Quality Management Guides - The Standards Navigator

Buy AS9100 Rev D Standard: Where to Get the Official Document in 2026

AS9100 Rev D is the quality management standard for aviation, space, and defense — and it must be purchased from an authorized source. This guide covers where to buy it, current pricing, format options, what the document includes, and what the upcoming IA9100 transition means for buyers in 2026.

How to purchase AS9100 Rev D from authorized sources — pricing, formats, and what comes with the standard

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

If You’re Sourcing AS9100, You Need to Get This Right

AS9100 Rev D is the quality management standard for aviation, space, and defense. If you’re a supplier to Boeing, Lockheed Martin, Raytheon, or any prime contractor in the aerospace sector, there’s a good chance AS9100 certification is either already required or will be before your next contract renewal.

Getting the standard wrong at the start creates problems that compound. Counterfeit copies circulate online. Outdated revisions get used for implementation. Organizations spend months building a QMS to the wrong requirements and then face nonconformances during Stage 1 audit because the auditor is working from the current text and they’re not.

This guide covers exactly where to buy AS9100 Rev D, what you’re actually getting when you purchase it, the formats available, and what to know about the upcoming transition to IA9100.

In This Guide:

Where to buy AS9100 Rev D from authorized sources
Pricing and format options (PDF vs. print)
What the standard document includes
Related aerospace standards worth purchasing together
What the IA9100 transition means for buyers in 2026
How to verify your certification body is OASIS-listed

👉 Start Here — Top Resources for AS9100

👉 Buy AS9100 Rev D (PDF or Print): ANSI Webstore — Official SAE/AS9100 Standard — use code CC2026 for 5% off through December 31, 2026

👉 Save on Standard Bundles: ANSI Standard Packages — up to 50% off

👉 Build Your AS9100 QMS Documentation: 9001Simplified — Documentation Kits for Aerospace QMS

👉 AS9100 Training Courses: BSI Group — AS9100 Training and Certification

👉 ISO 9001 Training (Foundation for AS9100): ISOQAR — ISO/AS9100 Training Courses

Where to Buy AS9100 Rev D

AS9100 Rev D is published by SAE International on behalf of the International Aerospace Quality Group (IAQG). It is not freely available. To access the official, enforceable text of the standard, you must purchase it from an authorized source.

There are three legitimate options:

Source	Format Available	Best For
ANSI Webstore	PDF, print, multi-user, bundles	U.S. buyers; international orders; bundle purchases — multiple languages available
SAE International (sae.org)	PDF, print	Direct from publisher; SAE members may receive discounts
BSI Group	PDF, print	UK and European buyers; combined standard and training purchases

Comparison infographic showing authorized AS9100 Rev D purchase sources versus unauthorized sources, including pricing ranges, compliance benefits, and risks of unofficial copies. — Purchasing AS9100 Rev D from authorized sources helps ensure document accuracy, compliance, support, and access to the latest revision.

The ANSI Webstore is the recommended source for most buyers. It carries the full SAE AS9100 series in PDF and print formats, processes international orders, offers standards in multiple languages, and includes bundle packages that reduce per-standard cost when you need more than one document. Use code CC2026 at checkout for 5% off through December 31, 2026.

Avoid third-party resellers offering discounted PDFs, “free downloads,” or document-sharing platforms. Copies obtained outside authorized channels are almost always outdated, incomplete, or counterfeit — and your registrar will ask to see that you’re working from a current, controlled copy of the standard.

Pricing and Formats

AS9100 Rev D pricing through the ANSI Webstore runs approximately $200–$260 for a single-user PDF. Hardcopy print editions are similarly priced. Multi-user and enterprise licenses are available for organizations that need broader access.

Format	Price Range	Notes
Single-user PDF	$200–$260	Immediate download; searchable; single-user license only
Hardcopy (print)	$200–$260	Physical copy; useful for shop floor reference; single license
PDF Multi-User	$400–$500	Shared access across your implementation team
Enterprise License	$1,000–$1,800	Organization-wide access; contact ANSI for quote
Bundle (AS9100 + related standards)	Up to 50% off	Best value when purchasing multiple aerospace standards together

If you’re buying AS9100 alongside AS9102 (first article inspection), AS9101 (audit requirements), or ISO 9001, the ANSI standard bundle packages are worth evaluating — savings of up to 50% off list price apply when you bundle. That’s meaningful when you’re stacking multiple documents for a full implementation.

For a full breakdown of what AS9100 certification costs beyond the standard itself — including registrar fees, audit costs, and consultant expenses — see How Much Does ISO Certification Cost?

What the Standard Includes

AS9100 Rev D is the full quality management system requirements document for aviation, space, and defense. It is built on the ISO 9001:2015 framework — every clause from ISO 9001 is present — with aerospace-specific additions layered on top.

When you purchase AS9100 Rev D, you get:

The complete text of all 10 clauses, including all aerospace add-ons
Annex A — mapping of clause additions to ISO 9001 structure
Annex B — quality management principles (informative)
Bibliography of related standards

Key aerospace-specific requirements that go beyond ISO 9001 include:

Requirement Area	AS9100-Specific Addition
Product safety	Dedicated clause — must identify, document, and manage product safety risks
Counterfeit parts prevention	Explicit controls required for prevention, detection, and disposition of counterfeit EEE parts
Configuration management	Required for products throughout lifecycle — more rigorous than ISO 9001 traceability requirements
First article inspection	Referenced requirement — cross-references AS9102 for full FAI requirements
Human factors	Addressed explicitly — organizations must consider human factors in their processes
Operational risk management	Expanded beyond ISO 9001 risk-based thinking — more prescriptive requirements

The standard text itself does not include implementation guidance, checklists, or templates. Those are separate documents. If your team needs a ready-made documentation system, 9001Simplified’s aerospace documentation kits are built to the AS9100 clause structure and can significantly compress implementation time.

⚠️ Most teams don’t fail AS9100 audits because they misread the standard. They fail because they assumed their existing QMS covered it. If you haven’t run a clause-by-clause gap check against Rev D, do it before you schedule your Stage 1.

👉 Download the AS9100 Rev D Gap Assessment Checklist — free

AS9100 Rev D references several companion standards. If you’re implementing or certifying to AS9100, these are the documents your auditor will expect you to know — and in some cases, demonstrate compliance with.

Standard	What It Covers	Required?
AS9101F	Audit requirements for aviation, space, and defense	Used by your registrar during audits — worth understanding
AS9102B	First Article Inspection (FAI) requirements	Frequently customer-mandated; cross-referenced in AS9100
AS5553	Counterfeit parts avoidance, detection, mitigation	Directly referenced by Clause 8.1.4 of AS9100
ISO 9001:2015	Quality management system requirements (base standard)	AS9100 incorporates ISO 9001 in full — purchasing separately is optional
AS9110	QMS requirements for aviation maintenance organizations	MRO-specific — not needed unless you’re an aviation maintenance operation
AS9120	QMS requirements for aviation distributors	Distributors only — not a manufacturing standard

For most manufacturers, the priority purchases alongside AS9100 Rev D are AS9102 if your customers require FAI, and AS5553 if you handle electronic or electromechanical components. Both are available through ANSI standard bundle packages. The full SAE International aerospace standards catalog is available if you need to browse the complete series before deciding.

If you are also ISO 9001 certified — or working toward it as a foundation for AS9100 — see What Is AS9100? for a full breakdown of how the two standards relate clause by clause.

The IA9100 Transition — What Buyers Need to Know in 2026

This is the most important context for anyone buying AS9100 in 2026.

The IAQG is in the process of rebranding and revising AS9100 Rev D as IA9100 — where “IA” stands for International Aerospace. The name change reflects the IAQG’s goal of publishing a single, unified global document rather than separate regional versions. The target publication date is late 2026, aligned with the anticipated release of ISO 9001:2026.

What this means practically:

AS9100 Rev D remains the current, enforceable standard. Buy it now if you need to implement or certify to AS9100. It is the document your registrar will audit against.
The transition window after IA9100 publishes will likely be two to three years. Organizations with current AS9100 Rev D certificates will have time to transition — similar to how ISO 9001:2015 gave organizations three years to move from 2008.
Key changes expected in IA9100 include expanded product safety requirements, new information security clauses, stronger counterfeit parts controls, and alignment with the revised ISO 9001 high-level structure.
You are not behind by purchasing Rev D today. Every organization that certifies in 2026 will need to transition later — that’s standard practice in ISO and aerospace standards management.

Timeline infographic showing the expected transition from AS9100 Rev D certification to IA9100 publication and the anticipated 2-3 year aerospace industry transition period. — This timeline illustrates the expected path from AS9100 Rev D certification to the future IA9100 standard and transition window.

⚠️ Buyer’s Note: If you see a listing for “IA9100” or “AS9100 Rev E” as a published, purchasable standard in 2026, verify the source carefully. As of June 2026, IA9100 has not been published. AS9100 Rev D (2016) is the current edition.

For a deeper look at what AS9100 requires and how certification works, see What Is AS9100? — Complete Guide to the Aerospace Quality Standard.

How to Verify Your Certification Body Is OASIS-Listed

Not every ISO 9001 registrar is accredited to certify AS9100. This is a common mistake — organizations assume that because a CB holds ISO 9001 accreditation, they can issue an AS9100 certificate. They can’t unless they hold separate AS9100 accreditation.

The IAQG maintains the OASIS database — the authoritative registry of AS9100-certified organizations and accredited certification bodies. Before you sign with a registrar:

✅ Search the OASIS database to confirm your CB is listed and active for AS9100
✅ Verify ANAB accreditation for AS9100 in North America — this is the recognized accreditation body
✅ Ask specifically which aerospace sectors and scopes the CB is accredited for — aerospace scopes vary
✅ Confirm your organization’s OASIS listing after certification — your prime contractor customers will check it

An AS9100 certificate from an unaccredited CB is not recognized by prime contractors, DoD, or the commercial aerospace supply chain. This is not a technicality. It is a disqualifier for contract eligibility in most aerospace programs.

If you are evaluating which certification body to use → see Best ISO Certification Bodies — Ranked and Reviewed for 2026 for a full breakdown of accredited options.

If you are comparing AS9100 certification against your existing ISO 9001 scope → see ISO 9001 Certification Guide for how the two audit processes compare.er for contract eligibility.

Frequently Asked Questions

Where can I buy AS9100 Rev D officially?

AS9100 Rev D is published by SAE International and available through authorized resellers including the ANSI Webstore, SAE.org directly, and BSI Group. The ANSI Webstore is the recommended source for U.S. and international buyers — use code CC2026 for 5% off through December 31, 2026.

How much does AS9100 Rev D cost?

A single-user PDF runs approximately $200–$260 through most authorized resellers. Hardcopy editions are similarly priced. Multi-user PDFs run $400–$500, and enterprise licenses run $1,000–$1,800. Bundle pricing through ANSI reduces costs significantly when you’re purchasing multiple aerospace standards together.

Is AS9100 Rev D the same as ISO 9001?

No — but it contains all of ISO 9001:2015. AS9100 Rev D incorporates the full ISO 9001:2015 text and adds aerospace-specific requirements on top: product safety, counterfeit parts prevention, configuration management, first article inspection references, human factors, and expanded operational risk management. If you are certified to AS9100, you are also meeting ISO 9001 requirements — but not the reverse.

Should I wait for IA9100 before implementing AS9100?

No. AS9100 Rev D is the current, enforceable standard. IA9100 is expected in late 2026 with a transition window of approximately two to three years after publication. If your customers require AS9100 certification now, implement and certify to Rev D. You will transition to IA9100 when it’s published, as every currently-certified organization will need to do.

Can I share the AS9100 PDF with my whole team?

Not on a single-user license. Standard single-user PDF licenses do not permit multi-user access. If your implementation team needs simultaneous access, purchase a multi-user license. Using a single-user PDF across your organization is a license violation your registrar may flag during document control review — a finding you do not want going into Stage 1.

Do I need to buy AS9101 separately?

AS9101F (audit requirements) is used by your registrar, not your organization. You are not required to purchase it, but many quality managers find it useful for understanding what auditors will look for during Stage 1 and Stage 2 assessments. It’s available separately through ANSI.

What’s the difference between AS9100, AS9110, and AS9120?

AS9100 is for aerospace manufacturers. AS9110 is for aviation maintenance, repair, and overhaul organizations. AS9120 is for aviation distributors. Most companies in the aerospace manufacturing supply chain need AS9100. The standard you need is determined by your scope of work, not your customer’s preference.

Is a free version of AS9100 available anywhere?

No. There is no legally free version of AS9100 Rev D. Documents labeled “free AS9100 download” online are either counterfeit, illegally distributed, or are summaries rather than the full standard text. Your QMS must be built from the official, current document — auditors will ask to see your controlled copy.

📥 Free Resources for Aerospace QMS Implementation

📋 AS9100 Rev D Gap Assessment Checklist — clause-by-clause gap tool for pre-implementation assessment
📋 ISO 9001 Roadmap — foundational QMS roadmap (AS9100 uses the same clause structure)
📋 Manufacturing Compliance Checklist — operational compliance baseline for manufacturers
📋 Supplier Quality Checklist — supplier evaluation tool aligned to AS9100 Clause 8.4 controls

Not Sure What to Do Next?

🔹 If you’re ready to buy the standard: AS9100 Rev D — ANSI Webstore — use code CC2026 for 5% off

🔹 If you need multiple standards: ANSI Standard Packages — up to 50% off bundles

🔹 If you need training before you implement: BSI Group — AS9100 Training Courses

🔹 If you’re not sure whether AS9100 applies to you: What Is AS9100? — Complete Guide

🔹 If you need to find an accredited registrar: Best ISO Certification Bodies — Ranked for 2026

🔹 If you want to check your gap before you commit: AS9100 Rev D Gap Assessment Checklist — free download

The Standards Navigator covers AS9100, ISO 9001, ISO 13485, and the full range of standards affecting aerospace, manufacturing, and defense supply chains. If you found this useful, there’s more where it came from.

Stay Ahead of AS9100 and IA9100 Changes

The IA9100 transition is coming. When it publishes, certified organizations will have a limited window to update their QMS. Subscribers to The Standards Navigator get clause-level breakdowns, implementation guidance, and audit prep resources delivered directly — before the deadline pressure hits.

👉 Subscribe below and get the AS9100 Rev D Gap Assessment Checklist free. Know exactly where your QMS stands before your next audit.

What Is AS9100? The Complete Guide to Aerospace Quality Management (2026)

AS9100 Rev D is the quality management system standard for aviation, space, and defense. It builds on ISO 9001 and adds over 100 aerospace-specific requirements — product safety, counterfeit parts prevention, configuration management, first article inspection, and more. If your organization supplies to aerospace primes, this is not optional. This guide covers what AS9100 requires, how it differs from ISO 9001, what certification costs, and what the upcoming IA9100 revision means for your organization.

The aerospace quality management standard explained — what AS9100 Rev D requires, who needs it, how it differs from ISO 9001, the five core tools, certification costs, and what IA9100 means for your organization.

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

AS9100 Is Not Optional in Aerospace. It Is the Price of Entry.

If your organization supplies to Boeing, Lockheed Martin, Raytheon, Airbus, or any Tier 1 aerospace prime — AS9100 certification is not a differentiator. It is a baseline requirement. Without it, you do not get on the approved supplier list. Full stop.

AS9100 Rev D is the quality management system standard for the aviation, space, and defense industries. It builds on ISO 9001:2015 and adds over 100 aerospace-specific requirements covering product safety, configuration management, counterfeit parts prevention, first article inspection, key characteristics, and human factors — areas where ISO 9001 alone is insufficient for the risk profile of aerospace manufacturing.

This guide covers what AS9100 actually requires, who publishes it, how it differs from ISO 9001, what the five core tools are, what certification costs, and what you need to know about the upcoming transition to IA9100.

In This Guide

What AS9100 is and who publishes it
AS9100 Rev D — the current edition and what it requires
How AS9100 differs from ISO 9001
The aerospace-specific requirements ISO 9001 doesn’t cover
The five core tools of AS9100
Who needs AS9100 certification
AS9100 certification process — Stage 1 and Stage 2
AS9100 certification costs
IA9100 — the upcoming revision and what it means
Where to buy the AS9100 standard
Training and certification resources

👉 Start Here (Top Resources)

👉 Purchase the official AS9100 Rev D standard from the authorized source → SAE AS9100D — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026

👉 Get AS9100 certified with an accredited aerospace certification body → BSI Group AS9100 Certification

👉 Get AS9100 training for your team → BSI Group AS9100 Training

👉 Save up to 50% buying aerospace standards as a bundle → ANSI Standard Packages

What Is AS9100?

