
Supplier Quality Checklist — Evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts.

Not Sure What to Do Next?

🔹 Still researching your options? Get the ISO 9001 Roadmap first — it maps out exactly what your QMS needs before you commit budget to either path.

🔹 Ready to start building your documentation? 9001Simplified’s implementation packages give you a structured starting point at a fraction of consultant pricing.

🔹 Need to buy the standard itself first? Get the official ISO 9001:2015 text from ANSI Webstore — use code CC2026 for 5% off before you build against clause requirements you haven’t actually read.

🔹 Already built your documentation and need to manage it day-to-day? A kit gets your QMS built — QualityWeb 360 is what keeps it running.

Neither path is inherently better — the wrong fit is what costs you months. Whichever route your operation is built for, The Standards Navigator will keep walking you through it, clause by clause.

Struggling to Know If Your QMS Is Actually Audit-Ready?

Most manufacturers don’t get flagged for picking a documentation package over a consultant, or the other way around. They get flagged because whichever path they chose was never fully finished — a clause left half-documented, a gap assessment skipped to save time.

Operations that skip the gap-check step going into an audit tend to find out the hard way, mid-audit, in front of the registrar. Operations that run one six weeks out walk in already knowing where they stand.

The Standards Navigator covers ISO 9001 implementation, documentation, and audit readiness for manufacturers building or maintaining a certifiable QMS.

👉 Get updates on ISO 9001 implementation and documentation strategy
👉 Be first to access new gap assessment checklists and implementation resources

The Standards Navigator — Industrial Compliance. Clearly Explained.

What Happens If You Fail an ISO 9001 Audit? (2026 Guide)

Failing an ISO 9001 audit doesn’t end your certification — but what you do next determines whether it survives. This guide covers the difference between minor and major nonconformances, corrective action requirements, surveillance audit consequences, and the most common clause failures in manufacturing audits.

Major nonconformances, corrective action timelines, and how to protect your certification before the registrar closes the loop

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

Most ISO 9001 Audit Failures Are Preventable — But Only If You Know What to Look For

A single major nonconformance can freeze shipments, trigger customer notifications, and put your certification at risk before you even finish the closing meeting.

You’ve invested months building your QMS. Your documentation is in order — or so you think. Then the registrar’s auditor walks out of your facility with a major nonconformance on the table.

This happens more often than certification bodies will publicly admit. And for most manufacturers, the stakes are real: lost contracts, delayed shipments, customer notification requirements, and a follow-up audit on a deadline that doesn’t flex.

What happens if you fail an ISO 9001 audit?

The first thing to understand is that “failing” an ISO 9001 audit isn’t technically the right term. You don’t pass or fail like a written exam. You receive nonconformance findings — minor or major — and what happens next depends entirely on which type you received, how your registrar handles them, and whether your corrective action response is credible.

The second thing to understand is that most nonconformances that trigger a failed audit cycle are foreseeable. They show up in the same clauses, for the same reasons, in facility after facility. If you know where auditors find them, you can close them before the auditor arrives.

⚠️ Am I In Trouble? Signs Your Audit Result Is Serious

A major nonconformance was issued — not just an observation or minor NC
The registrar indicated a follow-up audit is required before certification is issued
Your certification has been placed under suspension notice
A customer contract requires ISO 9001 certification and your certificate is at risk
Your corrective action deadline is less than 30 days away and root cause analysis isn’t complete

If any of these apply, keep reading — this guide covers exactly what happens next and how to recover.

I’ve been on both sides of this. As an ISO 9001 Internal Auditor and operations manager across heavy manufacturing environments — including a global gas and energy manufacturing facility — I’ve watched organizations go into surveillance audits with gaps they didn’t know they had. The ones that recovered fastest weren’t the ones with the best documentation. They were the ones with gap assessment data in hand before the registrar showed up.

👉 Before your next audit, run this gap check: Download the Manufacturing Compliance Checklist — a practical reference covering key ISO 9001, OSHA, and quality requirements for production environments.

In This Guide:

The difference between minor and major nonconformances
Exactly what happens after each type of finding
The most common clause failures in ISO 9001 audits
Corrective action timelines and what your registrar expects
How to prevent a failed audit cycle before Stage 1

👉 Start Here: Top Resources for Audit Readiness

📋 ISO 9001 Documentation Kit — 9001Simplified — The no-consultant solution for manufacturers building or repairing a QMS before an audit. Covers all required documented information under ISO 9001:2015.

📘 ISO 9001:2015 Standard — ANSI Webstore — Purchase the current standard directly. Use code CC2026 for 5% off through December 31, 2026.

🎓 ISO 9001 Training — BSI Group — Auditor training, lead implementer courses, and internal audit programs for manufacturing teams.

🎓 ISO 9001 Training — ISOQAR — ISO 9001 training and certification courses from an accredited certification body. A strong option if you’re evaluating training and certification from a single provider.

Minor vs. Major Nonconformances: What’s the Difference?

Finding Type	Definition	Certification Impact	Typical Response Window
Observation / OFI	Opportunity for improvement — no requirement gap	None	Discretionary
Minor NC	Single lapse or isolated gap in one part of the QMS	Certification recommended with conditions	30–90 days documented CA
Major NC	Systemic failure or total breakdown of a requirement	Certification withheld or suspended	30–90 days + follow-up audit

A minor nonconformance means a single procedure wasn’t followed, a record was missing, or a process had a localized gap. The registrar can still recommend certification, but you’ll be required to submit a documented corrective action within the agreed timeframe.

A major nonconformance means a systemic failure — either a complete absence of a required process, or a pattern of minor issues that collectively indicate the QMS isn’t functioning as intended. Certification is withheld until the finding is closed, and a follow-up audit is typically required before the registrar issues the certificate.

Comparison infographic showing the differences between minor and major ISO 9001 nonconformances including certification impact, corrective action expectations, urgency, and business risk. — See how minor and major ISO 9001 audit findings differ and what each means for certification status and corrective action.

⚠️ Most common mistake: Treating a major NC like a documentation problem. Root cause analysis is required — not just evidence that you fixed the symptom.

What Happens Immediately After a Major NC

The registrar closes the audit with an audit report. This document details every finding with the clause reference, objective evidence cited, and severity classification. Here’s what the sequence looks like after a major nonconformance:

Step 1 — Audit Report Issued The registrar delivers the formal audit report, typically within 5–10 business days of the closing meeting. Every finding is documented with clause references and evidence.

Step 2 — Corrective Action Plan Submitted You submit a corrective action plan addressing the major NC. This must include: immediate correction (what you did to fix the specific instance), root cause analysis (why it happened), and systemic corrective action (what you changed so it can’t recur).

Step 3 — Evidence Review or Follow-Up Audit Depending on the registrar and the severity of the NC, they’ll either accept documented evidence or require a follow-up audit — sometimes called a special audit — at your facility. This is an additional cost.

Step 4 — Certification Decision If the registrar accepts the corrective action response, the certification is issued or reinstated. If the response is inadequate, the clock restarts.

Infographic showing the four-step process after receiving a major ISO 9001 nonconformance, including audit report issuance, corrective action, follow-up audit, and certification decision. — A visual guide showing what manufacturers can expect after receiving a major ISO 9001 audit nonconformance.

👉 If you’re in a corrective action cycle now: 9001Simplified’s documentation kit includes pre-built corrective action procedures, nonconformance tracking templates, and documented information frameworks that align directly to the clauses auditors flag most.