AS9100 is the international quality management system standard for the aviation, space, and defense industries. The current edition is AS9100 Rev D, formally designated SAE AS9100D:2016 — Quality Management Systems: Requirements for Aviation, Space, and Defense Organizations.

It is published by the International Aerospace Quality Group (IAQG) — a consortium of aerospace manufacturers from the Americas, Asia/Pacific, and Europe — and distributed in the United States through the Society of Automotive Engineers (SAE) and the ANSI Webstore.

AS9100 is used globally across three regional designations:

Region	Designation	Requirements
Americas	AS9100 Rev D	Identical requirements
Europe	EN9100:2018	Identical requirements
Asia/Pacific	JISQ9100:2016	Identical requirements

All three are functionally equivalent. A certificate issued under any of them is recognized across the global aerospace supply chain.

AS9100 is built on the foundation of ISO 9001:2015 — it includes all ISO 9001 requirements verbatim and adds over 100 aerospace-specific requirements on top. Organizations certified to AS9100 automatically satisfy ISO 9001 requirements. The reverse is not true.

For a full comparison of the two standards, see AS9100 vs ISO 9001.

AS9100 Rev D — The Current Edition

AS9100 Rev D was published in September 2016 and became the only version accepted for certification in September 2018 when the transition period from Rev C closed. It remains the current active standard.

Rev D introduced the most significant structural changes in the standard’s history — primarily because it aligned with the simultaneously released ISO 9001:2015, which introduced risk-based thinking as a foundational requirement and eliminated prescriptive documentation requirements in favor of a results-based approach.

What Rev D Changed From Rev C

Area	Rev C Approach	Rev D Approach
Risk management	Preventive action clause	Risk-based thinking embedded throughout
Documentation	Prescribed procedures and records	Documented information — flexible and scalable
Leadership	Management representative required	Top management direct accountability
Product safety	Implied through quality controls	Explicit dedicated clause
Counterfeit parts	General supplier controls	Dedicated counterfeit parts prevention requirement
Human factors	Not addressed	Explicit human factors clause
Configuration management	Basic requirement	Expanded requirements

Rev D also introduced specific requirements for key characteristics — the product and process features that most affect safety, fit, form, and function — and strengthened first article inspection (FAI) requirements under AS9102.

Most common finding in Rev D audits: Organizations that mapped their Rev C system to Rev D clause numbers without genuinely embedding risk-based thinking throughout their processes. The standard is not just restructured — it requires a different way of thinking about quality management.

AS9100 vs ISO 9001 — Key Differences

Comparison infographic showing the key differences between ISO 9001 and AS9100 Rev D, including aerospace-specific requirements such as product safety, counterfeit parts prevention, configuration management, and first article inspection. — AS9100 builds upon ISO 9001 by adding more than 100 aerospace-specific requirements focused on safety, risk, traceability, and product integrity.

AS9100 Rev D contains all of ISO 9001:2015 plus approximately 105 additional aerospace-specific requirements. The additions are not cosmetic — they address the specific risk profile of aviation, space, and defense manufacturing, where product failures can result in loss of life and billions in liability.

Requirement Area	ISO 9001:2015	AS9100 Rev D
Product safety	Not explicitly addressed	Dedicated clause — must identify and manage product safety risks
Counterfeit parts	Not addressed	Explicit requirement to prevent counterfeit part use
Configuration management	Not addressed	Required — must control product configuration throughout lifecycle
First article inspection	Not required	Required for new parts and significant changes (AS9102)
Key characteristics	Not addressed	Required — identify, control, and document key characteristics
Human factors	Not addressed	Required — consider human factors in design and production
Customer-designated special requirements	Basic supplier controls	Enhanced flow-down requirements to sub-tier suppliers
Project management	Not addressed	Required for programs above a defined complexity threshold
Risk management	Risk-based thinking	Risk-based thinking plus specific product and program risk requirements
Production process verification	Standard process control	First article inspection plus ongoing process monitoring

The practical implication: an organization with ISO 9001 certification has the QMS foundation but needs significant additional controls to meet AS9100 requirements. The gap is not insurmountable — but it is real, and underestimating it is the most common implementation mistake.

For organizations already certified to ISO 9001, see ISO 9001 Certification Guide for the foundational QMS requirements that carry directly into AS9100.

Aerospace-Specific Requirements

These are the clauses and requirements in AS9100 Rev D that have no direct equivalent in ISO 9001. They are where most nonconformances occur in organizations transitioning from ISO 9001 or building an aerospace QMS for the first time.

Product Safety (Clause 8.1.1)

AS9100 requires organizations to identify product safety risks, implement controls, and maintain documentation that traces safety-critical decisions throughout the product lifecycle. This is not a general quality objective — it is a formal, documented process.

Most common finding: Product safety risk assessments that exist as standalone documents rather than being integrated into design controls, supplier qualification, and production process planning.

Counterfeit Parts Prevention (Clause 8.1.4)

Organizations must implement controls to detect and prevent the use of counterfeit or suspect unapproved parts. This includes procurement controls, approved supplier lists, incoming inspection procedures, and training for personnel involved in purchasing and receiving.

The counterfeit parts problem is significant in aerospace — the FAA and DoD have documented thousands of counterfeit parts incidents. AS9100 treats this as a systemic risk requiring a systemic response, not just an inspection step.

Most common finding: Counterfeit parts procedures that address purchasing but not the full supply chain — particularly for legacy parts and spot-buy procurement.

Configuration Management (Clause 8.1.3)

Configuration management ensures that the product delivered matches the approved design — and that any changes to the design are controlled, approved, and documented throughout the product’s lifecycle. This is particularly critical in defense programs where product configurations may be legally specified in contracts.

Most common finding: Configuration management that covers the initial production baseline but lacks controls for engineering changes, customer-approved deviations, and product updates in the field.

Key Characteristics (Clause 8.1.2)

Key characteristics are the features of a product or process whose variation most significantly affects safety, fit, form, function, or service life. AS9100 requires organizations to identify key characteristics, establish controls for them, and communicate them to suppliers.

In practice this means manufacturing engineers and quality engineers working together to identify which dimensions, material properties, or process parameters are truly critical — and building specific inspection and control plans around them rather than treating all characteristics equally.

First Article Inspection (FAI)

AS9100 references AS9102 — the First Article Inspection standard — which requires a documented review of the first production article against engineering drawings and specifications before series production begins. FAI is required for new parts and for significant design or process changes.

FAI is one of the most rigorous requirements new AS9100 implementers underestimate. A complete FAI includes dimensional verification, material certifications, process documentation, and a formal review package that must be retained as a quality record.

Most common finding: FAI records that are incomplete, filed incorrectly, or not updated after engineering changes that should have triggered a partial or full re-FAI.

Human Factors (Clause 8.1.5)

AS9100 requires organizations to consider human factors in the design of work processes and environments — particularly in maintenance, assembly, and inspection operations where human error can have safety consequences.

This is not an ergonomics requirement. It is a quality control requirement — addressing how process design, workstation layout, lighting, task complexity, and shift patterns affect the likelihood of errors in safety-critical operations.

The Five Core Tools of AS9100

Infographic showing the Five Core Automotive Quality Tools framework, including APQP, FMEA, Control Plan, MSA, and PPAP, arranged in a continuous improvement cycle used in IATF 16949 and automotive quality management systems. — The Five Core Tools work together as an integrated framework that helps automotive manufacturers prevent defects, reduce risk, and achieve consistent product quality.

The aerospace supply chain — particularly in the defense sector — references five core quality tools that support AS9100 implementation. Organizations pursuing certification should have working knowledge of all five.

Step	Tool	Purpose	When Used
1	APQP (Advanced Product Quality Planning)	Structured product development process that defines what will be built and how — integrating quality planning from design through production	New product launches, design changes
2	FMEA (Failure Mode and Effects Analysis)	Systematic identification of potential failure modes and their effects on safety and quality — used to prioritize risk reduction before production begins	Design, process, and system risk analysis
3	Control Plan	Document that specifies control methods, reaction plans, and responsibilities for each step in the production process to prevent defects	Production process control
4	MSA (Measurement System Analysis)	Evaluation of measurement equipment and processes to ensure measurement systems are accurate and reliable before production data is trusted	Gauge R&R studies, calibration validation
5	PPAP (Production Part Approval Process)	Formal submission that validates all requirements are met and obtains customer approval before production launch	Customer approval before production

These tools originated in the automotive sector (they are also requirements of IATF 16949) and were adopted by aerospace because they provide structured methods for quality planning that align with AS9100’s risk-based approach. For a comparison of automotive and aerospace quality standards, see ISO 9001 vs IATF 16949.

Who Needs AS9100 Certification?

AS9100 certification is required or effectively required in the following situations:

Prime Contractors and Tier 1 Suppliers

Boeing, Lockheed Martin, Northrop Grumman, Raytheon, Airbus, and other aerospace primes require AS9100 certification from their direct suppliers. This requirement flows down through the supply chain — Tier 1 suppliers typically require AS9100 from their Tier 2 suppliers for safety-critical work.

OASIS Database Registration

The OASIS database (Online Aerospace Supplier Information System) is the global registry of AS9100, AS9110, and AS9120 certified organizations. Prime contractors use OASIS to verify supplier certification status. If you are not in OASIS, you cannot demonstrate certification to a prime.

Certification to AS9100 by an IAQG-recognized certification body results in automatic OASIS registration.

Defense Contractors

U.S. Department of Defense contracts frequently specify AS9100 or an equivalent quality management system. DFARS clauses and contract quality requirements often reference the IAQG 9100 series. Organizations pursuing defense work should verify specific contractual quality requirements — some programs require additional standards beyond AS9100.

MRO and Repair Stations

Maintenance, Repair, and Overhaul (MRO) organizations and FAA Part 145 repair stations often pursue AS9110 — the AS9100 variant for aviation maintenance organizations — rather than AS9100 itself. AS9110 addresses the specific quality requirements of maintenance operations.

Aviation Parts Distributors

Organizations that distribute aviation parts without performing manufacturing use AS9120 — the AS9100 variant for distributors. AS9120 focuses on traceability, documentation, and counterfeit parts prevention in the distribution chain.

For a full breakdown of which ISO and quality standards apply to different manufacturing operations, see ISO Standards Required for Manufacturing.

The AS9100 Certification Process

AS9100 certification follows the same two-stage audit structure as ISO 9001, with additional aerospace-specific audit requirements governed by AS9104/1 — the standard that defines how certification bodies must conduct AS9100 audits.

Stage 1 — Documentation Review

The certification body reviews your QMS documentation — the quality manual, procedures, work instructions, and records — against AS9100 requirements. Stage 1 identifies gaps that must be addressed before the Stage 2 audit.

Stage 1 for AS9100 is more rigorous than ISO 9001 Stage 1 because auditors must verify that aerospace-specific documentation is present — FAI procedures, key characteristics identification, counterfeit parts controls, product safety risk processes, and configuration management documentation.

Typical duration: 1–2 days on-site or remote.

Stage 2 — System Audit

The certification body conducts a full on-site audit of your QMS in operation. Auditors evaluate not just whether procedures exist but whether they are being followed, whether records are accurate, and whether the system is producing conforming products.

AS9100 Stage 2 audits routinely include shop floor walkthroughs, review of production records, FAI package review, supplier qualification records, and interviews with operators and inspectors — not just quality and management staff.

Typical duration: 2–5 days depending on organization size and scope.

Surveillance Audits

AS9100 certificates are valid for three years. Annual surveillance audits are required in years 1 and 2. The surveillance audit scope is determined by the certification body but must cover a rotating sample of the certified QMS — it is not a light-touch check-in.

Recertification

A full recertification audit is required in year 3. If your organization is preparing for recertification, treat it with the same rigor as the initial certification audit — auditors are looking at three years of records, trends, and management review history.

AS9100 Certification Costs

AS9100 certification is more expensive than ISO 9001 certification — the audit is longer, the audit requirements are more stringent, and IAQG-accredited auditors command a premium over general ISO 9001 auditors.

Typical Cost Ranges (2026)

Cost Category	Small Org (under 50 employees)	Mid-Size Org (50–250 employees)	Large Org (250+ employees)
Standard purchase (AS9100D)	~$200	~$200	~$200
Gap assessment	$3,000–$8,000	$8,000–$20,000	$20,000–$40,000
Implementation (internal)	$15,000–$40,000	$40,000–$100,000	$100,000–$250,000+
Consultant (if used)	$10,000–$25,000	$25,000–$60,000	$60,000–$150,000+
Stage 1 + Stage 2 audit	$8,000–$15,000	$15,000–$30,000	$30,000–$60,000+
Annual surveillance audits	$4,000–$8,000/yr	$8,000–$15,000/yr	$15,000–$30,000/yr

These are ranges, not quotes. The single biggest cost variable is internal labor — the hours your quality team, engineers, and production personnel spend on implementation. Organizations that underestimate internal labor consistently run over budget.

Factors That Drive Cost Up

Multiple sites — each site requires separate audit coverage
Complex scope — machining, welding, special processes, and NDT all require additional audit time
Low starting point — organizations with no formal QMS pay significantly more for implementation than those building on an existing ISO 9001 system
Special processes — welding, heat treatment, plating, NDT, and similar processes require specific procedure documentation and personnel qualification records that take significant time to build

The ROI Case

AS9100 certification pays for itself through contract access. A single aerospace contract that requires AS9100 certification — and that your organization could not pursue without it — typically exceeds the full cost of certification in revenue. The question is rarely whether AS9100 is worth the cost. The question is whether your organization is positioned to win the contracts that certification unlocks.

For a full cost breakdown with calculator, see ISO Certification Cost Calculator.

IA9100 — The Upcoming Revision

This is the most important current development in aerospace quality management that every AS9100-certified organization should be tracking.

Timeline infographic showing the anticipated transition from AS9100 Rev D to IA9100, including development activities beginning in 2022, a target publication date of 2026, a 2 to 3 year transition period, and expected industry adoption by 2028 to 2029. — This roadmap illustrates the expected evolution from AS9100 Rev D to IA9100 and highlights the key milestones aerospace organizations should monitor as the next generation aerospace quality standard develops.

The IAQG is developing the next revision of AS9100, which will be published under the new name IA9100. Beginning in 2022, IAQG adopted a new global naming convention — all new standards and revisions now use the “IA” prefix rather than the regional designations (AS9100 for Americas, EN9100 for Europe, JISQ9100 for Asia/Pacific). IA9100 will be a single unified global document, replacing all three regional versions simultaneously.

Why the Timing Matters

IA9100 is being developed in parallel with ISO 9001:2026, which is scheduled for publication in Q3 2026. This is intentional — AS9100 and its successor IA9100 incorporate ISO 9001 text verbatim, so IA9100 cannot be finalized until ISO 9001:2026 is published. ISO 9001:2026 is expected to introduce updates to risk-based thinking, change management, and sustainability considerations — all of which IA9100 must incorporate. The IAQG has indicated a 2026 release target for IA9100 to coincide with the ISO 9001:2026 publication.

For organizations already certified to AS9100 Rev D, the verbatim inclusion of ISO 9001 text in IA9100 means continuity — not a complete rewrite. The QMS foundation you build today carries forward. The changes will be additive, not a teardown.

Timeline

Milestone	Timing
IAQG new naming convention adopted	2022
IA9100 development begins	2022
ISO 9001:2026 target publication	Q3 2026
IA9100 target publication	2026 (aligned with ISO 9001:2026)
Transition window (historical precedent)	2–3 years after publication

What This Means for Your Organization

Organizations currently certified to AS9100 Rev D do not need to do anything differently today. Rev D remains the valid and active standard. Certification bodies are still issuing AS9100 Rev D certificates.