The Most Common ISO 9001 Audit Failures by Clause

ISO doesn’t publish official failure data. But pattern recognition across audits — and auditor feedback in the field — points to the same clauses repeatedly.

Clause 8.4 — Control of Externally Provided Processes, Products, and Services

This is the top finding in manufacturing audits. The requirement is clear: you must define criteria for evaluating, selecting, monitoring, and re-evaluating suppliers. What auditors find instead: approved supplier lists that aren’t maintained, incoming inspection records that don’t exist, and no evidence of supplier re-evaluation.

Most common finding: Approved Supplier List hasn’t been reviewed in over 12 months. No documented re-evaluation criteria exist.

Here’s what this looks like in practice: A fabrication shop in a surveillance audit showed an Approved Supplier List with 14 vendors — six of which had supplied critical weld consumables within the last year. None had been re-evaluated since initial approval three years prior. The auditor cited a major NC under Clause 8.4 because the monitoring and re-evaluation process existed in the procedure but hadn’t been executed. The corrective action required not just updating the ASL, but documenting a re-evaluation schedule and demonstrating it had been followed for at least one review cycle — which pushed the follow-up audit out 60 days.

Clause 10.2 — Nonconformity and Corrective Action

Too few CAPAs is a red flag. An auditor who walks into a facility with three CAPAs closed in the last 12 months immediately suspects the system isn’t being used. A functioning QMS in a manufacturing environment generates nonconformances — that’s evidence the system works, not evidence of failure.

Most common finding: CAPA records exist but root cause analysis is superficial — symptoms were fixed but systemic causes weren’t addressed.

Clause 7.2 — Competence

Training records are one of the most audited areas. ISO 9001 requires you to determine necessary competence, ensure personnel are competent, and retain documented evidence. What gets organizations cited: training records stored by department heads with no centralized system, no evaluation of training effectiveness, and gaps when employees change roles.

Most common finding: No evidence of training effectiveness evaluation for personnel performing quality-critical tasks.

If your team needs to close a training gap before the next audit, both BSI Group and ISOQAR offer ISO 9001 internal auditor and competence training. Both are accredited providers — compare delivery formats and scheduling against your timeline before committing.

Clause 9.2 — Internal Audit

The requirement is straightforward: conduct internal audits at planned intervals. What fails: audit programs that exist on paper but weren’t executed, internal audits that cover only part of the QMS scope, and no evidence that audit findings drove corrective action.

Most common finding: Internal audit schedule planned but not completed in the 12 months before the surveillance audit.

Clause 9.3 — Management Review

Management review must address specific inputs and outputs defined in the standard. Organizations fail here when management review meetings happened but the minutes don’t cover all required agenda items — particularly risk, objectives performance, and process effectiveness.

Most common finding: Management review records don’t address customer feedback trends or QMS performance metrics against quality objectives.

Clause 4.2 / 7.5 — Context and Documented Information

Document control is a perennial finding. Outdated documents in circulation, no version control, procedures referencing retired documents, and records not retained per the required timeframe.

Most common finding: Work instructions on the shop floor don’t match the current approved revision in the document control system.

👉 Most repeat findings come from documents nobody updated. See if QualityWeb 360 fits your operation — no consultant required.

Risk dashboard infographic showing the ISO 9001 clauses most commonly associated with audit failures and major nonconformances. — See which ISO 9001 clauses generate the most audit findings and where manufacturers should focus preventive action.

Corrective Action: What Your Registrar Actually Expects

A corrective action plan is not a promise to fix something. It’s a documented demonstration that you understand why it happened and that the system change you made prevents recurrence.

Registrars consistently reject corrective action responses that:

✅ Fix only the symptom without identifying root cause
✅ State “training was provided” without explaining what changed in the process
✅ Provide no objective evidence that the corrective action was implemented
✅ Fail to link the correction back to the specific clause requirement

Root cause analysis is not optional. Under Clause 10.2, ISO 9001 explicitly requires organizations to determine the causes of nonconformities — not just correct them. A major NC with a shallow root cause analysis will not close. The registrar’s reviewer will push it back.

The corrective action structure that works:

Immediate correction — What you did to address the specific instance found by the auditor
Root cause — The actual reason the system failed, not the symptom (5-Why or fishbone analysis documented)
Systemic action — What you changed in the process, procedure, or training so it can’t recur
Effectiveness verification — How you’ll confirm the corrective action worked, and when

Surveillance Audits and Certification Suspension

ISO 9001 certification doesn’t end at initial certification. You’re on a three-year cycle with annual surveillance audits. Failing a surveillance audit carries different consequences than failing an initial certification audit.

Surveillance audit major NC: The registrar typically issues a 30–90 day window to close the finding with documented corrective action. If the finding isn’t closed, certification can be suspended.

Certification suspension means your ISO 9001 certificate is temporarily invalid. You cannot represent yourself as ISO 9001 certified during suspension. For manufacturers with customer contracts requiring certification, this is an immediate commercial problem — not just a compliance problem.

Certification withdrawal is the most serious outcome and typically follows failure to close a suspension within the registrar’s timeline. Recertification requires restarting the audit process from Stage 1.

⚠️ Customer notification: Some customers require immediate notification if your certification is suspended. Check your customer contracts and quality agreements before assuming this is an internal matter.

How to Prevent a Failed Audit Before It Happens

The manufacturers who consistently pass surveillance audits aren’t the ones with the most sophisticated QMS software. They’re the ones who run internal audits on schedule, close CAPAs with documented root cause analysis, and review their QMS against the standard before the registrar arrives.

Gap Assessment Before Every Audit Cycle

Run a full internal gap check against ISO 9001:2015 clause requirements before Stage 1 or your annual surveillance. The gap assessment doesn’t need to be elaborate — it needs to be honest. Every “partial” or “no” is a finding you can close before the registrar finds it.

👉 ISO 9001 Implementation Roadmap — Free Download — A step-by-step implementation guide for manufacturers building or strengthening a quality management system before certification.

Six Actions That Protect Certification Status

✅ Run internal audits on schedule — every planned audit must be executed and documented

✅ Maintain your CAPA log actively — open, investigate, close, and verify CAPAs throughout the year

✅ Review your approved supplier list at least annually — document re-evaluation results

✅ Keep training records centralized and current — not in department binders

✅ Verify document revision control before every audit — pull working copies against the master

✅ Execute management review with documented minutes covering all Clause 9.3 inputs

If You’re Building Documentation from Scratch

The biggest gap for manufacturers heading into initial certification is documented information — procedures, work instructions, forms, and records that meet the requirements of ISO 9001:2015 Clauses 4–10. Building these from scratch without a framework takes months.

9001Simplified is built specifically for manufacturers who need a complete, audit-ready QMS without hiring a consultant. It’s the approach I’d recommend to any operations manager running a fabrication or manufacturing facility who needs to close a documentation gap on a real-world timeline.

👉 Built your documentation but dreading the ongoing tracking? Refer your company to QualityWeb 360 for straightforward ISO 9001 management software.

Objection: “We’re Too Small to Have These Problems”

This comes up constantly in smaller manufacturing operations. The assumption is that ISO 9001 audit failures happen to large corporations with complex processes — not to a 25-person fabrication shop or a contract manufacturer with a tight scope.

That assumption is wrong.

Smaller operations fail audits for the same reasons larger ones do — often faster, because there’s less infrastructure to catch gaps before the registrar does. Internal audit programs get deprioritized when the quality manager is also the production scheduler. Training records are in someone’s head, not in a system. CAPA process exists in theory but hasn’t been actively used.

The standard doesn’t scale its requirements based on company size. Clause 10.2 applies whether you have 20 employees or 2,000. The difference is that a smaller operation has less time to recover from a major NC — because the commercial consequences of certification suspension are proportionally larger.

The answer isn’t to build a more complex QMS. It’s to build a leaner one that you actually use. That’s exactly what 9001Simplified is designed for.

FAQ: ISO 9001 Audit Failures

What is the difference between a major and minor nonconformance in an ISO 9001 audit?

A minor nonconformance is an isolated gap or single instance of noncompliance — one missing record, one procedure not followed. A major nonconformance is a systemic failure: either a required process is completely absent, or a pattern of minor issues indicates the QMS isn’t functioning as intended. Major NCs prevent certification from being issued or can trigger suspension of existing certification.

How long do I have to respond to a major nonconformance?

Response windows vary by registrar but typically range from 30 to 90 days. The specific timeline will be documented in your audit report and nonconformance notice. Some registrars allow a documentation-only response; others require a follow-up audit at your facility to verify corrective actions were implemented.

Can I still claim ISO 9001 certification while a nonconformance is open?

If your certification has been issued and a minor NC was found during surveillance, you can typically maintain your certified status while the corrective action is in progress. If a major NC results in certification suspension, you cannot represent yourself as ISO 9001 certified during the suspension period. Review your certificate and the registrar’s suspension policy for the exact terms.

What happens if I don’t close a major nonconformance on time?

If you miss the corrective action deadline, the registrar will escalate to certification suspension. Continued failure to close the finding leads to certification withdrawal. Recertification after withdrawal requires restarting the full audit process from Stage 1, including a new Stage 1 document review and Stage 2 on-site audit — at full cost.

Is root cause analysis required for every nonconformance?

ISO 9001 Clause 10.2 requires root cause analysis for nonconformities. The depth of analysis should be proportional to the significance of the finding. A minor NC may require a straightforward 5-Why. A major NC — particularly one involving a systemic failure — requires documented root cause analysis that demonstrates you understand why the process failed, not just what failed.

What are the most common clauses that generate major nonconformances?

Based on field experience and auditor feedback, the highest-frequency major NC clauses are: Clause 8.4 (supplier controls), Clause 10.2 (CAPA), Clause 7.2 (competence and training records), Clause 9.2 (internal audit execution), and Clause 9.3 (management review). Document control gaps under Clauses 4.2 and 7.5 generate frequent minor NCs that can escalate to major when they’re systemic.

How do I prepare for a follow-up audit after a major NC?

A follow-up audit verifies that your corrective action was implemented and is effective — not just documented. Prepare by ensuring the corrective action evidence is organized by clause and finding reference, your root cause analysis is clear and defensible, and any process or procedure changes are visible in practice — not just on paper. The auditor will ask to see the change in operation, not just the revised procedure.

What does certification suspension mean for my customer contracts?

Certification suspension means your ISO 9001 certificate is temporarily invalid. If your customer contracts or purchase orders require current ISO 9001 certification, you are in contractual nonconformance during the suspension period. Many quality agreements include customer notification requirements when certification status changes. Review your contracts immediately if you receive a suspension notice.

📥 Free Resources

ISO 9001 Implementation Roadmap — Step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — Practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — Evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts

Not Sure What to Do Next?

🔹 Still researching what a failed audit means for your operation? Start with the ISO 9001 Certification Guide — it covers the full audit cycle, what Stage 1 and Stage 2 audits look like, and how surveillance audits work.

🔹 Ready to close your documentation gaps before the next audit? 9001Simplified gives manufacturers a complete, audit-ready QMS documentation framework without consultant fees. Built for operations managers who need to get compliant on a real timeline.

🔹 Need to purchase the current ISO 9001:2015 standard? Get it directly from the ANSI Webstore — the authorized U.S. source for ISO standards in print and PDF. Use code CC2026 for 5% off through December 31, 2026.

🔹 Already certified and looking to simplify ongoing management? Refer your company to QualityWeb 360 for day-to-day QMS software.

The manufacturers who sail through surveillance audits aren’t lucky. They run internal audits on schedule, close CAPAs with documented root cause analysis, and they don’t wait for the registrar to find gaps they could have found themselves. The Standards Navigator exists to help you stay on the right side of that line.

Stay Ahead of Your Next Audit

Too many manufacturers find their biggest QMS gaps when an auditor is already in the building. By then, the corrective action clock is running — and your certification is at risk.

Organizations that pass surveillance audits consistently aren’t running more complex systems. They’re running systems they actually use: internal audits executed on schedule, CAPAs tracked and closed with root cause analysis, and documented information that matches what’s happening on the floor.

The Standards Navigator covers ISO 9001, audit preparation, QMS documentation, and manufacturing compliance — with content written by a practitioner, not a consultant.

👉 Get updates on ISO 9001 audit readiness and QMS best practices
👉 Be first to access new compliance checklists and implementation tools

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

Supplier Controls for Medical Devices: ISO 13485 Requirements Explained (2026)

ISO 13485 supplier controls are among the most audited requirements in medical device QMS certifications. This guide covers Section 7.4 — evaluation criteria, purchasing document requirements, incoming inspection, re-evaluation, and the common audit findings that derail supplier programs before Stage 2.

How to build a compliant supplier qualification and monitoring program that holds up under notified body scrutiny

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

Your Supplier Is Now Your Risk — and Your Auditor Knows It

Supplier nonconformances are among the top findings in ISO 13485 audits. Not because manufacturers don’t care about their supply chain — but because most supplier controls for medical devices are built for appearance rather than function. They look complete on paper. They fall apart under scrutiny.

When a notified body or FDA investigator walks into your facility, they aren’t just looking at what happens on your production floor. They’re asking who made your components, how you selected them, what evidence you have that they’re capable, and what happens when they fail to deliver compliant product.

If your answers are “we have an approved vendor list” and “we send them a purchase order with our spec,” you’re in trouble.

I’ve audited supplier programs for a global manufacturer of many different types of valves and the gaps I found most often had nothing to do with the suppliers themselves. They had to do with how the manufacturer defined their requirements, communicated them, and verified compliance after the fact. A supplier can’t meet a requirement you never clearly documented. That’s your problem, not theirs, and it shows up in your audit findings.

Before you work through your supplier qualification process, run your current program through the ISO 13485 gap assessment checklist first.

👉 Download the ISO 13485 Gap Assessment Checklist → — free checklist for medical device manufacturers assessing their QMS against ISO 13485:2016 requirements, including supplier control clauses.

In This Guide

What ISO 13485 Section 7.4 actually requires for supplier controls
How to build a compliant supplier qualification and evaluation process
What your purchasing documents must include under 7.4.2
Verification of purchased product — incoming inspection and beyond
Common audit findings in supplier control programs
How supplier controls tie into your risk management process under ISO 14971
A quick audit checklist for your supplier control program

👉 Start Here: Top Resources for ISO 13485 Supplier Controls

Buy ISO 13485:2016 — the official standard from ANSI Webstore; use code CC2026 for 5% off through December 31, 2026
ISO 13485 Training — BSI Group — training for regulatory affairs and quality professionals implementing ISO 13485
ISO 13485 Training — ISOQAR — alternative training and certification body; compare both before you commit

What ISO 13485 Section 7.4 Requires

ISO 13485:2016 addresses purchasing and supplier controls in Section 7.4, which breaks into three requirements:

7.4.1 — Purchasing process: You must establish criteria for evaluating, selecting, and monitoring suppliers. The criteria must be based on the supplier’s ability to meet your requirements. Records of evaluation results must be maintained.
7.4.2 — Purchasing information: Purchasing documents must clearly describe the product or service being ordered, including applicable specifications, procedures, or quality system requirements you’re flowing down.
7.4.3 — Verification of purchased product: You must establish and implement the inspection or other activities necessary to verify that purchased product meets requirements.