What you should do:

✅ Continue pursuing or maintaining AS9100 Rev D certification — there is no reason to wait for IA9100

✅ Begin monitoring IAQG communications for formal transition requirements

✅ Note that the transition window (estimated 2–3 years) gives certified organizations significant time to adapt

⚠️ Do not let IA9100 uncertainty delay certification decisions — the aerospace supply chain is not pausing AS9100 requirements while the revision is finalized

Where to Buy the AS9100 Standard

AS9100 Rev D is an SAE standard distributed through authorized channels. The ANSI Webstore is the authorized U.S. source for SAE standards and serves international buyers with standards available in multiple languages.

→ SAE AS9100D — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026

→ Save up to 50% on ANSI Standard Packages — bundles covering AS9100 with ISO 9001 and related aerospace standards

The ANSI Webstore also offers a SAE AS9100D and ISO 9001 QMS Requirements Set — a bundle that includes AS9100D, ISO 9001:2015, and the ISO 9001 amendment, which is particularly useful for organizations building a combined AS9100/ISO 9001 system or transitioning from ISO 9001 to AS9100.

For a full guide on purchasing from authorized sources, see Where to Buy ISO Standards.

AS9100 Training and Certification Resources

Pursuing AS9100 certification requires trained personnel — internal auditors who understand the aerospace-specific requirements, quality managers who can build and maintain a compliant system, and leadership that understands what AS9100 commitments mean operationally.

Training Options

👉 BSI Group AS9100 Training — BSI Group is one of the most recognized certification bodies globally, offering AS9100 foundation, internal auditor, and lead auditor training. Their training is built around real audit experience and reflects what auditors actually look for.

👉 ISOQAR AS9100 Training — ISOQAR offers ISO-family training courses covering auditor qualifications and QMS implementation. Position alongside BSI as a second training option for your team.

Choosing an AS9100 Certification Body

Only certification bodies accredited under the IAQG’s ICOP (International Certification Organization for OASIS) scheme can issue AS9100 certificates that appear in the OASIS database. Verify any certification body’s ICOP accreditation status directly at ANAB before signing a contract — this is non-negotiable. A certificate from a non-ICOP certification body does not satisfy prime contractor requirements.

Major ICOP-accredited certification bodies include BSI Group, Bureau Veritas, DNV, Intertek, DEKRA, NQA, Perry Johnson Registrars, and SGS. For a ranked comparison of certification bodies, see Best ISO Certification Bodies.

AS9100 Implementation Checklist

Before your Stage 1 audit, verify these aerospace-specific elements are in place:

✅ Product safety risk assessment documented and integrated into operations

✅ Counterfeit parts prevention procedure — procurement, receiving, and storage controls

✅ Configuration management procedure covering design baseline, changes, and deviations

✅ Key characteristics identified on drawings and linked to control plans

✅ First Article Inspection (FAI) procedure referencing AS9102

✅ Human factors considered in work instruction and process design

✅ Special process controls — welding procedures, heat treatment specs, NDT procedures, qualified personnel records

✅ Supplier qualification records for all external providers supplying safety-critical items

✅ OASIS registration completed after certification

✅ Internal auditors trained to AS9100 Rev D requirements — not just ISO 9001

Download the Free AS9100 Rev D Gap Assessment Checklist

Knowing the requirements is one thing. Knowing where your organization actually stands against them is another.

The AS9100 Rev D Gap Assessment Checklist gives you a structured, clause-by-clause evaluation of your current QMS across 74 requirements and 12 sections — including the four AS9100-specific areas that generate the majority of first-time audit failures:

Product safety (Clause 8.1.1)
Counterfeit parts prevention (Clause 8.1.4)
Configuration management (Clause 8.1.3)
Key characteristics (Clause 8.1.2)

Mark each item YES, PARTIAL, or NO. The scoring guide tells you exactly where you stand and what to prioritize before you invest in certification.

It takes under 45 minutes and is completely free.

👉 Download the AS9100 Rev D Gap Assessment Checklist

AS9100 Rev D gap assessment checklist showing aerospace quality management requirements, audit readiness evaluation, and certification preparation for aerospace manufacturers and suppliers. — Use an AS9100 Rev D gap assessment checklist to identify quality management system weaknesses before your certification audit.

Frequently Asked Questions

What is AS9100 certification?

AS9100 certification is formal third-party verification that an organization’s quality management system meets the requirements of AS9100 Rev D — the aerospace industry quality standard. Certification is issued by IAQG-accredited certification bodies and results in registration in the OASIS database, which prime contractors use to verify supplier qualification.

What is the difference between AS9100 and ISO 9001?

AS9100 Rev D includes all ISO 9001:2015 requirements plus approximately 105 aerospace-specific additions covering product safety, counterfeit parts prevention, configuration management, key characteristics, first article inspection, and human factors. Organizations certified to AS9100 automatically satisfy ISO 9001 requirements. ISO 9001 certification alone does not satisfy AS9100 requirements.

What does AS9100 Rev D mean?

Rev D indicates the fourth major revision of the AS9100 standard. AS9100 was first published in 1999 (Rev A), revised in 2001 (Rev B), 2004 (Rev C), and 2016 (Rev D). Rev D is the current active edition and the only version accepted for certification. A new revision — to be rebranded as IA9100 — is expected in late 2026.

How long does AS9100 certification take?

Organizations with no existing QMS typically require 12–24 months to implement AS9100 and achieve certification. Organizations with an existing ISO 9001 system can often achieve AS9100 certification in 6–12 months, depending on the gap between their current QMS and AS9100’s aerospace-specific requirements. See How Long Does ISO Certification Take for a phase-by-phase timeline breakdown.

Do I need AS9100 if I already have ISO 9001?

ISO 9001 is the foundation of AS9100 — but it is not a substitute. If your aerospace customers or contracts require AS9100 certification, ISO 9001 alone does not satisfy that requirement. The aerospace-specific requirements in AS9100 (product safety, counterfeit parts, configuration management, FAI, key characteristics) are not addressed in ISO 9001.

What is OASIS and why does it matter?

OASIS (Online Aerospace Supplier Information System) is the global database of AS9100, AS9110, and AS9120 certified organizations maintained by the IAQG. Prime contractors use OASIS to verify that suppliers hold valid certification from an ICOP-accredited certification body. Only certification bodies operating under ICOP accreditation can register certifications in OASIS. A certificate from a non-ICOP body does not appear in OASIS and does not satisfy prime contractor supplier qualification requirements.

What is IA9100 and when will it replace AS9100?

IA9100 is the next revision of the AS9100 aerospace quality management standard, developed by the IAQG. Beginning in 2022, IAQG adopted a new global naming convention — all new standards and revisions now use the “IA” prefix. IA9100 is being developed in parallel with ISO 9001:2026 because IA9100 incorporates ISO 9001 text verbatim and cannot be finalized until ISO 9001:2026 is published. ISO 9001:2026 is expected to introduce updates to risk-based thinking, change management, and sustainability considerations — all of which IA9100 must incorporate. ISO 9001:2026 is scheduled for Q3 2026, and the IAQG has indicated a 2026 release target for IA9100 as well. Once published, organizations will have a formal IAQG-defined transition period — historically 2–3 years — to migrate from AS9100 Rev D. Because IA9100 incorporates ISO 9001 text verbatim, the transition will be additive rather than a complete system rewrite. Both the IAQG and NASA have explicitly stated that organizations should continue certifying to AS9100 Rev D now rather than waiting for IA9100.

How much does AS9100 certification cost?

AS9100 certification costs vary significantly by organization size and complexity. A small organization (under 50 employees) with a limited scope can expect total first-year costs of $30,000–$80,000 including implementation, training, and audit fees. Mid-size organizations typically spend $80,000–$200,000. Annual surveillance audits run $4,000–$15,000 depending on size. See How Much Does ISO Certification Cost for a full breakdown.

📥 Free Resources

👉 ISO 9001 Roadmap
👉 Manufacturing Compliance Checklist
👉 Supplier Quality Checklist
👉 ISO 13485 Gap Assessment Checklist
👉 AS9100 Rev D Gap Assessment Checklist — 74 items across 12 sections, including all AS9100-specific requirements

Not Sure What to Do Next?

🔹 You need the official AS9100 Rev D standard

→ SAE AS9100D — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026

🔹 You want to save buying AS9100 with ISO 9001 and related standards

→ Save up to 50% on ANSI Standard Packages — AS9100D and ISO 9001 bundle available

🔹 You’re ready to pursue AS9100 certification

→ BSI Group AS9100 Certification

🔹 You need AS9100 training for your quality team

→ BSI Group AS9100 Training

→ ISOQAR ISO Training Courses

🔹 You want to understand how AS9100 compares to ISO 9001

→ ISO 9001 vs IATF 16949 — covers the ISO 9001 vs industry-specific standard comparison framework

→ ISO 9001 Certification Guide

🔹 You want to understand certification costs before committing

→ How Much Does ISO Certification Cost?

→ ISO Certification Cost Calculator

🔹 You need a certification body recommendation

→ Best ISO Certification Bodies

🔹 You want to understand implementation timelines

→ How Long Does ISO Certification Take?

→ ISO Implementation Timeline for Manufacturers

AS9100 Is the Standard. The Question Is When.

If your organization is in aerospace, defense, or aviation manufacturing — or wants to be — AS9100 certification is not a question of if. It is a question of when and how to get there efficiently.

The organizations that struggle with AS9100 are almost always the ones that treat it as a documentation project rather than a genuine quality system. The organizations that pass their first audit without major findings are the ones that understand the standard’s intent — that in aerospace, quality failures are not defects you rework or customer complaints you manage. They are incidents with consequences that cannot be reversed.

At The Standards Navigator, AS9100 and the broader aerospace compliance landscape are covered in depth — from the standard itself to implementation strategy, audit preparation, and certification body selection.

👉 Get updates on aerospace quality standards, implementation guidance, and compliance insights delivered directly.

👉 Be first to access new AS9100 guides, tools, and checklists as they publish.

Subscribe below to stay ahead.

ISO 14001, ISO 9001, and ISO 45001 Transition (2026) Guide

ISO 14001:2026 is published. ISO 9001:2026 arrives in September. ISO 45001:2027 has its DIS ballot open. Three major management system standard revisions landing within 18 months of each other — what the changes mean, why the overlapping transition deadlines create a planning problem most manufacturers haven’t solved yet, and four actions to take now before the window tightens.

Three major management system standards are revising within three years of each other. What manufacturers need to plan for now — before the window gets tight.

Last Updated: July 2026

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

📋 Free Download: Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all systems.

Three Standards. Three Transition Clocks. One Planning Problem Most Manufacturers Haven’t Solved Yet.

In heavy industrial manufacturing, the worst compliance situations are rarely the ones that arrive without warning. They’re the ones where the warning was visible months in advance — and nobody acted on it because each individual deadline felt manageable on its own.

That’s the situation most manufacturers managing ISO 9001, ISO 14001, and ISO 45001 certifications are in right now.

ISO 14001:2026 published in April 2026. ISO 9001:2026 is expected in September 2026 — the FDIS ballot closes July 9, 2026, the last formal checkpoint before publication. ISO 45001:2027 has its DIS ballot open as of March 2026, with publication expected mid-2027. Three major management system standard revisions landing within roughly 18 months of each other.

Each one individually is manageable. Each one comes with a three-year transition period. Each one, evaluated in isolation, looks like something you can handle when the time comes.

The problem is they’re not arriving in isolation. For manufacturers running integrated management systems — or running three separate QMS, EMS, and OH&S programs that share auditors, procedures, and personnel — the transition timelines overlap in a way that most planning cycles haven’t accounted for.

This article covers the timeline, what’s changing in each standard, and four actions to take now before the window tightens.

In This Guide

The current status and timeline for all three standard revisions
What is changing in ISO 14001:2026 — the key updates
What is expected in ISO 9001:2026 — the FDIS direction
What is emerging in ISO 45001:2027 — early DIS signals
The integrated management system advantage in a triple transition
Four actions to take now before the transition window tightens
Decision-stage guidance for organizations at different points in their certification journey

Start Here (Top Resources)

🔖 Get ISO 14001:2026 → ANSI Webstore — ANSI is the official U.S. distributor of ISO standards, ensuring you receive the controlled, compliant version required for certification audits. Use coupon CC2026 for 5% off.

🔖 Train your team on ISO 14001, ISO 9001, and ISO 45001 → BSI Group — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

🔖 Build compliant management system documentation → 9001Simplified — 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

🔖 Pursue or maintain ISO certification → ISOQAR — ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

Browse the Standards Library or explore standards by compliance area to identify which standards apply to your organization.

The Triple Transition Timeline

Infographic timeline comparing ISO 14001:2026, ISO 9001:2026, and projected ISO 45001:2027 revisions, including publication dates and expected certification transition deadlines through 2030. — The Triple Transition Timeline illustrates how ISO 14001, ISO 9001, and ISO 45001 revisions are unfolding between 2026 and 2030, helping organizations plan integrated management system updates.

Standard	Current Version	New Version	Publication	Transition Deadline
ISO 14001	ISO 14001:2015	ISO 14001:2026	April 2026 ✓ Published	April 2029 (expected)
ISO 9001	ISO 9001:2015	ISO 9001:2026	September 2026 (FDIS submitted)	September 2029 (expected)
ISO 45001	ISO 45001:2018	ISO 45001:2027	2027 (DIS stage — TBC)	~2030 (projected)

Three-year transition periods mean organizations have time — but not unlimited time. The clock on ISO 14001 started in April 2026. The ISO 9001 clock starts in September. ISO 45001 follows in 2027, though no confirmed publication date has been issued.

Sources: BSI Group and SGS confirm September 2026 as the ISO 9001:2026 publication target.

For an organization managing all three certifications, the transition window runs from now through approximately 2030. That sounds comfortable until you factor in what transition actually requires: gap analysis against each new standard, internal audit updates, procedure revisions, management review inputs, and surveillance audits that will eventually evaluate the new requirements.

⚠️ Certification bodies must be trained and accredited to new standards before they can issue certificates. For ISO 9001:2026, GACI accreditation guidance will be issued after publication — based on typical 9–12 month accreditation cycles, Q3 2027 is a reasonable industry projection for first certificates, though no confirmed date has been issued. Plan your transition timeline around certification body readiness, not just publication dates.

ISO 14001:2026 — What Changed

ISO 14001:2026 published in April 2026 — the first revision since 2015. The revision builds on the 2024 climate change amendment (ISO 14001:2015/Amd 1:2024) and goes further in several areas that matter for manufacturing operations.

Climate change is now fully embedded. The 2024 amendment required organizations to consider climate change in their environmental management systems. ISO 14001:2026 integrates that requirement more deeply — climate-related risks and opportunities are now explicitly part of the planning and risk management process, not an optional consideration.

Life-cycle perspective is strengthened. Environmental aspects must now be assessed more holistically across the product life cycle — from raw material sourcing through end-of-life disposal. For manufacturers, this means environmental assessment can no longer stop at the facility gate. Upstream supplier impacts and downstream customer use are in scope.

Biodiversity and pollution prevention are more explicit. The revision sharpens language around pollution prevention, resource use efficiency, and biodiversity considerations. Organizations in industries with direct environmental footprints — coatings, fabrication, chemical processing — will see more specific audit scrutiny in these areas.

Planning clauses are reorganized. The structure around risks, opportunities, and change management is clearer in the 2026 version. For organizations that have always treated environmental risk management as a compliance checklist rather than a genuine planning input, this is the revision that makes that gap visible.

At this point, most EHS managers should: → Pull your current ISO 14001:2015 environmental aspects register and evaluate it against the life-cycle and climate requirements of the 2026 revision. If your aspects assessment stops at your facility boundary, it needs to be expanded. Get ISO 14001:2026 from ANSI Webstore — use CC2026 for 5% off. ANSI is the official U.S. distributor of ISO standards, ensuring you receive the controlled, compliant version required for certification audits.

📋 Free Download: Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all systems.

ISO 9001:2026 — What’s Coming

ISO 9001:2026 infographic highlighting upcoming quality management system changes including quality culture, ethical leadership, risk and opportunity management, supply chain resilience, and the 2026 to 2029 transition timeline. — ISO 9001:2026 builds on the existing framework while introducing stronger expectations for quality culture, ethical leadership, risk management, and supply chain resilience.

ISO 9001:2026 is not published yet — ISO/FDIS 9001 reached stage 50.20 as of April 2026, confirming the FDIS ballot has been initiated — confirmed on ISO’s official standards page and reported by DQS Global, a DAKKS-accredited certification body. ⚠️ The ballot closes July 9, 2026. Only editorial changes are possible after that point — the technical content of ISO 9001:2026 is effectively locked. The direction is clear enough to plan against.

The revision is evolutionary, not revolutionary. The core Annex SL structure remains. Clause numbering stays intact. Organizations certified to ISO 9001:2015 are not facing a rebuild — they’re facing a targeted update.

Quality culture and ethical conduct are new emphasis areas. The 2026 version introduces more explicit expectations around leadership’s role in establishing a culture of quality — not just documenting a quality policy, but demonstrating that quality values are embedded in how the organization operates. Ethical conduct and integrity within leadership are specifically called out.

Risk and opportunity management is sharpened. Risks and opportunities are expected to be addressed more distinctly in the 2026 version — with clearer guidance on how each is identified, evaluated, and acted upon. Organizations that have treated Clause 6.1 as a one-time planning exercise rather than an ongoing process will find the 2026 expectations more demanding.

Supply chain resilience enters the picture. The disruptions of recent years are reflected in 2026’s increased emphasis on supply chain management and organizational resilience. Clause 8.4 language around external providers is expected to be more specific about resilience and continuity considerations.

The transition timeline is specific. Publication in September 2026 triggers a three-year transition period — organizations will need to be certified to ISO 9001:2026 by September 2029. First certificates will follow — certification bodies must complete training and receive accreditation guidance from GACI after publication. Based on typical 9–12 month accreditation cycles, Q3 2027 is a reasonable industry projection, though no confirmed date has been issued.

If you are currently implementing ISO 9001:2015 for the first time → Proceed. Your 2015 certificate remains valid through September 2029 and the transition to 2026 is not a rebuild. The ISO 9001 Implementation Roadmap covers the full 5-phase process from gap assessment to Stage 2 audit clearance.

➡️ BSI Group ISO 9001 and ISO 14001 Training — Transition training for ISO 9001:2026 and ISO 14001:2026 covering gap analysis, new requirements, and audit preparation. BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

ISO 45001:2027 — Early Signals

ISO 45001:2027 is the furthest out — but the revision entered the DIS stage in early 2026, and the direction of the revision is visible in the committee draft material. Publication is expected mid-2027, with a three‑year transition period expected, likely running through 2030.

Worker wellbeing expands beyond physical safety. The current ISO 45001:2018 standard focuses on occupational health and safety in a traditional sense. The 2027 revision explicitly expands scope to include psychosocial hazards — stress, burnout, workplace violence, mental health — as core OH&S considerations. This is a meaningful shift for manufacturers whose safety programs have focused primarily on physical hazard controls.

Climate change is integrated as an OH&S requirement. Climate-related risks — heat stress, extreme weather events, air quality impacts — are being incorporated into the OH&S risk framework. For operations in industries with outdoor or climate-exposed work environments, this will require new hazard identification and control measures.

New working models are addressed. Remote work, hybrid arrangements, and contractor-heavy operations are explicitly considered in the 2027 revision. The definition of “workplace” is expanding, and with it, the scope of OH&S responsibility.

Leadership accountability is stronger. Management’s active role in safety culture — not just policy sign-off — is a recurring theme across the 2027 draft. The expectation is demonstrable leadership engagement, not just documented commitment.

ESG and supply chain responsibility. The revision extends OH&S considerations to the supply chain, consistent with the direction ISO 9001:2026 and ISO 14001:2026 are also taking. For manufacturers with complex supplier networks, this creates new audit scope.

The Common Thread Across All Three

Reading the three revisions together, a consistent direction emerges — and it matters for how organizations approach transition planning.

All three standards are moving from compliance to performance. The 2026/2027 revisions across quality, environmental, and safety management systems reflect a shared expectation: that management systems demonstrate real outcomes, not just documented processes. Certification bodies auditing against these revised standards will be looking for evidence of genuine system effectiveness, not procedure compliance.

All three embed climate and sustainability more explicitly. ISO 14001:2026 integrates climate requirements into its planning clauses. ISO 9001:2026 adds resilience and supply chain sustainability language. ISO 45001:2027 adds climate-related OH&S risks. Organizations that have managed these as separate environmental compliance obligations are going to find them converging into a single integrated requirement set.

All three strengthen leadership expectations. Quality culture in ISO 9001:2026, environmental leadership in ISO 14001:2026, safety culture in ISO 45001:2027. Leadership’s role is not just policy ownership — it’s demonstrated behavioral commitment. That is an audit finding waiting for organizations whose top management signs off on policy documents but isn’t visible in the management system.

All three align with the updated Annex SL high-level structure. This means integration across the three standards is structurally easier in the revised versions than it was in the 2015/2018 versions. For organizations running integrated management systems, the 2026/2027 revisions are actually an opportunity — the common structure means a single integrated gap assessment covers significant ground across all three.

The Integrated Management System Advantage

Integrated Management System diagram showing ISO 9001, ISO 14001, and ISO 45001 overlap for quality, environmental, and safety management — A visual representation of how ISO 9001, ISO 14001, and ISO 45001 integrate into a single management system to improve quality, environmental performance, and workplace safety.

Organizations managing ISO 9001, ISO 14001, and ISO 45001 as separate programs face the triple transition as three independent projects. Organizations managing them as an integrated management system (IMS) face it as one.

The practical difference is significant. An IMS shares a single management review process — one review covers QMS, EMS, and OH&S inputs and outputs. It shares an internal audit program — one audit cycle covers all three standards. It shares document control, training records, and corrective action systems. When revisions land, an IMS organization updates one system. A siloed organization updates three.

The 2026/2027 revisions accelerate this advantage because of the common thematic direction across all three standards. A gap analysis that covers climate integration, leadership requirements, and supply chain scope serves all three transitions simultaneously. A management review that adds resilience and sustainability performance inputs serves ISO 9001, ISO 14001, and ISO 45001 at the same time.

If your organization manages the three standards in separate programs, the triple transition is a legitimate reason to evaluate IMS consolidation now — not because it’s required, but because the administrative burden of three independent transition projects under overlapping deadlines is the kind of thing that creates compliance gaps.

Approach	Gap Analysis	Internal Audit	Management Review	Procedure Updates	Transition Risk
Siloed programs	3 separate assessments	3 separate cycles	3 separate reviews	3 separate update projects	High — deadline convergence
Integrated IMS	1 integrated assessment	1 combined cycle	1 combined review	1 coordinated update	Lower — shared infrastructure

Four Actions to Take Now

Infographic outlining four actions organizations should take now to prepare for ISO 14001:2026, ISO 9001:2026, and ISO 45001 transition requirements, including gap assessments, audit planning, management review evaluation, and internal audit integration. — Four practical actions organizations can take today to prepare for upcoming ISO 14001, ISO 9001, and ISO 45001 transition requirements and avoid last-minute certification challenges.

1. Get ISO 14001:2026 and run a gap assessment against your current EMS.

The clock is running on ISO 14001. Your 2015 certification remains valid through approximately April 2029 — but the gap assessment takes time, procedure updates take time, and your surveillance audit schedule may not align with your ideal transition timeline. Start the gap assessment now while you have room to plan. Get the standard from ANSI Webstore — use CC2026 for 5% off.

For the full ISO 9001:2026 transition timeline including certification body accreditation milestones, 9001Simplified’s revision guide is the most detailed publicly available planning reference.

2. Map your surveillance audit schedule against the transition deadlines.

Your certification body will eventually conduct a transition audit for each standard. Knowing when your next surveillance audit is scheduled — and whether it falls before or after each publication date — tells you when you need to have your transition work complete. A surveillance audit in early 2027 for ISO 14001 means your 14001 transition needs to be done before that visit, not by 2029.

3. Evaluate your management review process against the new common requirements.

Climate change, resilience, supply chain performance, and leadership accountability are showing up across all three revisions. Adding these as management review inputs now — before the standards require it — positions your organization to demonstrate proactive compliance rather than reactive scrambling. It also means your management review minutes start building a record of these considerations before your first transition audit.

4. Consolidate your internal audit program if you haven’t already.

If you’re running separate audit cycles for quality, environmental, and safety, consider whether an integrated audit program would serve all three transitions more efficiently. A single annual audit cycle that covers ISO 9001, ISO 14001, and ISO 45001 in one planned program gives you a single update project when the revised standards require audit checklist changes. It also means your internal auditors need transition training once, not three times.

At this point, most operations and EHS managers overseeing all three certifications should: → Start with the Manufacturing Compliance Checklist — it covers ISO 9001, 14001, 45001 and OSHA across 50 items with gap scoring. It gives you a current-state baseline across all three systems before you invest in transition-specific gap analysis tools.

Why Organizations Delay Transition Planning

“We have until 2029 — there’s no urgency.”

The three-year transition period is real. The urgency is not about the deadline — it’s about the gap between when a transition deadline is announced and when certification bodies can actually audit against the new standard. For ISO 9001:2026, first certificates aren’t expected until Q3 2027 at the earliest, because certification bodies need 9–12 months after publication to complete training and accreditation. If your next ISO 9001 surveillance audit falls in late 2027, you may be audited against the 2026 standard whether you planned for it or not.

“Each transition is manageable — we’ll handle them one at a time.”

Handling ISO 14001:2026 now, ISO 9001:2026 in late 2026, and ISO 45001:2027 in 2027–2028 as three sequential projects is a reasonable approach — if your internal audit program, management review schedule, and quality personnel capacity can absorb three consecutive transition projects. Organizations with lean QMS teams consistently discover that sequential transition management creates a permanent state of transition, where the team finishes one standard’s update cycle and immediately starts the next. Integrated planning reduces that burden significantly.

“We don’t know enough about ISO 9001:2026 and ISO 45001:2027 yet to plan.”

You know enough. The FDIS direction for ISO 9001:2026 is clear — quality culture, ethics, resilience, supply chain. The DIS signals for ISO 45001:2027 are clear — wellbeing, climate, new working models, leadership accountability. Waiting for final publication to start thinking about these themes means your gap assessment starts at zero when the standard publishes. Starting now means your gap assessment starts from a position of partial readiness.

Frequently Asked Questions

Do I need to transition all three standards at the same time?

No — each standard has its own transition deadline and you can manage them sequentially. The case for coordinated planning is efficiency, not obligation. ISO 14001:2026 is already published, so that transition clock is running. ISO 9001:2026 publishes in September 2026. ISO 45001:2027 publishes mid-2027. Three separate deadlines — but organizations that plan them together avoid three separate periods of transition disruption.

Will my current certifications become invalid when the new standards publish?

No. Your current ISO 9001:2015, ISO 14001:2015, and ISO 45001:2018 certificates remain valid through their respective transition deadlines — approximately 2029, 2029, and 2030. You do not need to take immediate action on certification. You do need to plan for transition before those deadlines.

What is the transition period for ISO 14001:2026?

The transition period is expected to be three years from publication — approximately April 2029. Your certification body will confirm the exact transition deadline once IAF guidance is issued. Plan against April 2029 as the working assumption.

When will certification bodies start auditing against ISO 9001:2026?

Not immediately after publication. Certification bodies must complete training and accreditation to the new standard — a process that typically takes 9–12 months. First ISO 9001:2026 certificates are not expected until at least Q3 2027. This means organizations pursuing ISO 9001 certification for the first time should implement ISO 9001:2015 now — it remains the auditable standard through the transition period.

What does the ISO 45001:2027 revision mean for manufacturers with mostly physical hazard environments?

The 2027 revision expands OH&S scope to include psychosocial hazards and climate-related risks — which will require manufacturers to broaden their hazard identification processes. For facilities with outdoor operations, heat stress and extreme weather become OH&S planning inputs. For all facilities, psychosocial hazard assessment becomes an expected element of the risk identification process.

Should we pursue an integrated management system before the triple transition?

If your organization manages ISO 9001, ISO 14001, and ISO 45001 as separate programs, the triple transition is a legitimate trigger to evaluate IMS consolidation. It is not required — but the efficiency gains during three overlapping transition projects are real. The decision depends on your internal resource capacity and how much administrative redundancy your current siloed programs create. BSI Group offers integrated management system training that covers all three standards simultaneously. BSI Group training — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

What are the key changes in ISO 14001:2026 for manufacturers?

Climate change fully embedded in planning requirements, life-cycle perspective extended beyond facility boundaries, stronger biodiversity and pollution prevention language, and reorganized planning clauses around risks and opportunities. For manufacturers in industries with direct environmental footprints — coatings, fabrication, chemical processing — the life-cycle and climate requirements are the most operationally significant changes.

Do ISO 9001:2026 and ISO 45001:2027 change the Annex SL structure?

No. All three revised standards maintain the Annex SL high-level structure — the common clause framework that enables integrated management systems. This is by design: ISO intends the common structure to make multi-standard integration easier, and the 2026/2027 revisions maintain that compatibility.

Free Resources

📋 Free Download: Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all systems.

📋 Free Download: Supplier Quality Checklist — ISO 9001 Clause 8.4 — all supplier controls auditors evaluate, 45 items with scoring.

📋 Free Download: ISO 9001 Implementation Roadmap — The exact 5-phase process from gap assessment to Stage 2 audit clearance.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Not Sure What to Do Next?

→ You need ISO 14001:2026 now → ANSI Webstore — Use CC2026 for 5% off. ANSI is the official U.S. distributor of ISO standards.

→ You need to train your team on the revised standards → BSI Group Training — ISO 14001, ISO 9001, and ISO 45001 transition training available. BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses.

→ You need to build or update management system documentation → 9001Simplified Documentation Kits — ready-to-use documentation kits for ISO 9001, 14001, and integrated management systems.

→ You are ready to pursue or maintain ISO certification → ISOQAR — UKAS-accredited, one of the most recognized certification bodies in the industry.

→ You need to understand what changed specifically in ISO 14001:2026 → What’s New in ISO 14001:2026

→ You need a current-state baseline across all three systems → Manufacturing Compliance Checklist — free, 50 items covering ISO 9001, 14001, 45001 and OSHA.

→ You need to understand ISO 9001 implementation from the ground up → ISO 9001 Implementation Roadmap

→ You want to understand how ISO 9001 and ISO 14001 relate to each other → explore standards by compliance area

→ You want to browse all manufacturing standards in one place → Standards Library

Still figuring out where to start?

The best first step for most organizations managing all three certifications: → Download the free Manufacturing Compliance Checklist — 50 items across ISO 9001, 14001, 45001 and OSHA with gap scoring. It gives you a current-state picture across all three systems in 20 minutes, before you spend anything on transition planning.

📋 Free Download: Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all systems.

The Window Is Open. It Won’t Stay That Way.

Three-year transition periods create the illusion of distance. They don’t.

The organizations that handle standard transitions well are not the ones that wait for the final published standard and then scramble to close gaps. They’re the ones that track the direction of the revision, run a preliminary gap assessment while the draft is still in ballot, update management review inputs before the standard requires it, and arrive at their first transition audit with documented evidence of preparation — not a stack of recently revised procedures.

ISO 14001:2026 is published. The ISO 9001:2026 FDIS is in ballot. The ISO 45001:2027 DIS ballot is open. All three revision directions are clear enough to plan against right now.

For manufacturers running all three certifications, the planning decision isn’t whether to prepare. It’s whether to prepare for one integrated transition or three sequential ones.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

ISO 13485 Documentation Requirements (2026)

Every document and record ISO 13485 requires — with clause references, document control requirements under Section 4.2, record retention rules, how QMSR changed the documentation landscape, and the seven gaps auditors find most consistently. Built as a reference document quality managers can use before their next audit.

Every document your QMS must have, what auditors check first, and why the gaps between your procedures and your records are where most findings live.

Last Updated: May 2026

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

The Binder on the Shelf Is Not a QMS

Years ago, working in a nuclear component facility, I watched a certification audit go sideways in the first thirty minutes. The quality manager had spent six months building what looked like a complete quality management system — binders, procedures, forms, the works. The auditor asked to see the document register. The quality manager pointed to the binder. The auditor asked how documents were controlled at the point of use. The quality manager pointed to the binder again.

The binder was the system. It sat on a shelf in the quality office. The machinists on the floor had printed copies of procedures from three years prior. Nobody had a current revision of anything. The audit did not go well.