This is not a checkbox exercise. The standard requires documented procedures, records, and evidence that your program actually functions — not just that it exists.

One important distinction from ISO 9001: ISO 13485 is more prescriptive about what supplier evaluation must cover and what records must be maintained. If you’re coming from an ISO 9001 background, expect your notified body to go deeper on supplier documentation than you may be used to.

For a full comparison of how supplier control requirements differ between the two standards, see: ISO 9001 vs ISO 13485

Supplier Qualification: How to Evaluate and Approve Suppliers

Supplier controls for medical devices infographic showing a risk-based supplier evaluation framework, Approved Supplier List process, regulatory review, technical capability assessment, and periodic supplier re-evaluation for medical device manufacturers. — ISO 13485 supplier approval requires documented evaluation, risk classification, qualification records, and ongoing supplier monitoring before suppliers remain on the Approved Supplier List.

Your Approved Supplier List (ASL) is the foundation of your supplier control program. But the list itself isn’t the requirement — the process that populates and maintains it is.

Supplier Evaluation Criteria

Your procedure must define how you evaluate a new supplier before adding them to your ASL. At minimum, this should include:

Evaluation Category	What to Assess	Evidence Required
Quality system	ISO 13485, ISO 9001, or equivalent QMS	Certificate, audit report, questionnaire
Regulatory compliance	FDA registration, CE marking, applicable regulations	Regulatory filings, declarations
Technical capability	Ability to meet your specification requirements	Capability studies, sample approval
Delivery and financial stability	Risk to supply continuity	References, business history
Product/service risk classification	Impact on device safety and performance	Risk assessment (see Section 7 below)

Not every supplier gets the same level of scrutiny. A supplier providing sterile packaging components gets evaluated differently than a supplier providing cardboard shipping boxes. Your procedure must define those tiers — and the evaluation rigor that goes with each.

Most common finding: Approved Supplier Lists that include suppliers with no documented evaluation on file. The vendor was added years ago, the person who approved them is gone, and there’s no record of what they were evaluated on.

Purchasing Controls: What Your POs and Specs Must Cover

Section 7.4.2 is where many organizations have significant gaps. Purchase orders and specifications must be clear enough that a supplier knows exactly what’s expected — and clear enough that you can verify compliance on receipt.

What Purchasing Documents Must Include

At minimum, your purchasing documents should specify:

Product description, part number, and revision level
Applicable specifications (dimensional, material, performance)
Quality requirements you’re flowing down (e.g., certificate of conformance, first article inspection, CAPA notification requirements)
Any regulatory or standards requirements the supplier must meet
Change notification requirements — the supplier must tell you before they change anything that affects your product

ISO 13485 purchasing controls infographic comparing a weak purchase order to an audit-ready controlled purchasing package with specifications, quality requirements, and verification controls. — ISO 13485 purchasing documents must define specifications, quality flow-down requirements, and verification expectations to support compliant supplier controls.

That last point is critical and frequently missed. Supplier-initiated changes — new sub-tier suppliers, process changes, facility moves, material substitutions — must not reach your production floor without your review and approval. If your purchase order doesn’t require the supplier to notify you of changes, you have no contractual basis to enforce it.

If your purchasing documents and quality flow-downs aren’t documented in a controlled procedure, your QMS documentation requirements aren’t complete. See: ISO 13485 Documentation Requirements

Most teams don’t discover their purchasing document gaps until a notified body auditor requests three supplier files during a Stage 2 audit. Run the gap check now, while you still have time to fix it.

👉 Download the ISO 13485 Gap Assessment Checklist →

Verification of Purchased Product

Section 7.4.3 requires you to verify that purchased product meets requirements before it enters your production process. What that looks like depends on the product, the supplier, and the risk level involved.

Incoming Inspection Options

Verification Method	When to Use	What to Document
100% incoming inspection	High-risk components, new suppliers, history of nonconformances	Inspection records, acceptance/rejection criteria
Statistical sampling	Established suppliers, lower-risk components	Sampling plan (AQL level), records of results
Certificate of conformance review	Established, well-performing suppliers	COC receipt record, periodic verification
Supplier data review	High-confidence qualified suppliers only	Data review records, approval basis
Skip-lot inspection	Extended high-performance track record	Defined criteria for skip-lot qualification

Your incoming inspection procedure must define the method for each supplier or product category — and your records must show you actually performed it.

What Auditors Look For

Auditors will ask to see incoming inspection records for specific lots. They will cross-reference the purchase order revision, the inspection criteria in your procedure, and the actual record. Discrepancies between any of these three are nonconformances.

They will also ask: what happens when incoming inspection finds a nonconformance? Your CAPA process must connect directly to your incoming inspection findings.

For how CAPA integrates with supplier nonconformances, see: CAPA Requirements in ISO 13485

Ongoing Supplier Monitoring and Re-Evaluation

Qualifying a supplier once is not enough. ISO 13485 requires ongoing monitoring and periodic re-evaluation of your suppliers.

What Ongoing Monitoring Looks Like

Your procedure should define what data you collect and at what frequency to assess supplier performance. Common metrics include:

Incoming acceptance rate — percentage of lots accepted without rejection
On-time delivery rate — consistently late suppliers are a supply risk
Nonconformance rate — corrective action requests issued per time period
Customer complaints attributable to supplied components
CAPA closure rate — how quickly suppliers respond to and close corrective actions you’ve issued

Re-Evaluation Requirements

Most organizations set an annual re-evaluation cycle. At re-evaluation, you’re reviewing the supplier’s performance data, confirming their certification is still valid, and deciding whether they remain on the ASL — or whether their approval level changes.

Re-Evaluation Outcome	Action
Strong performance	Maintain or upgrade approval level
Acceptable but issues noted	Issue corrective action, increase monitoring frequency
Poor performance	Probationary status, increase incoming inspection
Failed or uncertified	Remove from ASL, qualify replacement

If a supplier is removed from your ASL, your records must reflect that decision and any transition actions taken. An audit trail gap here — particularly if a product from a de-listed supplier made it into production — creates significant liability.

BSI Group offers ISO 13485 training that covers supplier management as part of QMS implementation — useful for quality managers building or rebuilding a supplier program from scratch.

How Supplier Controls Connect to ISO 14971 Risk Management

Risk-based supplier controls infographic showing ISO 13485 and ISO 14971 supplier tiering, supplier monitoring KPIs, risk classification, and supplier re-evaluation workflow for medical device manufacturers. — Risk-based supplier controls connect ISO 14971 risk analysis with ISO 13485 qualification, monitoring, verification, and supplier re-evaluation activities.

Your supplier tier system shouldn’t be arbitrary. It should be driven by a risk assessment.