ISO 13485 documentation is not about having paperwork. It is about having the right documents, in the right format, accessible to the right people, at the right time — and being able to prove all of that during an audit. The standard is specific about what must be documented, what must be retained as records, and what that documentation must demonstrate.

Under QMSR, which took effect February 2, 2026, FDA now evaluates ISO 13485 documentation requirements against the framework directly. Organizations that treat documentation as a filing exercise rather than a quality system function are finding that gap at inspection.

This article covers every documentation requirement ISO 13485 imposes, where auditors look first, and what a compliant documentation system actually looks like in practice.

In This Guide

The difference between documents and records under ISO 13485 — and why it matters for audits
Every mandatory document the standard requires
Every mandatory record the standard requires
Document control requirements under Section 4.2
Record retention rules under Section 4.2.5
The most common documentation gaps auditors find
How QMSR changed the documentation landscape for U.S. medical device manufacturers
Decision-stage guidance for organizations at different points in their documentation journey

Start Here (Top Resources)

🔖 Get ISO 13485:2016 → ANSI Webstore — ANSI is the official U.S. distributor of ISO standards, ensuring you receive the controlled, compliant version required for certification audits. Use coupon CC2026 for 5% off.

🔖 Build compliant QMS documentation → 9001Simplified — 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

🔖 Train your team on ISO 13485 documentation requirements → BSI Group — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

🔖 Pursue or maintain ISO 13485 certification → ISOQAR — ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

Browse the What Is ISO 13485? pillar article for full clause context, or use the ISO 13485 Gap Assessment Checklist to identify your specific documentation gaps before your next audit.

Documents vs. Records: The Distinction That Drives Compliance

ISO 13485 treats documents and records as separate categories with different requirements. Confusing them is one of the most consistent sources of documentation findings in surveillance audits.

Documents are instructions, procedures, specifications, and plans — the things that tell people what to do. They are living documents: they can be revised, updated, and superseded. Section 4.2.4 governs their control.

Records are evidence that something was done — completed forms, test results, inspection reports, calibration data, training sign-offs. They are fixed in time: once a record is created, it cannot be altered without creating a documented amendment. Section 4.2.5 governs their control.

The practical distinction matters for two reasons. First, the control requirements differ. Documents need revision control, approval, distribution, and obsolescence management. Records need legibility, identification, storage protection, retrieval, and defined retention periods. A documentation system that applies the same controls to both will have gaps in one or the other.

Second, auditors evaluate them separately. When an auditor asks for a procedure, they are asking for a document. When they ask for evidence, they are asking for a record. Handing an auditor a completed form when they asked for a procedure — or a procedure when they asked for evidence — signals a documentation system that does not understand its own structure.

At this point, most quality managers building or auditing a documentation system should: → Map your document inventory against your record inventory separately. If your document register includes completed forms alongside controlled procedures, your system architecture has a structural problem. 9001Simplified’s documentation kits include pre-structured document and record registers built for ISO 13485 compliance. 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

Mandatory Documents Under ISO 13485

ISO 13485 requires specific documented procedures and plans across multiple clauses. These are not optional — certification bodies audit for their existence and their content.

ISO 13485 documentation infographic illustrating mandatory quality management system documents with interconnected process icons for quality manuals, risk management, design planning, procedures, records retention, purchasing controls, and document control requirements. — Certification bodies expect documented procedures, controlled records, and defined plans that demonstrate the quality system operates consistently and remains audit ready — see the full list in the table below.

Document	Clause	What It Must Cover
Quality Manual	4.2.2	Scope of the QMS, exclusions with justification, documented procedures or references, description of QMS process interactions
Document Control Procedure	4.2.4	Approval, review, revision control, distribution, obsolescence management, external documents
Records Control Procedure	4.2.5	Identification, storage, protection, retrieval, retention periods, disposition
Management Review Procedure	5.6	Inputs, outputs, frequency, documentation requirements
Competence, Training & Awareness Procedure	6.2	How competence is determined, how training is delivered, how competence is evaluated and recorded
Infrastructure Procedure	6.3	Maintenance of buildings, equipment, and supporting services affecting product quality
Work Environment Procedure	6.4	Control of work environment conditions where required for product conformity
Risk Management Procedure	7.1	Risk management process across the product lifecycle, per ISO 14971
Customer-Related Processes Procedure	7.2	Requirements determination, review, and customer communication
Design & Development Procedure	7.3	Planning, inputs, outputs, review, verification, validation, transfer, changes (if design is not excluded)
Purchasing Procedure	7.4	Supplier evaluation, selection, monitoring, and purchasing information
Production & Service Controls Procedure	7.5	Control of production and service provision, cleanliness, installation, and servicing
Identification & Traceability Procedure	7.5.3	Product identification throughout realization and traceability requirements
Customer Property Procedure	7.5.4	Control and safeguarding of customer-supplied product or data
Preservation Procedure	7.5.5	Preservation of product during processing and delivery
Monitoring & Measurement Equipment Procedure	7.6	Calibration, verification, and control of measuring equipment
Feedback Procedure	8.2.1	Post-market surveillance and feedback collection
Complaint Handling Procedure	8.2.2	Complaint receipt, investigation, and regulatory reporting decisions
Internal Audit Procedure	8.2.4	Audit planning, conduct, reporting, and follow-up
Nonconforming Product Procedure	8.3	Identification, segregation, evaluation, and disposition
CAPA Procedure	8.5.2 / 8.5.3	Corrective and preventive action process, including root cause analysis and effectiveness verification

⚠️ If your organization excludes design and development under Clause 7.3, that exclusion must be justified in the Quality Manual and documented. Exclusions without documented justification are a consistent finding in initial certification audits.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Mandatory Records Under ISO 13485

Records are the evidence your QMS operated as documented. The standard specifies which records must be maintained — these are the minimum. Your procedures may require additional records.

Record	Clause	What It Must Demonstrate
Management Review Minutes	5.6.3	Inputs reviewed, decisions made, actions assigned with owners and timelines
Education, Training, Skills & Experience	6.2	Competence evaluated, training completed, results recorded
Infrastructure Maintenance	6.3	Maintenance activities and results for quality-critical equipment
Risk Management Records	7.1	Risk analysis, risk evaluation, risk control, residual risk assessment, post-production monitoring
Customer Requirements Review	7.2.2	Requirements determined and confirmed before commitment
Design & Development Records	7.3	Inputs, outputs, reviews, verifications, validations, transfer, and changes (if not excluded)
Design & Development Changes	7.3.9	Change description, evaluation, verification, validation, approval
Supplier Evaluation Records	7.4.1	Evaluation criteria, results, and re-evaluation decisions
Production Process Validation	7.5.2	Validation protocols, results, equipment qualifications
Traceability Records	7.5.3.2	Unique device identification and traceability through production
Customer Property Records	7.5.4	Receipt, condition assessment, and disposition of customer property
Calibration Records	7.6	Equipment identification, calibration standard, results, next due date
Internal Audit Records	8.2.4	Audit plans, findings, nonconformances, corrective actions, follow-up
Product Monitoring & Measurement	8.2.6	Evidence of conformity and identification of release authority
Nonconforming Product Records	8.3	Nature of nonconformity, disposition decision, concession records if applicable
CAPA Records	8.5.2 / 8.5.3	Root cause analysis, action taken, effectiveness verification with criteria and evidence

➡️ 9001Simplified Documentation Kits — Pre-built ISO 13485 procedures, forms, and record templates covering every mandatory document and record listed above. 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

Document Control: What Section 4.2.4 Actually Requires

Section 4.2.4 sets out seven specific requirements for document control. Each one has a practical implementation implication — and each one is evaluated individually during audits.

1. Documents must be approved before use. Approval must be by authorized personnel. Your document control procedure must define who has approval authority for each document type. A document approved by someone outside that authority — or with no documented approval at all — is a nonconformance.

2. Documents must be reviewed, updated as necessary, and re-approved. Review frequency should be defined in your procedure. Documents that have never been reviewed since initial creation are a finding in surveillance audits — particularly if the regulatory environment or production process has changed.

3. Changes and current revision status must be identified. Every controlled document needs a revision identifier — a number, letter, or date — and your document register needs to reflect current revision status. Auditors check this against what is in use.

4. Relevant versions must be available at points of use. This is the binder-on-the-shelf failure. Current controlled versions must be accessible where work is performed. If people work from printed copies, you need a controlled printing process. If work is performed on a production floor, current procedures must be accessible there — not only in the quality office.

5. Documents must be legible and identifiable. This sounds obvious. It is consistently violated by organizations that allow handwritten annotations, informal updates, or degraded printed copies to remain in service.

6. External documents must be identified and controlled. This includes customer drawings, regulatory guidance documents, referenced standards, and supplier specifications. External documents that affect product quality must be listed in your document control system and their current version verified.

7. Obsolete documents must be prevented from unintended use. Obsolete documents must either be removed from all points of use or clearly marked as obsolete. Finding an active workstation with a superseded procedure is a major nonconformance — regardless of whether anyone was actually using it.

If you are under active FDA inspection pressure → BSI Group ISO 13485 Training covers document control implementation and audit preparation in depth. BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

Record Retention: What Section 4.2.5 Actually Requires

Section 4.2.5 requires that records be retained for a period at least equal to the lifetime of the medical device, but not less than two years from the date of product release by the organization.

That two-year floor is the minimum. In practice, most medical device records should be retained significantly longer:

Implantable devices — the device lifetime may span decades. Records need to match.
Devices with long service lives — the same logic applies.
FDA QMSR requirements — align with ISO 13485 on the two-year minimum but your complaint handling procedure may require longer retention for MDR-related records.
Customer contractual requirements — OEM customers increasingly specify record retention periods in their supplier quality agreements. These requirements take precedence where they are more stringent than the standard’s minimum.

Your records control procedure must define retention periods for each record type. A blanket “two years” policy applied to all records — including design history files and risk management records for long-life devices — is not compliant.

Provider	What You Get	Best For
ANSI Webstore	ISO 13485:2016 official standard	Any organization needing the controlled, compliant version of the standard
9001Simplif i ed	QMS documentation kits with record templates	Organizations building documentation from scratch or rebuilding after a major finding
BSI Group	ISO 13485 training courses	Teams implementing documentation systems or preparing for initial certification
ISOQAR	ISO 13485 certification	Organizations ready to pursue or maintain certification

Most organizations building documentation systems from scratch need all three:

The standard from ANSI Webstore (use CC2026 for 5% off)
Lead implementer training from BSI Group
A documentation kit from 9001Simplified

This combination covers the standard, the knowledge, and the implementation infrastructure.

The Most Common Documentation Gaps

ISO 13485 documentation gaps infographic illustrating seven common audit findings, including outdated document registers, incomplete supplier records, weak CAPA evidence, missing procedures, and disconnected risk management records within medical device quality systems. — Documentation failures rarely appear as isolated findings. They create chains of audit problems across CAPA, supplier controls, training, management review, and risk management. The gap is usually discovered long after it was created.

These are the findings that appear most consistently in ISO 13485 surveillance audits and QMSR inspections. Each one points to a specific procedure or record requirement.

The Quality Manual references procedures that don’t exist. A common initial certification shortcut is writing a Quality Manual that references a full set of documented procedures — then discovering during the surveillance audit that several of those procedures were never finalized. The Quality Manual and the document register must be synchronized.

The document register is not current. Document registers that haven’t been updated in months, that show revision numbers inconsistent with what is in use, or that are missing entire document categories are a consistent finding. The register is the first thing many auditors check.

Risk management records stop at design transfer. ISO 14971 requires risk management across the product lifecycle. Design-phase risk files with no post-production updates — no connection to complaint data, service reports, or CAPA findings — are incomplete regardless of how thorough the original analysis was. See ISO 14971 vs ISO 13485 for the full lifecycle requirement.

CAPA records close without effectiveness verification evidence. A CAPA record that reads “action implemented — problem resolved” with no supporting data is not a closed CAPA — it is an open finding waiting to be issued. For the complete breakdown of what effectiveness verification requires, see CAPA Requirements in ISO 13485.

Supplier qualification records are incomplete or outdated. An approved supplier list without corresponding qualification evidence, or qualification records for suppliers whose scope has changed without requalification, are consistently cited findings under Clause 7.4.

Training records prove attendance, not competence. Sign-off sheets showing who attended a training session are not competence records. The record must show what competence was evaluated, by what method, and what the result was. See Common Mistakes in ISO 13485 QMS for the full breakdown of this finding.

Management review minutes record presentations, not decisions. Minutes that describe what was presented in management review without documenting what was decided are a major finding under Section 5.6.3. Every input reviewed must produce a documented output — a decision, an action, or a rationale for no action.

How QMSR Changed the Documentation Landscape

FDA’s Quality Management System Regulation, effective February 2, 2026, aligns U.S. medical device QMS requirements with ISO 13485:2016. For documentation, the practical changes are significant.

The Device Master Record (DMR) structure is now explicitly required. Under QMSR, the DMR — which must include device specifications, production process specifications, quality assurance procedures, packaging and labeling specifications, and installation and maintenance procedures — is a specific documentation requirement that ISO 13485 certification alone does not fully address.

Complaint files under 21 CFR 820.198 remain a separate requirement. ISO 13485 requires a complaint handling procedure. QMSR additionally requires that complaint files contain specific elements — including the decision on whether the complaint required investigation and, if so, the results of that investigation — that go beyond what most ISO 13485 complaint procedures specify.

MDR procedures must be documented separately. Medical Device Reporting obligations are a regulatory requirement that sits outside ISO 13485 but must be addressed in your QMS documentation under QMSR.

⚠️ FDA QMSR compliance date was February 2, 2026. If your documentation system has not been reviewed against the four QMSR-specific bridge requirements since that date, that review is overdue. The ISO 13485 Gap Assessment Checklist covers all four QMSR bridge requirements explicitly alongside the standard ISO 13485 clause requirements.

For the full regulatory alignment picture, see FDA QSR vs ISO 13485.

Infographic explaining the major operational and regulatory changes introduced under the FDA QMSR, including terminology alignment, expanded risk management, inspection changes, and ISO 13485 document control requirements. — The FDA’s QMSR transition introduced major changes beyond terminology — expanding risk management expectations, changing inspection structure, and aligning medical device quality systems directly with ISO 13485.

Why Organizations Delay Getting Documentation Right

“We’ll clean it up before the surveillance audit.”

This is the most common delay rationalization — and it consistently produces the worst outcomes. Documentation gaps that accumulate over 11 months cannot be credibly remediated in the 30 days before a surveillance visit. Auditors can identify recently created records. A CAPA file dated three weeks before the audit for a problem that complaint data shows has existed for eight months is not evidence of a functioning QMS — it is evidence of audit preparation, which auditors treat as a different category of finding.

“Our documentation was good enough for initial certification.”

Initial certification evaluates documentation at a point in time against a system that was built to be audited. Surveillance audits evaluate whether that system has been maintained — which means they look at records created since the last audit, not at procedures written before it. Organizations that passed initial certification and then stopped maintaining their documentation systems often face multiple major nonconformances at the first surveillance visit.

“We don’t have the internal resources to build this properly.”

This objection is real — but the cost of building documentation properly before certification is substantially lower than the cost of remediation after a major nonconformance. A documentation kit from 9001Simplified covers every mandatory document and record template in a ready-to-use format. 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch. The internal labor required to customize a pre-built kit is a fraction of what is required to build from scratch — and a fraction of what remediation costs after a finding.

Frequently Asked Questions

What documents are required by ISO 13485?

ISO 13485 requires documented procedures covering quality manual, document control, records control, management review, training and competence, risk management, customer requirements, purchasing, production controls, identification and traceability, calibration, feedback, complaint handling, internal audit, nonconforming product, and CAPA. The full list with clause references is in the Mandatory Documents table above.

What records are required by ISO 13485?

ISO 13485 requires records covering management reviews, training and competence evaluations, risk management activities, design and development (if not excluded), supplier evaluations, calibration, internal audits, product monitoring, nonconforming product dispositions, and CAPA activities. The full list with clause references is in the Mandatory Records table above.

How long must ISO 13485 records be retained?

The standard requires retention for at least the lifetime of the device, with a minimum of two years from product release. For implantable devices and devices with long service lives, the retention period is typically longer and should be defined in your records control procedure. FDA QMSR aligns with this minimum but specific record types — particularly MDR-related records — may require longer retention.

Does ISO 13485 require a Quality Manual?

Yes. Section 4.2.2 requires a Quality Manual that defines the scope of the QMS, documents or references procedures, and describes the interactions between QMS processes. The Quality Manual is one of the first documents an auditor requests.

Can we use electronic records to meet ISO 13485 requirements?

Yes — electronic records are acceptable provided your document control system ensures they are controlled, legible, retrievable, and protected from unauthorized modification. Electronic systems used to manage controlled documents must themselves be validated if they affect product quality.

What is the difference between a controlled document and a record under ISO 13485?

A controlled document is an instruction, procedure, or specification that tells people what to do — it can be revised and must be version-controlled. A record is evidence that something was done — it is fixed in time and must be retained according to your records control procedure. Section 4.2.4 governs controlled documents; Section 4.2.5 governs records. The distinction is fundamental to building a compliant documentation system.

Does design and development documentation apply to all medical device manufacturers?

Only if the manufacturer performs design and development activities. If your organization manufactures to customer specifications and does not perform design activities, you may be eligible to exclude Clause 7.3 — but that exclusion must be documented and justified in your Quality Manual. Contract manufacturers who claim a 7.3 exclusion without justification are consistently cited at initial certification.

How do FDA QMSR documentation requirements differ from ISO 13485?

QMSR aligns with ISO 13485 but adds four specific requirements: the Device Master Record structure, complaint files under 21 CFR 820.198, Medical Device Reporting procedures, and corrections and removals procedures. ISO 13485 certification alone does not cover these four requirements. The ISO 13485 Gap Assessment Checklist addresses all four explicitly.

What is the first thing an auditor looks at for ISO 13485 documentation?

Most auditors start with the document register — to verify that controlled documents are listed, revision levels are current, and the register reflects what is actually in use. From there they move to the Quality Manual to verify scope and procedure references. Gaps in either of those two items typically expand the audit’s scope significantly.

Free Resources

📋 Free Download: Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all systems.

📋 Free Download: Supplier Quality Checklist — ISO 9001 Clause 8.4 — all supplier controls auditors evaluate, 45 items with scoring.

📋 Free Download: ISO 9001 Implementation Roadmap — The exact 5-phase process from gap assessment to Stage 2 audit clearance.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Not Sure What to Do Next?

→ You need the official ISO 13485:2016 standard → ANSI Webstore — Use CC2026 for 5% off. ANSI is the official U.S. distributor of ISO standards.

→ You need to build ISO 13485 documentation from scratch → 9001Simplified Documentation Kits — ready-to-use procedures, forms, and record templates for every mandatory document.

→ You need to train your team on documentation requirements → BSI Group ISO 13485 Training — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses.

→ You are ready to pursue ISO 13485 certification → ISOQAR — UKAS-accredited, one of the most recognized certification bodies in the industry.

→ You need to assess your documentation gaps before your next audit → ISO 13485 Gap Assessment Checklist — free, 64 items.

→ You need to understand how QMSR changed your documentation obligations → FDA QSR vs ISO 13485

→ You need to understand CAPA record requirements in depth → CAPA Requirements in ISO 13485

→ You need to understand the most common documentation audit findings → Common Mistakes in ISO 13485 QMS

→ You need to understand how risk management documentation connects to your QMS → ISO 14971 vs ISO 13485

→ You need to understand the full ISO 13485 clause structure → What Is ISO 13485?

→ You want to buy ISO 13485 → Buy ISO 13485

→ You want to browse all medical device standards → explore standards by compliance area

Still figuring out where to start?

If you are not ready to commit to a documentation build yet — that is normal. Most organizations spend several weeks between identifying gaps and starting remediation.

The best next step: → Download the free ISO 13485 Gap Assessment Checklist — it takes 20 minutes and tells you exactly which documents and records you are missing before you spend anything.

Feature image promoting an ISO 13485 Gap Assessment Checklist for medical device manufacturers, contract manufacturers, and component suppliers preparing for certification and FDA QMSR compliance. — ISO 13485 Gap Assessment Checklist designed to help medical device manufacturers identify compliance gaps, prioritize actions, and prepare for certification and FDA QMSR requirements.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

The Binder Is Not the System

Documentation is not ISO 13485’s most technically demanding requirement. But it is the foundation every other requirement rests on. Without controlled documents, procedures cannot be consistently followed. Without records, there is no evidence that procedures were followed at all. Without a document control system that connects what is written to what people actually use, the gap between those two things grows quietly — until an auditor measures it.

The organizations that handle documentation audits well are not the ones with the most sophisticated quality management software or the thickest procedure binders. They are the ones whose documentation reflects how work actually gets done — current, accessible, and connected to the records that prove it.

That alignment takes discipline to build and discipline to maintain. It does not take complexity.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

Subscribe below to stay ahead.

Common Mistakes in ISO 13485 QMS (2026)

Seven ISO 13485 QMS mistakes that consistently produce major nonconformances — document control drift, management review gaps, supplier qualification failures, CAPA records closed without verification, risk management treated as a one-time activity, competence records that prove attendance not ability, and internal audits that never find anything. With clause references and fixes for each.

The audit findings that derail medical device manufacturers — and the fixes that prevent them.

Last Updated: May 2026

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Your QMS Passed Initial Certification. Now the Surveillance Audit Found Three Major Nonconformances.

This scenario plays out more often than most quality managers expect.

Initial certification audits are thorough — but they happen at a fixed point in time, against a QMS that was built specifically to pass them. Surveillance audits arrive 12 months later and evaluate how the system actually operates day to day. That gap between what was built and what runs is where most findings live.

The mistakes in this article are not obscure edge cases. They are the findings that certification bodies issue most consistently, that FDA investigators flag most frequently under QMSR, and that experienced quality practitioners see repeated across organizations of every size. Some of them look like documentation failures. Most of them are process failures wearing documentation’s clothes.

If you are preparing for a first certification audit, a surveillance visit, or an FDA QMSR inspection, this list tells you where to look before the auditor does.

In This Guide

The most common mistakes in ISO 13485 QMS by clause
Why document control failures are almost never about documents
The management review gap that catches organizations by surprise
How supplier qualification problems compound over time
What auditors find when they look at CAPA records
The risk management connection most QMS procedures miss
Decision-stage guidance for organizations at different points in their compliance journey

Start Here (Top Resources)

🔖 Train your team on ISO 13485 → BSI Group — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

🔖 Pursue or maintain ISO 13485 certification → ISOQAR — ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

Browse the What Is ISO 13485? pillar article for full clause context, or use the ISO 13485 Gap Assessment Checklist to identify your specific gaps before your next audit.

Mistake 1: Document Control That Controls Nothing

The clause: ISO 13485 Section 4.2 — Document Control

What auditors find: Obsolete procedures still accessible in shared drives. Forms in use that don’t match the current controlled version. Employees working from printed copies with no revision date. Documents approved by someone whose role no longer includes that authority.

Document control failures are the most consistently cited finding in ISO 13485 surveillance audits — not because organizations don’t have document control procedures, but because those procedures don’t match how people actually access and use documents day to day.

The standard requires that documents be reviewed and approved before use, that current versions are available at points of use, and that obsolete documents are prevented from unintended use. Each of those three requirements has failed in organizations that had a document control procedure on file.

The fix: Document control is an access problem, not a paperwork problem. The question is not “do we have a procedure?” — it’s “can an employee working right now reach a document that has been superseded?” If the answer is yes, your document control system is not functioning regardless of what your procedure says.

Audit your access architecture — shared drives, QMS software, printed SOPs at workstations — before an auditor does. Every document a user can reach should be the current controlled version. Everything else should require deliberate action to retrieve.

At this point, most quality managers in this position should: → Pull your document control procedure and map it against actual employee access. If those two things don’t match, 9001Simplified’s documentation kits include document control templates built specifically for ISO 13485 compliance. 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

Mistake 2: Management Review Without Documented Outputs

The clause: ISO 13485 Section 5.6 — Management Review

What auditors find: Meeting minutes that record attendance and agenda items but contain no documented decisions. Review inputs listed without evidence they were actually analyzed. Action items described without owners, deadlines, or follow-up records. Reviews conducted annually when the organization’s risk profile warranted more frequent review.

ISO 13485 Section 5.6.3 is explicit: management review outputs must include decisions and actions related to improvement of the QMS, improvement of product to meet customer requirements, and resource needs. A management review that happened but produced no documented decisions is a nonconformance — regardless of what was discussed in the room.

This finding catches organizations off guard because the review itself felt thorough. Leadership reviewed quality objectives, discussed complaint trends, walked through audit results. But the meeting minutes read like a summary of what was presented, not a record of what was decided.

The fix: Management review outputs need to look like decisions, not summaries. For each input reviewed, the record should show: what the data indicated, what conclusion was reached, and what — if anything — will be done about it. “Complaint trend reviewed — no action required” is a decision. “Complaint data presented” is not.

⚠️ Under QMSR, FDA inspectors now evaluate management review as part of every inspection. Inspectors who find management reviews without documented outputs routinely cite this as a systemic QMS failure, not an administrative lapse.

Mistake 3: Supplier Qualification on Paper Only

ISO 13485 supplier qualification infographic illustrating risk-based supplier controls under Clause 7.4, featuring a supplier risk tier matrix, qualification lifecycle process, ongoing monitoring activities, and common supplier management mistakes. — Supplier qualification under ISO 13485 is not a one-time approval exercise. Risk classification, qualification activities, performance monitoring, and periodic re-evaluation must work as a continuous lifecycle.

The clause: ISO 13485 Section 7.4 — Purchasing / Supplier Controls

What auditors find: An approved supplier list that has not been updated in years. Suppliers qualified based on a questionnaire with no follow-up evaluation. Critical suppliers with no documented performance monitoring. Qualification records for suppliers whose scope of supply has expanded beyond what was originally evaluated.

Supplier qualification failures compound over time in a way that most other QMS failures don’t. A supplier that was qualified five years ago may have changed ownership, changed manufacturing processes, changed subcontractors, or expanded into new product categories — none of which triggered a requalification because the procedure didn’t require one.

ISO 13485 requires that purchasing controls be proportionate to the risk the supplier presents to product quality and patient safety. That proportionality has to be reflected in your qualification criteria, your monitoring frequency, and your records. An approved supplier list populated with names and no evaluation data is not a supplier qualification program.

The fix: Supplier qualification is a living process, not a one-time gate. Your procedure should define evaluation criteria by supplier risk tier, monitoring frequency, requalification triggers, and what happens when a supplier fails to meet performance criteria. If you are using the Supplier Quality Checklist, the ISO 13485 Clause 7.4 section identifies every supplier control element auditors evaluate — including the ones most procedures leave undocumented.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Mistake 4: CAPA Records That Close Without Verification

ISO 13485 CAPA infographic comparing incorrect and correct closure methods, showing the difference between closing corrective actions without effectiveness verification and closing them with documented objective evidence under Clause 8.5.2. — CAPA is not complete when action is implemented. Under ISO 13485 Clause 8.5.2, closure requires effectiveness verification supported by defined criteria, monitoring, objective evidence, and documented results.

The clause: ISO 13485 Section 8.5.2 — Corrective Action

What auditors find: CAPAs closed at implementation with no effectiveness check. Effectiveness verifications that consist of a single sentence — “action implemented, problem resolved” — with no supporting data. Criteria for effectiveness that were defined after the action was taken rather than before. The same problem recurring in a subsequent audit cycle.

Closing a CAPA without effectiveness verification is one of the most consistently cited major nonconformances in ISO 13485 audits. The standard requires that corrective actions be reviewed for effectiveness — and that review must be documented, must use defined criteria, and must be supported by evidence.

The pattern most organizations fall into is treating CAPA closure as an administrative step rather than a quality decision. Someone implements the action, marks the record complete, and moves on. The question “did this actually work?” never gets formally answered.

The fix: Effectiveness verification criteria must be established before the corrective action is implemented — not after. The criteria should be specific enough that a different person reviewing the record could objectively determine whether they were met. “No recurrence for 90 days” is a criterion. “Situation improved” is not.

For a complete breakdown of CAPA requirements under ISO 13485 Clause 8.5.2 — including the InfuTronix case study and the six mandatory data inputs under Section 8.4 — see CAPA Requirements in ISO 13485.

➡️ BSI Group ISO 13485 Training — Covers CAPA, supplier controls, management review, and all major ISO 13485 clauses. BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

Mistake 5: Risk Management Treated as a One-Time Activity

The clause: ISO 13485 Section 7.1 / ISO 14971

What auditors find: Risk files created during design and never updated. Post-market surveillance data that has no documented connection to risk management. Field failures that triggered a CAPA but never prompted a review of the corresponding risk file. Risk management plans that reference ISO 14971 but contain no evidence of post-production monitoring.

Risk management documentation under Clause 7.1 is now the top QMSR inspection finding — 25 citations in the first three months of QMSR inspection data, ahead of CAPA. That displacement reflects a systematic failure in how most organizations treat risk: as a design-phase activity rather than a lifecycle responsibility.

ISO 14971 is explicit that risk management extends across the entire product lifecycle. Post-market surveillance data, complaint trends, service reports, and CAPA findings are all risk management inputs. When those data sources exist in separate systems with no documented connection to the risk file, the risk management process is incomplete — regardless of how thorough the original risk analysis was.

The fix: Your risk management procedure should define how post-production information feeds back into risk files. When a complaint trend reaches a defined threshold, when a CAPA is opened for a field failure, when a service report pattern emerges — each of those events should trigger a documented review of the relevant risk analysis. That review should produce a documented decision: residual risk is still acceptable, or risk control measures need updating.

For the full picture of how ISO 14971 and ISO 13485 interact at the clause level, see ISO 14971 vs ISO 13485.

Mistake 6: Training Records That Prove Attendance, Not Competence

The clause: ISO 13485 Section 6.2 — Human Resources / Competence

What auditors find: Training records that show who attended a session and when, with no evidence of what was covered or whether it was understood. Competence assessments that consist of a supervisor signature with no evaluation criteria. Personnel performing quality-critical tasks without documented evidence that they are qualified to do so. New employees signed off on procedures they completed training on — but with no record of how competence was evaluated.

ISO 13485 Section 6.2 requires that personnel performing work affecting product quality are competent — and that competence is evaluated and the results are recorded. Attendance is not competence. Completing a training module is not competence. Competence is the demonstrated ability to apply knowledge and skills to produce the required outcome.

This distinction becomes a major finding when an auditor pulls the training record for someone who made a quality-critical decision and finds a sign-off sheet.

The fix: Competence evaluation needs defined criteria for each quality-critical role — what knowledge and skill is required, and how it will be evaluated. That evaluation can be a practical demonstration, a written assessment, a supervised work period with documented sign-off, or another method appropriate to the task. The key is that the record shows what was evaluated and what the result was — not just that training occurred.

If you are building competence frameworks from scratch, BSI Group’s ISO 13485 training courses include role-based competency models that align with Section 6.2 requirements. BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

Mistake 7: Internal Audits That Don’t Find Anything

The clause: ISO 13485 Section 8.2.4 — Internal Audit

What auditors find: Internal audit programs that audit the same low-risk processes repeatedly while avoiding the areas where problems actually exist. Audit reports that describe observations as “satisfactory” or “no issues found” across every clause. Internal auditors who have never issued a nonconformance. Audit findings that are consistently minor and never escalate to CAPA.

An internal audit program that finds nothing is either auditing the wrong things or auditing them incorrectly. Certification bodies and FDA investigators specifically look at the output of your internal audit program — not just whether audits were conducted on schedule. If your internal audit findings never trigger a CAPA and never surface anything your surveillance audit finds, that incongruence is a finding in itself.

ISO 13485 requires that the internal audit program take into account the status and importance of the processes to be audited and the results of previous audits. A risk-based audit program will allocate more frequency and depth to high-risk processes — CAPA, supplier controls, complaint handling, design controls — and less to lower-risk administrative processes.

The fix: Evaluate your internal audit program against what your surveillance audits and FDA inspections have actually found. If there is a consistent gap — if surveillance audits find things your internal audits missed — that gap is the finding. Your audit program needs to be harder on the areas that matter most, not easier.