ISO 14971 — the risk management standard for medical devices — requires you to identify hazards and estimate risks throughout the product life cycle. The components and materials your suppliers provide are part of that risk picture.

Risk-Based Supplier Tiering

Risk Tier	Component Examples	Supplier Control Level
Critical	Sterile packaging, implantable components, direct patient-contact materials	Full qualification, audits, COC per lot
Major	Electronic subassemblies, precision machined parts	Qualification + periodic re-evaluation, sampling
Minor	Non-product-contact materials, standard hardware	Basic approval, periodic review
Administrative	Calibration services, software tools	Contract review, credentials verification

Documenting the risk basis for each tier — and linking it to your ISO 14971 risk file — gives you a defensible rationale for your supplier control decisions. Auditors respond well to risk-based reasoning. They respond poorly to “that’s how we’ve always done it.”

For a full breakdown of how ISO 14971 and ISO 13485 work together: ISO 14971 vs ISO 13485

Common Audit Findings in Supplier Control Programs

These are the findings that show up repeatedly in ISO 13485 audits — and the ones your program should be specifically designed to prevent.

Most common finding #1: Suppliers on the ASL with no qualification records. Vendors added informally, without documented evaluation. No basis for their approval on file.

Most common finding #2: Purchase orders that don’t flow down quality requirements. The PO has a part number and a price. It does not reference a specification revision level, a certificate of conformance requirement, or any CAPA notification obligation.

Most common finding #3: Incoming inspection records that don’t match procedures. The procedure says AQL sampling on a specific plan. The records show visual inspection only. Or no records at all.

Most common finding #4: No re-evaluation records for suppliers on the ASL for more than 12 months. Annual re-evaluation is defined in the procedure. No evidence it was performed.

Most common finding #5: Supplier CAPAs not tracked or closed. A corrective action was issued to a supplier. There’s no record of their response or whether the root cause was resolved.

If any of those five sound familiar, your supplier control program has audit risk right now.

Quick Audit Checklist: Supplier Controls

Run through this before your next internal audit or notified body review:

✅ Documented supplier evaluation criteria based on product risk level

✅ Approved Supplier List with documented evaluation records for every supplier

✅ Procedure defines supplier tiers and the control requirements for each tier

✅ Purchasing documents (POs, specs) include product description, revision level, and quality flow-down requirements

✅ Change notification requirement communicated to and acknowledged by suppliers

✅ Incoming inspection procedure defines method by product/supplier category

✅ Incoming inspection records maintained and linked to purchase orders

✅ Nonconforming purchased product procedure exists and connects to CAPA

✅ Supplier performance data collected and reviewed at defined frequency

✅ Annual re-evaluation records on file for all active suppliers

✅ De-listed supplier records maintained with transition documentation

✅ Risk basis documented for supplier tier assignments (links to ISO 14971 risk file)

FAQ

What does ISO 13485 Section 7.4 require for supplier controls?

Section 7.4 of ISO 13485:2016 requires three elements: a documented process for evaluating, selecting, and monitoring suppliers (7.4.1); purchasing documents that clearly specify product requirements and quality flow-down obligations (7.4.2); and a defined process for verifying that purchased product meets requirements before use (7.4.3). All three require documented procedures and maintained records — not just policy statements.

How do I build an Approved Supplier List that satisfies ISO 13485 auditors?

Your Approved Supplier List must be backed by documented evaluation records for every supplier on it. The evaluation criteria should be defined in your procedure and applied consistently. Auditors will select suppliers from the list at random and ask to see their qualification records. If a supplier was added without documented evaluation, that’s a nonconformance regardless of how long they’ve been on the list.

Do all suppliers need the same level of evaluation under ISO 13485?

No. ISO 13485 supports a risk-based approach to supplier controls. Suppliers providing critical components — those that directly affect device safety or performance — require more rigorous qualification and monitoring than suppliers of low-risk or non-product-contact materials. Your procedure must define the risk tiers and the control requirements for each.

What must purchase orders include to satisfy ISO 13485 Section 7.4.2?

Purchase orders and associated documents must describe the product clearly enough to verify compliance on receipt. This includes the product description, specification revision level, applicable standards or regulatory requirements, quality requirements being flowed down (such as a certificate of conformance), and change notification obligations. A purchase order that only includes a part number and price is not compliant with 7.4.2.

How often do I need to re-evaluate suppliers under ISO 13485?

ISO 13485 requires periodic re-evaluation but does not specify a frequency. Most quality management systems set annual re-evaluation as the standard cycle. What matters is that your procedure defines the frequency, that re-evaluation is actually performed on schedule, and that records are maintained showing the outcome and any actions taken.

What happens if a supplier fails re-evaluation?

Your procedure must define the response to poor supplier performance. Options include issuing a corrective action request, increasing the incoming inspection level, placing the supplier on probationary status, or removing them from the Approved Supplier List. Whatever action is taken must be documented. If a supplier is removed from the ASL, records must reflect the decision and any transition activities.

How do supplier controls connect to CAPA in ISO 13485?

Any nonconformance associated with purchased product — identified at incoming inspection, during production, or through customer complaints — should trigger your CAPA process. CAPAs issued to suppliers must be tracked to closure, with evidence that the root cause was addressed. A CAPA issued to a supplier with no follow-up record is a frequent audit finding.

Does ISO 13485 require supplier audits?

ISO 13485 does not explicitly require supplier audits, but it requires you to evaluate and monitor suppliers — and for high-risk suppliers, a supplier audit may be the most effective and defensible method. Your procedure should define when supplier audits are required based on risk level and performance history.

📥 Free Resources

ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements — includes supplier control clauses
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification

Not Sure What to Do Next?

🔹 Still researching whether your supplier program meets 13485 requirements? Start with the free ISO 13485 Gap Assessment Checklist to identify specific gaps before you invest in implementation.

🔹 Ready to build or rebuild your supplier control program? BSI Group’s ISO 13485 training covers supplier management as part of a full QMS implementation curriculum — practical, not academic.

🔹 Need the standard itself to verify clause requirements? Buy ISO 13485:2016 from the ANSI Webstore — use code CC2026 for 5% off through December 31, 2026.

Supplier controls are one of the most audited areas in ISO 13485 — and one of the most correctable. The common findings aren’t caused by complexity. They’re caused by supplier programs that were built fast, never formalized, and never tested against the actual clause requirements. The Standards Navigator covers ISO 13485 implementation from gap assessment through certification, with practical guidance built on real QMS and quality management experience.

Stay Ahead of ISO 13485 Supplier Control Requirements

Supplier nonconformances are consistently among the top audit findings in ISO 13485 certifications — not because the requirements are unclear, but because most programs were built to satisfy an initial audit and never updated to reflect actual supplier performance data.

Organizations that maintain clean supplier records and re-evaluate on a defined schedule rarely have corrective actions in this area. Organizations that treat supplier qualification as a one-time event get findings every surveillance cycle.

The Standards Navigator covers the full ISO 13485 implementation picture — from documentation requirements to CAPA processes to supplier controls — with guidance built for regulatory affairs and quality professionals who need to get it right, not just get it done.

👉 Get updates on ISO 13485 implementation requirements and audit readiness 👉 Be first to access new ISO 13485 compliance resources and checklists

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

ISO/TR 14969 Explained: What It Was, Why It Was Withdrawn, and What Replaces It in 2026

ISO/TR 14969:2004 — the companion guidance document for ISO 13485:2003 — was officially withdrawn when ISO 13485 was revised to its 2016 edition. Quality professionals still referencing it in QMS procedures are citing an obsolete document. This article explains what ISO/TR 14969 covered, why it was withdrawn, and what replaces it: the ISO 13485:2016 Practical Guide.