If you need to develop your internal audit capability, ISOQAR offers ISO 13485 internal auditor training and certification support. ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

At this point, most quality managers preparing for their next audit should: → Cross-reference your last three internal audit reports against your last surveillance audit finding. If the surveillance audit found something your internal audits missed, that’s the gap to close first. Get the ISO 13485 Gap Assessment Checklist to run a structured review across all clauses.

Common Misconceptions About ISO 13485 QMS

ISO 13485 infographic illustrating common misconceptions about quality management systems, comparing myths versus reality around certification, QMSR alignment, and major nonconformances in medical device quality systems. — Some of the most expensive ISO 13485 mistakes begin as assumptions. Certification is not a finish line, ISO 13485 and QMSR are not identical, and a major nonconformance does not automatically mean certification loss.

“Passing initial certification means the QMS is compliant.”

Initial certification confirms that a QMS met the standard’s requirements at a specific point in time, as evaluated against a specific set of records. Surveillance audits evaluate whether the system continues to operate as documented. Organizations that build a QMS to pass initial certification and then don’t maintain it operationally consistently accumulate findings by the first surveillance audit. Certification is not a destination — it is a recurring obligation.

“ISO 13485 and FDA QMSR requirements are now the same thing.”

QMSR, which took effect February 2, 2026, aligns FDA’s device QMS requirements with ISO 13485 — but does not make them identical. Four FDA-specific requirements exist in QMSR that ISO 13485 certification alone does not cover: complaint files under 21 CFR 820.198, MDR procedures, corrections and removals, and the device master record structure. An organization that is ISO 13485 certified is not automatically QMSR compliant. The ISO 13485 Gap Assessment Checklist covers all four QMSR bridge requirements explicitly.

“A major nonconformance means we will lose certification.”

A major nonconformance means the certification body has identified a significant gap in the QMS — one that has the potential to affect product quality or patient safety. It does not automatically result in suspension or withdrawal of certification. It triggers a corrective action requirement with a defined response timeline. Organizations that respond with a documented root cause analysis and credible corrective action plan typically resolve major nonconformances without losing certification. The risk is not the finding — it is the failure to respond adequately.

Frequently Asked Questions

What is the most common ISO 13485 audit finding?

Document control failures under Section 4.2 are consistently the most common finding in surveillance audits. CAPA effectiveness verification failures and management review output gaps follow closely. Under QMSR inspections, risk management documentation under Clause 7.1 is now the leading finding.

How many nonconformances are typical in an ISO 13485 surveillance audit?

There is no typical number. A mature QMS with active internal audit and CAPA programs may receive zero nonconformances. A QMS that has been maintained administratively rather than operationally may receive multiple majors. What matters is whether findings from one audit cycle are genuinely closed before the next one.

What is the difference between a major and minor nonconformance in ISO 13485?

A major nonconformance indicates a systematic failure that has the potential to affect product quality or patient safety — or the complete absence of a required process. A minor nonconformance indicates an isolated lapse or a process weakness that does not constitute a systematic failure. Major nonconformances require a documented corrective action plan with a defined response timeline. Minor nonconformances are typically addressed at the next surveillance audit.

Can we self-declare ISO 13485 compliance without certification?

Self-declaration against ISO 13485 is not recognized in the medical device industry in the way it is sometimes used in other sectors. Customers, regulatory bodies, and OEMs expect third-party certification from an accredited body. Self-declaration provides no audit trail and no independent verification of compliance. If you are building toward certification, ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

How long does it take to fix a major nonconformance?

Certification bodies typically allow 30 to 90 days to respond to a major nonconformance with a documented corrective action plan, evidence of root cause analysis, and initial implementation evidence. Full closure — including effectiveness verification — may take longer depending on the nature of the finding. The timeline should be proposed by the organization and accepted by the certification body.

What is the best way to prepare for an ISO 13485 surveillance audit?

Run a structured internal audit against the clauses most likely to surface findings — Section 4.2 (document control), Section 5.6 (management review), Section 7.4 (supplier controls), Section 8.2.4 (internal audit), and Section 8.5.2 (CAPA). Pull a sample of CAPA records and verify that effectiveness verifications are complete. Review your management review minutes for documented outputs. Check that your approved supplier list reflects current qualification status. The ISO 13485 Gap Assessment Checklist covers all of this in 64 structured items.

Do these mistakes also apply under FDA QMSR?

Yes — and in some cases the stakes are higher. QMSR inspections evaluate every subsystem, every inspection. Document control failures, CAPA gaps, and management review deficiencies that might result in a minor nonconformance from a certification body can result in a 483 observation or warning letter from FDA. See FDA QSR vs ISO 13485 for the full regulatory alignment picture.

Free Resources

📋 Free Download: Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all systems.

📋 Free Download: Supplier Quality Checklist — ISO 9001 Clause 8.4 — all supplier controls auditors evaluate, 45 items with scoring.

📋 Free Download: ISO 9001 Implementation Roadmap — The exact 5-phase process from gap assessment to Stage 2 audit clearance.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Not Sure What to Do Next?

→ You need the official ISO 13485:2016 standard → ANSI Webstore — Use CC2026 for 5% off. ANSI is the official U.S. distributor of ISO standards.

→ You need to assess your QMS gaps before your next audit → ISO 13485 Gap Assessment Checklist — free, 64 items

→ You need to build or rebuild QMS documentation → 9001Simplified Documentation Kits — 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

→ You need to train your team on ISO 13485 requirements → BSI Group ISO 13485 Training — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses.

→ You are ready to pursue or maintain ISO 13485 certification → ISOQAR — UKAS-accredited, one of the most recognized certification bodies in the industry.

→ You need to understand CAPA requirements in depth → CAPA Requirements in ISO 13485

→ You need to understand how risk management connects to your QMS → ISO 14971 vs ISO 13485 and What Is ISO 14971?

→ You need to understand how QMSR changed your compliance obligations → FDA QSR vs ISO 13485

→ You need to understand what ISO 13485 covers at the clause level → What Is ISO 13485?

→ You need to understand the cost of ISO 13485 certification → How Much Does ISO 13485 Cost?

→ You want to buy ISO 13485 → Buy ISO 13485

→ You want to browse all medical device standards → explore standards by compliance area

Still figuring out where to start?

If you are not ready to invest in training or documentation yet — that is normal. Most organizations take several weeks to move from identifying gaps to committing to a remediation plan.

The best next step for most organizations at this stage: → Download the free ISO 13485 Gap Assessment Checklist — it takes 20 minutes and tells you exactly where your QMS has gaps before you spend anything.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

The Gap Between What Was Built and What Runs

Most ISO 13485 QMS failures are not failures of intent. The organizations that receive major nonconformances typically built their systems with genuine effort. What they built, however, was optimized for initial certification — not for the ongoing operational reality that surveillance audits and FDA inspections evaluate.

Document control systems that work at go-live drift as people find workarounds. CAPA programs that close records efficiently lose track of effectiveness. Management reviews that felt thorough produce minutes that record what was presented rather than what was decided. None of these failures are dramatic. They accumulate quietly, and they surface at the worst possible time.

The difference between a QMS that passes surveillance audits consistently and one that doesn’t is not sophistication. It is the discipline to evaluate what the system actually does — not just what the procedures say it does — on a regular basis.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

Subscribe below to stay ahead.

CAPA Requirements in ISO 13485 (2026)

CAPA under ISO 13485 is more than corrective action paperwork. Learn what auditors and FDA investigators actually evaluate, common CAPA failures, Clause 8.5 requirements, effectiveness verification expectations, and how CAPA now fits into modern QMSR inspection strategy.

What the FDA’s newest inspection data reveals about where medical device manufacturers are still getting it wrong — and how to close the gaps before your next audit.

Last Updated: May 2026

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

The FDA Just Changed How It Measures Your CAPA System — And Most Manufacturers Haven’t Noticed

CAPA was the undisputed number-one FDA 483 finding for years. Not close. Not rotating with other subsystems. Every year, far and away.

That changed in 2026.

Three months of QMSR inspection data is in. Risk management documentation under Clause 7.1 now sits at number one — 25 citations. CAPA-related findings come in at 19 combined. On paper, that looks like good news. It isn’t — at least not entirely.

Here’s the nuance that matters: the inspection model changed. Under the old QSIT system, abbreviated inspections hit CAPA almost every single time. Other subsystems cycled in less frequently. CAPA’s dominance was partly an artifact of inspection structure, not a clean picture of where the industry actually struggled.

The new model looks at everything — every subsystem, every inspection. The categorization changed too. Under the old QSR, all CAPA requirements bundled into one code. Now they fragment. Two separate 8.5.2 entries already appear in the first dataset. CAPA didn’t disappear. The field just got wider.

If you’re managing a QMS for a medical device manufacturer, that means more exposure, not less.

In This Guide

What ISO 13485 Clause 8.5.2 actually requires — and what most procedures miss
The six mandatory data inputs for your CAPA process under Section 8.4
Why the InfuTronix case is the most instructive FDA enforcement example in recent years
The difference between measurement and analysis — and why confusing them causes most failures
How horizontal analysis works and why auditors look for it specifically
Common misconceptions that lead to major nonconformances
What to do before your next surveillance audit

Start Here (Top Resources)

🔖 Get ISO 13485 training → BSI Group — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

🔖 Build your CAPA documentation → 9001Simplified — 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

🔖 Pursue or maintain ISO 13485 certification → ISOQAR — ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

Browse the Standards Library to identify which standards apply to your compliance area, or view the most widely used standards in medical devices and manufacturing.

What Is CAPA Under ISO 13485?

CAPA cycle diagram showing ISO 13485 Clause 8.5.2 corrective action and Clause 8.5.3 preventive action steps: Identify, Prevent, Monitor, Improve, Correct, Root Cause — CAPA under ISO 13485 follows a closed-loop process: identify issues, determine root cause, implement corrective action, monitor effectiveness, and prevent recurrence through continual improvement.

CAPA — Corrective and Preventive Action — is the mechanism your QMS uses to identify problems, trace them to root cause, and prevent recurrence. Under ISO 13485:2016, CAPA spans two clauses: Clause 8.5.2 (corrective action) and Clause 8.5.3 (preventive action). They operate differently and auditors evaluate them separately.

Corrective action addresses a nonconformity that has already occurred. Preventive action addresses a potential nonconformity that has not yet materialized. The distinction matters because the procedures, triggers, and documentation requirements differ between them.

ISO 13485 places CAPA in the broader context of Clause 8.5, which also covers continual improvement. But the practical application of CAPA runs deeper — it pulls from data collected across Clause 8.4 (analysis of data) and connects to management review, internal audits, and post-market surveillance. A CAPA procedure that treats the clause as standalone almost always fails at audit.

Under the QMSR (Quality Management System Regulation), which took effect February 2, 2026, FDA now explicitly harmonizes its device QMS requirements with ISO 13485. CAPA requirements that previously lived in 21 CFR Part 820.100 now map directly to ISO 13485 Clause 8.5.2. FDA expects those requirements to be met — and QMSR inspections are actively evaluating them.

What Clause 8.5.2 Actually Requires

Clause 8.5.2 sets out six specific requirements for corrective action. Each one has a documentation implication.

1. Review nonconformities — including customer complaints. This means your CAPA trigger list must include complaint data, not just internal defect records. If complaints are logged in one system and CAPA is managed in another, there needs to be a formal connection between them. Auditors check that connection.

2. Determine the causes of nonconformities — root cause analysis is not optional. Documenting “operator error” or “process deviation” without supporting evidence of how that conclusion was reached is a common major nonconformance. You need a documented methodology — 5 Whys, fishbone, fault tree — and evidence it was applied.

3. Evaluate the need for corrective action — not every nonconformity requires a CAPA. The standard requires you to evaluate and document that decision. Organizations that open a CAPA for every minor deviation create administrative burden; organizations that never document the decision to not open a CAPA create audit vulnerability.

4. Determine and implement corrective action — the action must be proportionate to the effects of the nonconformity. This means documented implementation, not just a description of what was planned.

5. Record results of corrective action — effectiveness verification is required. You must demonstrate that the action you took actually resolved the problem. A corrective action record that closes without verification evidence is not compliant.

6. Review corrective action and its effectiveness — this step loops back into your data analysis process. If the same problem recurs, your record should capture that recurrence and the updated response.

The 2026 QMSR inspection data showing two separate 8.5.2 citations reflects how inspectors are now parsing these requirements individually. A finding against root cause determination is a different citation from a finding against effectiveness verification.

At this point, most quality managers in this position should: → Confirm your CAPA procedure addresses all six elements explicitly — and that your records can demonstrate compliance with each one. Get the ISO 13485 Gap Assessment Checklist to verify your current gaps across all 13485 clauses.

The Six Data Inputs for Section 8.4

Clause 8.4 requires you to analyze data from specific sources to drive CAPA and continual improvement. The standard names six:

Data Source	What It Covers
Feedback	Customer complaints, post-market surveillance data, service reports flagged by users
Product conformity	Inspection results, test data, nonconforming product records
Process and product trends	Statistical process control, yield trends, recurring deviations
Supplier performance	Supplier nonconformances, delivery performance, qualification data
Audit results	Internal audit findings, certification body findings, customer audits
Service reports	Field service records, repair data, failure modes reported post-delivery

Your CAPA procedure must document how data from each of these sources is collected, reviewed, and used to make CAPA decisions. The piece most manufacturers skip entirely is what experienced quality practitioners call horizontal analysis — looking across your data sources, not just within them.

The Analysis Failure: What InfuTronix Got Wrong

The InfuTronix case is the most instructive CAPA enforcement example to come out of FDA inspection activity in recent years. It illustrates the most common failure mode — and it isn’t what most people expect.

InfuTronix had a rule written directly into their CAPA procedure: ten complaints in a rolling 12-month window triggers a CAPA. Simple enough. Documented. Auditable on its face.

Between September 2020 and August 2021, they received 80 complaints reporting power issues, 31 for battery failures, and 67 for leaking administration sets. Not one CAPA was opened.

This was not a data collection failure. The complaints were logged. The threshold was documented. The system simply never connected what was being measured to what that data actually meant.

That is an analysis failure — and it is the most common one FDA finds.

Measurement gets you the number. Analysis tells you what to do with it.

ISO 13485 Section 8.4 requires both, and your procedure needs to address the full cycle: collect the data, analyze it against defined criteria, and produce a documented decision. The decision can be: open a CAPA, escalate to management review, or continue monitoring. All three are defensible. No decision — or a decision made without documentation — is not.

FDA found all of this during inspection. The warning letter that followed cited failure to establish and maintain procedures for implementing corrective action under 21 CFR 820.100(a). Under QMSR, that same finding maps directly to ISO 13485 Clause 8.5.2.

Source: FDA Warning Letter, InfuTronix LLC, June 16, 2022. Available at fda.gov.

ISO 13485 Section 8.4 infographic showing the measurement and analysis cycle with a process flow from data collection to analysis, documented decision making, and outcomes including CAPA, management review, or continued monitoring. — Measurement gets you the number. Analysis determines the response. Under ISO 13485 Section 8.4, organizations must collect data, analyze it against defined criteria, and document a defensible decision.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items covering ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Horizontal Analysis: The Step Most QMS Procedures Skip

Vertical analysis — reviewing data within a single source — is what most CAPA procedures are built around. You run through complaints. You run through audit findings. You check supplier nonconformances. Each in its own silo.

Horizontal analysis means looking across those sources simultaneously — specifically for patterns that only become visible when you connect the data.

A complaint spike in Q2 means something different when it aligns with a supplier nonconformance from the same quarter. A field failure pattern means something different when it correlates with a process change implemented three months prior. A rising service report trend means something different when internal inspection data for the same product shows clean numbers — because that combination suggests the problem is post-delivery, not in-process.

These cross-source connections are where real problems get caught before FDA finds them. They are also where most QMS procedures have no documented methodology whatsoever.

Your CAPA procedure should require a formal cross-source review at defined intervals — typically aligned with management review. The review should produce a documented output: either a CAPA trigger, a decision to continue monitoring with rationale, or escalation to a different quality subsystem.

Certification bodies increasingly audit for this specifically. The question is not just “do you have a CAPA procedure?” It’s “does your analysis process look across all six data sources and produce a documented decision?”