The guidance document for ISO 13485 has changed — here’s what medical device quality professionals need to know today

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Standard That Guided ISO 13485 Compliance Is Gone — Here’s What That Means

If you searched for ISO/TR 14969, you already ran into a dead end. The document is no longer current. It was officially withdrawn.

That matters more than it sounds. Quality professionals in the medical device space still reference ISO/TR 14969 in internal procedures, training materials, and supplier documentation. Some consultants still cite it. If you are building or auditing a QMS right now, you need to know what replaced it — and whether your documentation is anchored to an obsolete source.

ISO/TR 14969:2004 was withdrawn by ISO when ISO 13485 was revised to its 2016 edition. The technical report was tied to ISO 13485:2003. When the 2016 version introduced risk-based process controls, expanded post-market surveillance requirements, and global regulatory alignment language, the 2004 guidance became misaligned — and in some clauses, actively misleading. In its place, ISO published a new handbook: ISO 13485:2016 — Medical Devices — A Practical Guide.

Now, in 2026, the stakes are higher. The FDA’s Quality Management System Regulation (QMSR) took effect February 2, 2026, formally replacing 21 CFR Part 820 with ISO 13485:2016 as the baseline for U.S. device compliance. Organizations that built their QMS on ISO 13485:2003 interpretations — or whose procedures still reference ISO/TR 14969 — face a two-layer exposure: outdated guidance and regulatory non-alignment.

I’ve seen this pattern play out in quality systems that looked solid on paper. During a QMS documentation review I supported at a contract manufacturer with FDA-regulated device components, the team found five procedures that traced their CAPA language back to 14969 interpretation. The procedures hadn’t been reviewed since 2019. They weren’t wrong, exactly — but they were missing the risk-proportionate framing the 2016 standard requires. No findings yet. That changes when the next surveillance audit runs QMSR expectations against legacy documentation.

Before you go further — if your team is preparing for ISO 13485 certification or a surveillance audit, run a gap check first:

👉 Download the ISO 13485 Gap Assessment Checklist — Free checklist for medical device manufacturers assessing their QMS against ISO 13485:2016 requirements.

In This Guide

What ISO/TR 14969 was and what it covered
Why it was withdrawn
What replaced it — the ISO 13485:2016 Practical Guide, including its structure and chapter mapping
Why 2026 is the year this gap becomes a compliance liability (FDA QMSR)
How to update your QMS documentation to reflect current guidance
Where to purchase the current standard and guidance documents
FAQ

👉 Start Here — Top Resources

ISO 13485:2016 — ANSI Webstore — Purchase the current edition of the standard. Use code CC2026 for 5% off at checkout.
ISO 13485 Training — BSI Group — Implementation, internal auditor, and lead auditor courses aligned to ISO 13485:2016.
ISO 13485 Gap Assessment Checklist — Free download. Identify where your current QMS falls short before your next audit.

What Was ISO/TR 14969?

ISO/TR 14969:2004 was a Technical Report published by ISO’s Technical Committee 210 (ISO/TC 210), the group responsible for quality management and general aspects for medical devices.

TR stands for Technical Report. Unlike a full ISO standard, a Technical Report carries no requirements. It cannot be used as the basis for certification or regulatory inspection. Its purpose was interpretive: help organizations understand what ISO 13485 required and how to meet those requirements in practice.

ISO/TR 14969 provided clause-by-clause guidance on ISO 13485:2003. It explained intent, offered implementation examples, and clarified language that auditors and manufacturers found ambiguous. The document mirrored the clause structure of ISO 13485:2003 and covered:

Scope and application — how requirements applied across different organization types (manufacturers, service providers, distributors)
Quality management system (Clause 4) — documentation requirements, records, and what was required vs. recommended
Management responsibility (Clause 5) — how top management commitment was assessed and evidenced
Resource management (Clause 6) — personnel competency requirements, infrastructure, and work environment controls
Product realization (Clause 7) — planning, design controls, purchasing, production, and process validation
Measurement, analysis, and improvement (Clause 8) — feedback, internal audits, nonconformance control, CAPA, and data analysis

Most common finding: Organizations that built their QMS procedures using ISO/TR 14969 as a reference may have clause citations, interpretive notes, or CAPA language that is now misaligned with ISO 13485:2016. Those gaps become findings during document reviews and surveillance audits.

Why Was ISO/TR 14969 Withdrawn?

Comparison chart showing differences between withdrawn ISO/TR 14969 guidance and ISO 13485:2016 Practical Guide. — Compare legacy ISO/TR 14969 guidance with the current ISO 13485 implementation approach.

ISO/TR 14969:2004 was withdrawn because ISO 13485 itself was substantially revised in 2016. When the 2016 edition introduced new and modified requirements, the 2004 guidance document became misaligned — and in some areas, a liability.

Change Area	ISO 13485:2003 / TR 14969	ISO 13485:2016
Risk-based process control	Limited risk language	Risk-based approach embedded throughout QMS structure
Regulatory requirements	Aligned primarily to EU directives	Expanded global alignment (FDA, TGA, Health Canada, EU MDR)
Post-market surveillance	General requirements	Explicit feedback loop and monitoring requirements
Software validation	Basic guidance	Expanded requirements for QMS software validation
Outsourced processes	Covered in Clause 4.1	Risk-proportionate controls based on risk and external party capability
Supplier controls	Standard purchasing controls	Risk-proportionate controls with clearer documentation requirements

A technical report tied to the 2003 standard could not guide organizations through requirements that didn’t exist until 2016. ISO withdrew the document and directed users to the replacement handbook.

What Replaced ISO/TR 14969? Structure and Clause Mapping

Timeline showing ISO/TR 14969 withdrawal and transition to ISO 13485:2016 Practical Guide and FDA QMSR requirements. — See how ISO/TR 14969 evolved into today’s ISO 13485 guidance framework.

The current guidance document is the ISO 13485:2016 — Medical Devices — A Practical Guide, published by ISO in 2017 and authored by technical experts from ISO/TC 210. In the United States it was adopted by AAMI as AAMI/ISO 13485:2016 — A Practical Guide, available through the ANSI Webstore. AAMI explicitly identifies it as the replacement for ISO/TR 14969.

The handbook runs approximately 214 pages and is organized to mirror the clause structure of ISO 13485:2016, making it a direct lookup reference when you’re working through specific requirements. Here’s how it maps:

Handbook Section	ISO 13485:2016 Clause	Key Guidance Provided
Introduction & Scope	Clause 1	Applicability across organization types; what “regulatory purposes” means in practice
Quality Management System	Clause 4	Risk-based QMS design; documentation hierarchy; outsourced process controls
Management Responsibility	Clause 5	Top management commitment evidence; quality planning; management review inputs/outputs
Resource Management	Clause 6	Competency records; infrastructure qualification; work environment controls
Product Realization	Clause 7	Design controls; purchasing controls; production process validation; sterilization; servicing
Measurement, Analysis & Improvement	Clause 8	Feedback systems; complaint handling; internal audit; CAPA; statistical methods

Beyond clause-level guidance, the Practical Guide also includes:

Regulatory notes specific to different markets — particularly useful for EU MDR and FDA QMSR alignment
Worked examples of how to apply risk-based thinking to QMS process selection and documentation intensity
Transition guidance for organizations moving from ISO 13485:2003-based systems to the 2016 edition

One practical limitation worth knowing: the Practical Guide is a 214-page document that, despite its name, is not always light reading. Industry reviewers have noted that some sections contain circular references and that the guidance on risk-based approach — one of the biggest paradigm shifts in the 2016 standard — spans only a few pages for a topic that has generated ongoing debate between manufacturers and notified bodies. Having the Practical Guide alongside a current training course is more effective than relying on the handbook alone.

👉 If you’re preparing for Stage 1 audit and haven’t run a full clause-by-clause gap check, do that before you open the Practical Guide. Download the ISO 13485 Gap Assessment Checklist to identify gaps first — then use the handbook to close them.

Why This Matters More in 2026: FDA QMSR and Dual Compliance

This isn’t just a document housekeeping issue. In 2026, it’s a compliance liability with a hard regulatory edge.

The FDA QMSR took effect February 2, 2026. It formally replaced 21 CFR Part 820 — the U.S. Quality System Regulation that governed device manufacturing for nearly 30 years — with ISO 13485:2016 as the legal baseline for U.S. medical device quality systems. Manufacturers who previously maintained a 21 CFR Part 820-based QMS now need to be running against ISO 13485:2016 requirements, including the interpretive framework the 2016 standard uses.

That has a direct impact on ISO/TR 14969 references. Here’s why:

ISO/TR 14969 pre-dates both ISO 13485:2016 and FDA QMSR. Any QMS procedure, work instruction, or training record that traces its authority back to 14969 guidance — rather than the 2016 standard and current Practical Guide — is not aligned to the regulatory expectations your FDA inspector will be applying.

Specific areas where this creates dual exposure:

CAPA requirements — 14969 guidance on CAPA pre-dates the 2016 standard’s risk-proportionate framing. FDA inspectors applying QMSR expectations will scrutinize whether your CAPA process scales corrective action depth to risk level. Procedures built on 14969 interpretation often don’t.
Post-market surveillance — The 2016 standard significantly strengthened feedback loop requirements. 14969 guidance reflects the lighter 2003 language. Under QMSR, FDA expects active post-market data feeding back into the QMS — not just complaint logs.
Software validation for QMS applications — If your document control system, CAPA software, or ERP was validated against 14969 guidance language, that validation basis needs review under the 2016 standard’s expanded software validation requirements.

I worked with a team at a supplier to a large device OEM during QMSR transition prep. Their internal audit procedure had been solid for years — well-written, consistently followed. When we mapped it against QMSR expectations, the issue wasn’t procedure quality. It was that the criteria used to determine audit frequency and depth hadn’t been updated since the 2003-era documentation. Risk-based audit scheduling — required under the 2016 standard — wasn’t in the procedure. The OEM’s supplier quality team flagged it in a pre-audit review before the FDA did. That’s the window you want to catch this in.

For a detailed breakdown of the QMSR transition and what changes for manufacturers, see FDA QSR vs ISO 13485.

How to Update Your QMS for Current Guidance

Five-step workflow for updating QMS documentation from ISO/TR 14969 to ISO 13485:2016 guidance. — Use this workflow to systematically remove obsolete guidance from your QMS.

If your QMS procedures, work instructions, or training materials reference ISO/TR 14969, here’s how to address it systematically.

Step 1 — Document search Run a controlled search of your document management system for “ISO/TR 14969,” “TR 14969,” and “14969:2004.” Flag every document where the reference appears. Include training materials and supplier quality agreements.

Step 2 — Classify each reference Not every reference creates a compliance gap. Categorize:

✅ Citation-only reference — the procedure logic is sound; only the document reference needs updating
⚠️ Interpretive reference — procedure was built around 14969 guidance that may not align with current Practical Guide interpretation (CAPA framing, risk-based audit criteria, outsourced process controls)
⚠️ Training material reference — auditors check training records; outdated citations get flagged

Step 3 — Batch the citation updates For straightforward citation updates, consolidate them into a single planned revision cycle. Update the reference from “ISO/TR 14969” to “ISO 13485:2016” or the Practical Guide as appropriate. Document the rationale in your change control record.

Step 4 — Cross-reference interpretive references against the Practical Guide For procedures built on 14969 interpretation, map them against the equivalent clause in the ISO 13485:2016 Practical Guide. Pay specific attention to: CAPA (Clause 8.5), outsourced process controls (Clause 4.1), internal audit (Clause 8.2), and post-market surveillance feedback (Clause 8.2.1). These are the areas where the 2016 guidance diverges most from 2003-era interpretation.

Step 5 — Update internal auditor training records If your ISO 13485 internal auditor training references 14969, update the training materials and re-document competency verification. This is consistently one of the overlooked items in QMS transitions — and it surfaces in audits.

Do the gap assessment before you start revising. Chasing individual references without knowing your overall QMS posture is working in the wrong order. The ISO 13485 Gap Assessment Checklist gives you the full picture first.

✅ Quick Checklist: ISO/TR 14969 Reference Review

[ ] Searched QMS document system for all 14969 references
[ ] Searched training materials and supplier quality agreements
[ ] Classified references as citation-only or interpretive
[ ] Verified CAPA procedure aligns with 2016 risk-proportionate framing — not 14969
[ ] Verified internal audit frequency and depth criteria include risk-based logic
[ ] Verified post-market surveillance feedback procedure reflects 2016 requirements
[ ] Updated training materials to remove obsolete guidance document references
[ ] Confirmed training records reflect ISO 13485:2016 Practical Guide as current source
[ ] Completed a full ISO 13485:2016 gap assessment against all 8 clauses

Where to Buy ISO 13485 and the Current Guidance Handbook

Document	Description	Source
ISO 13485:2016	The current active standard — required for certification	ANSI Webstore
ISO 13485:2016 Practical Guide	214-page official guidance handbook replacing ISO/TR 14969	ANSI Webstore — available individually or in bundles
ISO 13485 / ISO 14971 Bundle	Standard + risk management standard package	ANSI Webstore bundle
ISO/TR 14969:2004	Withdrawn — historical reference only	Available as historical document only

Use coupon code CC2026 for 5% off at the ANSI Webstore — valid through December 31, 2026. ANSI serves international buyers and offers standards in multiple languages where available.

For more on building your ISO 13485 QMS documentation, see ISO 13485 Documentation Requirements and the ISO 13485 Implementation Roadmap.

FAQ

Is ISO/TR 14969 still valid?

No. ISO/TR 14969:2004 was officially withdrawn by ISO when ISO 13485 was revised to its 2016 edition. It is no longer current and should not be used as implementation guidance for an ISO 13485:2016-aligned QMS. It remains available as a historical document only. The replacement is the ISO 13485:2016 — Medical Devices — A Practical Guide.

What replaced ISO/TR 14969?

ISO/TR 14969 was replaced by the ISO 13485:2016 — Medical Devices — A Practical Guide, a 214-page companion handbook published by ISO in 2017 and authored by ISO/TC 210 technical experts. In the United States, it was adopted by AAMI as AAMI/ISO 13485:2016 and is available through the ANSI Webstore. AAMI explicitly identifies it as the replacement for ISO/TR 14969.

Can I still reference ISO/TR 14969 in my QMS procedures?

It is not prohibited, but it creates audit risk — especially now that FDA QMSR is in effect. A reference to a withdrawn guidance document signals that your documentation system may not be current. Best practice is to replace ISO/TR 14969 citations with ISO 13485:2016 clause references or the Practical Guide, and to verify that any procedure logic built on 14969 interpretation still holds against the 2016 standard.

Does ISO/TR 14969 apply to FDA QMSR compliance?

No. ISO/TR 14969 was guidance for ISO 13485:2003. The FDA QMSR — effective February 2, 2026 — harmonizes U.S. requirements with ISO 13485:2016. QMSR compliance requires alignment with the 2016 standard and its current guidance documents. Organizations still referencing 14969 in CAPA, audit, or post-market surveillance procedures should treat QMSR implementation as the trigger to complete that cleanup.

What is the difference between a Technical Report and an ISO standard?

An ISO Technical Report carries no requirements and cannot serve as the basis for certification or regulatory inspection. ISO/TR 14969 was a TR — it existed to help organizations interpret and implement ISO 13485, not to define binding requirements. The ISO 13485:2016 Practical Guide serves the same interpretive purpose.

How is ISO/TR 14969 different from ISO 13485?

ISO 13485 is the requirements standard — it defines what a QMS must do to be certifiable. ISO/TR 14969 was guidance only — it explained how to interpret and meet those requirements. The standard is mandatory for certification; the guidance document was optional but widely used. ISO 13485:2016 is the current active standard.

Do I need to buy the ISO 13485:2016 Practical Guide separately from the standard?

Yes. The standard and the Practical Guide are separate publications. The standard defines the requirements; the Practical Guide explains clause intent and provides implementation examples. Bundle packages combining ISO 13485:2016, the Practical Guide, and ISO 14971 are available at the ANSI Webstore at savings compared to individual purchases. For manufacturers building or overhauling a QMS, having both is strongly recommended.

Where can I get ISO 13485 training that covers the current guidance?

BSI Group offers ISO 13485 training at awareness, requirements, implementation, internal auditor, and lead auditor levels — all aligned to the 2016 edition. BSI is both an accredited training provider and a recognized certification body. Pairing their implementation or internal auditor course with the Practical Guide gives you a working command of the 2016 requirements, not just familiarity with the document.

📥 Free Resources

ISO 13485 Gap Assessment Checklist — Free checklist for medical device manufacturers assessing their QMS against ISO 13485:2016 requirements before certification or a surveillance audit
ISO 9001 Roadmap — Step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — Practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — Evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification

Not Sure What to Do Next?

🔹 Still researching ISO 13485 requirements? Start with What Is ISO 13485? for a full breakdown of the standard’s scope, structure, and who needs it.

🔹 Building or upgrading your ISO 13485 QMS? The ISO 13485 Implementation Roadmap walks you through the sequence from gap assessment to certification-ready documentation. For training on the 2016 requirements, BSI Group’s ISO 13485 courses include implementation-level coverage that goes well beyond the handbook itself.

🔹 Ready to purchase the standard? Get ISO 13485:2016 at the ANSI Webstore in digital or print. Use code CC2026 for 5% off through December 31, 2026.

The Standards Navigator covers the full medical device compliance standards landscape — from ISO 13485 implementation to FDA QMSR alignment. If your QMS has to hold up against both ISO certification and FDA inspection, the guidance document you’re working from matters as much as the standard itself.

Stay Current on ISO 13485 and Medical Device Compliance

QMS procedures built on outdated guidance don’t fail audits immediately. They fail them on the third surveillance cycle, when nobody remembers where the language came from. The FDA QMSR has made that timeline shorter.

The Standards Navigator covers ISO 13485 implementation, QMSR transition, risk management requirements, and the documentation controls that keep QMS systems audit-ready across both regulatory frameworks.

👉 Get updates on the medical device compliance standards cluster 👉 Be first to access new ISO 13485 implementation resources and checklists

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

The Training Gap Nobody Budgets For

Table of Contents

👉 Start Here (Top Resources)

Why These Three Standards Need Dedicated Training

AS9100 Training: What Aerospace Suppliers Actually Need

What AS9100 Training Covers Beyond ISO 9001

Who Needs AS9100 Training

Where to Get AS9100 Training

ISO 13485 Training: Meeting FDA QMSR Competence Expectations

What ISO 13485 Training Covers

Who Needs ISO 13485 Training

Where to Get ISO 13485 Training

ISO 50001 Training: Building Energy Management Competency

What ISO 50001 Training Covers

Who Needs ISO 50001 Training

Where to Get ISO 50001 Training

Training Level Comparison Across All Three Standards

Where to Get Training for Each Standard

Common Training Mistakes Specific to These Standards

Quick Training Readiness Checklist

FAQ

Can I use my ISO 9001 lead auditor credential to audit AS9100?

Does ISO 13485 training need to reference FDA QMSR specifically?

Is ISO 50001 training the same as ISO 14001 training?

How long does AS9100 lead auditor training take?

Who needs the AS9104/3 authentication specifically?

What’s the difference between an ISO 13485 internal auditor course and an ISO 9001 internal auditor course?

Do I need separate ISO 50001 training if my team already has ISO 14001 training?

Where do I purchase the AS9100, ISO 13485, or ISO 50001 standards my training is based on?

📥 Free Resources

Not Sure What to Do Next?

Stay Ahead of Specialized Compliance Training

Subscribe

The Internal Audit That Used to Be Private Isn’t Anymore

In This Guide

Table of Contents

👉 Start Here (Top Resources)

What Clause 8.2.4 Actually Requires

Internal Audits vs. Supplier Audits vs. Certification Audits

Auditor Competence: What Clause 6.2 Actually Requires

Building a Risk-Based Audit Program

The Internal Audit Process, Step by Step

A Real Finding, Start to Finish

The Five Most Common Findings

MDSAP: What Changes for Multi-Market Audits

What Changed: QMSR and ISO 19011:2026

Quick Audit-Readiness Checklist

FAQ

How often does ISO 13485 require internal audits?

Can the same person who performs a process also audit it?

Do internal auditors need a formal certification?

Does the FDA QMSR require a separate internal audit program from ISO 13485?

Are internal audit reports confidential from FDA inspectors?

What’s the difference between an internal audit and a supplier audit under ISO 13485?

Does MDSAP replace our ISO 13485 internal audit requirement?

What’s the most common reason internal audit programs fail a certification audit?

Should we hire a consultant to run our internal audits, or can we do it ourselves?

📥 Free Resources

Not Sure What to Do Next?

Subscribe for Medical Device Compliance Updates

Subscribe

The Standard Behind Your Biocompatibility Testing Just Changed — Is Your Documentation Still Defensible?

In This Guide

Table of Contents

👉 Start Here (Top Resources)

What Is Biocompatibility, and Why ISO 10993 Matters

The ISO 10993 Series at a Glance

What Changed in ISO 10993-1:2025

ISO 10993 FDA Recognition: What’s Excluded and Why

Do You Need to Retest Already-Cleared Devices?

Where Biocompatibility Fits Into Your ISO 13485 QMS

Quick Audit Checklist

FAQ

What is biocompatibility testing for medical devices?

What is ISO 10993-1, and do I need to comply with it?

What changed between ISO 10993-1:2018 and ISO 10993-1:2025?

Has the FDA recognized ISO 10993-1:2025?

Do I need to retest devices already cleared under the 2018 edition?

Which parts of the ISO 10993 series apply to my device?

Is ISO 10993 the same as ISO 13485?