➡️ ANSI Webstore — Get ISO 13485:2016, the standard your CAPA procedure must align with. ANSI is the official U.S. distributor of ISO standards, ensuring you receive the controlled, compliant version required for certification audits. Use coupon CC2026 for 5% off.

Common CAPA Misconceptions

“A CAPA is only needed when something goes seriously wrong.”

The standard doesn’t set a severity threshold for opening a CAPA — it requires a documented decision about whether a nonconformity warrants one. The mistake isn’t opening too many CAPAs. It’s failing to document the evaluation. Auditors don’t penalize organizations for opening few CAPAs; they penalize organizations that can’t show they evaluated the data and made a deliberate decision.

“Closing the CAPA once the action is implemented is sufficient.”

Clause 8.5.2 requires effectiveness verification — evidence that the corrective action actually resolved the problem. Closing a CAPA at implementation is one of the most consistently cited findings in ISO 13485 surveillance audits. Effectiveness verification must be documented, must use defined criteria, and must happen at a point in time when there is enough post-implementation data to draw a conclusion.

“Our CAPA system is separate from complaint handling and that’s fine.”

It isn’t. The connection between complaint data and CAPA decisions must be explicit and documented. A complaint handling procedure that logs data and a CAPA procedure that never receives it create exactly the kind of system failure the InfuTronix case illustrates. If there is no formal handoff between your complaint system and your CAPA trigger evaluation, that gap will be found.

What Auditors Look For in CAPA Reviews

Whether the auditor is from a certification body or an FDA investigator conducting a QMSR inspection, the CAPA review follows a consistent pattern. Understanding it in advance is the most effective preparation.

They start with your procedure. They read it. They look for whether it covers all six elements of Clause 8.5.2 and whether it explicitly addresses the six data inputs from Clause 8.4. Gaps in the procedure are flagged before they look at a single record.

They pull a sample of CAPA records. Typically 3–5 for a surveillance audit, more for initial certification or for-cause inspections. They are looking for: documented root cause methodology, proportionality between the action and the finding, effectiveness verification with criteria and evidence, and closure only after verification.

They look for records that should exist but don’t. This is where analysis failures surface. If complaint data shows a spike and no CAPA was opened, the auditor will ask for the documented decision that concluded no CAPA was needed. If that document doesn’t exist, that is a finding — regardless of whether the decision was actually reasonable.

They check the connection between data sources. Does your management review input include CAPA status? Does your internal audit program look at CAPA effectiveness? Does complaint data flow into your trend analysis? These connections are evaluated systematically.

They review effectiveness verifications. A CAPA closed with “action implemented — problem resolved” and no supporting data is a major nonconformance. Effectiveness verification requires defined criteria established before the action is taken, a monitoring period, and data that demonstrates the criteria were met.

ISO 13485 CAPA audit review infographic showing the key areas auditors evaluate during certification and FDA inspections, including procedures, CAPA records, missing records, data connections, and effectiveness verification. — CAPA audits follow a predictable path. Auditors review procedures, sample records, process connections, and effectiveness evidence to determine whether your system is functioning as designed.

If you are preparing for a certification audit or a QMSR inspection, the FDA QSR vs ISO 13485 (QMSR Transition Guide) is the clearest resource available on how the two frameworks now align.

If you are building CAPA procedures from scratch or rewriting existing ones, the What Is ISO 13485? pillar article covers the full clause-by-clause context you need before the documentation work begins. For a complete breakdown of how ISO 13485 and FDA QMSR requirements interact at the clause level, see ISO 9001 vs ISO 13485.

If you are under active FDA inspection pressure → Get BSI Group ISO 13485 training and ISOQAR certification support immediately. BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally. ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

Provider	What You Get	Best For
ANSI Webstore	ISO 13485:2016 official standard document	Any organization needing the controlled, compliant version of the standard
BSI Group	ISO 13485 training courses	Teams preparing for implementation, audit readiness, or CAPA procedure development
9001Simplified	QMS documentation kits	Organizations building CAPA and QMS documentation from scratch
ISOQAR	ISO 13485 certification	Organizations ready to pursue or maintain certification

Most organizations at this stage need all three:

The standard from ANSI Webstore (use CC2026 for 5% off)
Lead implementer training from BSI Group
A documentation kit from 9001Simplified

This combination covers the standard, the knowledge, and the implementation infrastructure.

Frequently Asked Questions

What does ISO 13485 require for CAPA?

ISO 13485 Clause 8.5.2 requires a documented procedure that covers reviewing nonconformities, determining root causes, evaluating the need for action, implementing corrective action proportionate to the problem, recording results, and verifying effectiveness. Preventive action under Clause 8.5.3 follows a parallel structure for potential — not actual — nonconformities.

What is the most common CAPA finding in ISO 13485 audits?

Failure to verify the effectiveness of corrective actions is consistently the most common major nonconformance in surveillance audits. The second most frequent is incomplete root cause analysis — particularly records that name a root cause without showing the methodology used to reach that conclusion.

How many CAPAs should a medical device manufacturer open per year?

There is no target number. A small manufacturer with a mature QMS might open fewer than ten CAPAs annually and pass every audit. What auditors evaluate is whether the documented decision-making process is defensible — not the volume of CAPAs opened. If you are in a situation where your data shows patterns and no CAPAs are being opened, the risk is high regardless of company size.

Does CAPA under QMSR differ from CAPA under the old QSR?

The substance is largely the same. The significant change is that QMSR now explicitly adopts ISO 13485 Clause 8.5.2 as the governing framework, and inspections evaluate every subsystem — not just CAPA, as abbreviated QSIT inspections frequently did. Two separate 8.5.2 citations already appear in early QMSR inspection data, reflecting more granular evaluation of individual requirements within the clause. Read the full FDA QSR vs ISO 13485 Transition Guide for a complete breakdown.

What is the difference between corrective action and preventive action in ISO 13485?

Corrective action (Clause 8.5.2) addresses a nonconformity that has already occurred. Preventive action (Clause 8.5.3) addresses a potential nonconformity that trend data or risk analysis suggests may occur. The distinction is more than semantic — auditors evaluate them separately, the documentation requirements differ, and the trigger criteria for each should be explicit in your procedure.

Can we use a single CAPA form for both corrective and preventive actions?

Yes — many organizations use a combined form with fields that distinguish the type of action. What matters is that the record clearly identifies whether the action is corrective or preventive, that the corresponding clause requirements are addressed, and that the effectiveness verification criteria are appropriate for the action type.

What data sources must feed our CAPA process under ISO 13485?

Clause 8.4 identifies six: feedback (including complaints), product conformity data, process and product trends, supplier performance, audit results, and service reports. Your CAPA procedure should document how each source is reviewed, at what frequency, and how that review produces documented CAPA decisions. If you are using the ISO 13485 Gap Assessment Checklist, the data analysis section will identify exactly where your current procedure has gaps.

How long do we need to keep CAPA records?

ISO 13485 Section 4.2.5 requires records to be retained for a period at least equal to the lifetime of the device, but not less than two years from the date of product release. FDA QMSR requirements align with this. For implantable devices or devices with extended service life, the retention period is typically longer and should be specified in your records control procedure.

Free Resources

📋 Free Download: Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all systems.

📋 Free Download: Supplier Quality Checklist — ISO 9001 Clause 8.4 — all supplier controls auditors evaluate, 45 items with scoring.

📋 Free Download: ISO 9001 Implementation Roadmap — The exact 5-phase process from gap assessment to Stage 2 audit clearance.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

Not Sure What to Do Next?

→ You need the official ISO 13485:2016 standard → ANSI Webstore — Use CC2026 for 5% off. ANSI is the official U.S. distributor of ISO standards.

→ You need to understand how your CAPA requirements changed under QMSR → FDA QSR vs ISO 13485 Transition Guide

→ You need to train your team on ISO 13485 CAPA requirements → BSI Group ISO 13485 Training — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses.

→ You need to build CAPA documentation from scratch → 9001Simplified Documentation Kits — 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS.

→ You are ready to pursue ISO 13485 certification → ISOQAR — ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

→ You want to assess your full ISO 13485 gaps before spending anything → ISO 13485 Gap Assessment Checklist — free, 64 items

→ You need to understand what ISO 13485 covers before addressing CAPA specifically → What Is ISO 13485?

→ You need to understand how risk management connects to CAPA → What Is ISO 14971? and ISO 14971 vs ISO 13485

→ You need to compare ISO 13485 to ISO 9001 to understand CAPA differences → ISO 9001 vs ISO 13485

→ You want to buy ISO 13485 → Buy ISO 13485

→ You want to browse all medical device standards in one place → explore sector-specific standards or browse standards by compliance area

Still figuring out where to start?

If you are not ready to purchase yet — that is normal. ISO 13485 CAPA decisions typically take weeks from first research to implementation commitment.

The best next step for most organizations at this stage: → Download the free ISO 13485 Gap Assessment Checklist — it takes 20 minutes and tells you exactly where your CAPA and QMS gaps are before you spend anything.

📋 Free Download: ISO 13485 Gap Assessment Checklist — 64 items — ISO 13485 clauses + all four FDA QMSR bridge requirements ISO 13485 certification alone does not cover.

The Cost of an Analysis Failure

CAPA is not a form. It is not a procedure sitting in your document management system. It is the mechanism that connects everything your quality system measures to everything your quality system does about it. When that connection breaks — when data is collected, thresholds are documented, and no one asks what the numbers actually mean — FDA finds it. Certification bodies find it. And devices reach the field with problems that could have been caught.

The InfuTronix case isn’t an outlier. Organizations that receive 483 observations for CAPA failures almost always had a procedure. What they didn’t have was an analysis process that produced documented decisions. That gap is what inspection finds — and it’s the gap that costs the most to recover from after the fact.

Under QMSR, the inspection model is now broader. Every subsystem, every inspection. CAPA didn’t disappear from the top of the finding list — it fragmented into more specific citations. That means more exposure, not less.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

👉 Get updates on new standards, implementation strategies, and compliance insights 👉 Be first to access new guides, tools, and checklists

Subscribe below to stay ahead.

Buy ISO 14971:2019 — Official PDF & Print Sources (2026 Guide)

Where to buy the official ISO 14971:2019 standard, what formats are available, how much it costs, and why purchasing from an authorized source is non-negotiable for medical device risk management — including why the superseded 2007 edition still circulating online creates real certification and regulatory risk.

Where to buy the official ISO 14971:2019 standard, what formats are available, how much it costs, and why purchasing from an authorized source is non-negotiable for medical device risk management.

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

📥 Free ISO 13485 & ISO 14971 Implementation Checklist — Confirm you have every required risk management document before your first certification audit. → [Download Free Checklist]

ISO 14971 Is No Longer Optional for Medical Device Manufacturers

ISO 14971:2019 was already the international standard for medical device risk management. Since February 2, 2026, it carries additional weight: the FDA’s Quality Management System Regulation (QMSR) incorporated ISO 13485:2016 by reference — and ISO 13485 explicitly requires risk management per ISO 14971. That means ISO 14971 is now embedded in U.S. regulatory expectations for every manufacturer subject to 21 CFR Part 820.

FDA investigators operating under Compliance Program 7382.850 are expected to use the risk management file as their inspection roadmap — following risk documentation into design controls, CAPA, supplier qualification, and post-market surveillance. If your risk management program is not built on ISO 14971, that gap will surface under QMSR inspection.

This guide covers exactly where to buy the official ISO 14971:2019 standard, what formats are available, how much it costs, and what to watch out for when purchasing.

⚠️ The QMSR compliance date has passed (February 2, 2026). Organizations that have not yet integrated ISO 14971 across their quality system are operating with a gap that FDA inspectors are actively evaluating.

In This Guide

What ISO 14971:2019 is and what changed from the 2007 edition
Which edition you need — 2019 vs 2007
Where to buy the official standard from authorized sources
Available formats — PDF, print, multi-user, and bundles
How much ISO 14971:2019 costs
Who needs to purchase the standard
What ISO 14971 does NOT include
Common purchasing mistakes to avoid
Related standards you will also need

👉 Start Here (Top Resources)

👉 Purchase the official ISO 14971:2019 standard — the current edition for all medical device risk management programs → ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026. ANSI is the official U.S. distributor of ISO standards, ensuring you receive the controlled, compliant version required for certification audits.

👉 Purchase the required companion — ISO 13485:2016 → ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off. ISO 14971 cannot be implemented in isolation — it is a required companion to ISO 13485 and must be purchased and controlled as an external document within your QMS.

👉 Save up to 50% buying both standards together → ISO Standards Packages — ANSI Webstore — the most cost-effective option for organizations purchasing ISO 14971 alongside ISO 13485 and related standards.

👉 Get ISO 13485 training covering risk management requirements → BSI Group ISO 13485 Training — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

👉 Get ISO 13485 certified with an accredited certification body → ISOQAR ISO 13485 Certification — ISOQAR is a UKAS-accredited certification body, one of the most recognized in the industry for ISO 13485 certification.

What Is ISO 14971:2019?

Feature image for an ISO 14971 guide showing medical device risk management concepts, lifecycle risk controls, and the relationship between ISO 14971, ISO 13485, and FDA QMSR requirements. — ISO 14971 is the required risk management framework for medical devices, embedding risk analysis and control throughout the product lifecycle and supporting ISO 13485 and FDA QMSR compliance.

ISO 14971:2019 — Medical Devices: Application of Risk Management to Medical Devices — is the international standard defining the process for identifying hazards associated with medical devices, estimating and evaluating associated risks, controlling those risks, and monitoring the effectiveness of those controls throughout the device lifecycle.

The standard is published by the International Organization for Standardization and is recognized globally as the baseline risk management framework for medical device manufacturers. It applies to all device classes — from Class I low-risk devices through Class III implantables — and to every organization involved in the device lifecycle: manufacturers, component suppliers, contract manufacturers, and service providers.

ISO 14971 does one thing with precision: it defines a formal, documented, lifecycle-integrated process for managing risk in medical device development and manufacturing. Nothing else in the ISO 13485 framework tells you how to manage risk — that is ISO 14971’s job.

Key updates in the 2019 edition include clarified terminology aligned with ISO/IEC Guide 63, updated requirements for risk management plan documentation, strengthened requirements for production and post-production information, and enhanced guidance on benefit-risk analysis. The 2019 edition also removed references to ALARP (As Low As Reasonably Practicable) — replacing it with a more precise framework for determining risk acceptability. For the complete breakdown of what the standard requires, see What Is ISO 14971? — Complete Guide.

ISO 14971:2019 vs ISO 14971:2007 — Which Do You Need?

Situation	Edition to Purchase
New risk management program — first implementation	ISO 14971:2019
Currently using ISO 14971:2007 — planning update	ISO 14971:2019
Pursuing ISO 13485 certification	ISO 14971:2019
Subject to FDA QMSR (21 CFR Part 820)	ISO 14971:2019
EU MDR technical documentation	ISO 14971:2019
Researching risk management before committing	ISO 14971:2019

The answer in every case is ISO 14971:2019. The 2007 edition has been superseded. ISO 13485:2016 references ISO 14971 — and certification bodies audit against the current edition. The QMSR regulatory expectation is built on ISO 13485:2016, which requires current-edition conformance.

If your organization is still operating a risk management program built on ISO 14971:2007, purchasing the 2019 edition and conducting a gap assessment is your first step. The changes are substantive enough that a documented gap assessment is expected before your next certification audit.

→ ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026

Where to Buy ISO 14971:2019 — Official Sources Only

ISO standards are copyrighted intellectual property. They are not available as free downloads and must be purchased from authorized distributors. Every “free ISO 14971 PDF” circulating online is an unauthorized copy — typically an outdated 2007 edition, an incomplete document, or an altered version. Using an unauthorized copy for risk management program development introduces certification risk and potential regulatory exposure simultaneously.

Certification bodies audit against the precise wording of the current official standard. A risk management file built from an outdated or incomplete copy will generate nonconformances — costing far more in audit findings and corrective action cycles than the official document.

Provider	What You Get	Price Range	Best For	Link
ANSI Webstore	Official current edition, immediate PDF delivery, audit-accepted	$150–$200	U.S.-based organizations — official distributor, CC2026 coupon available	Buy Here
ISO.org Store	Official current edition directly from publisher	$158–$198	International buyers outside the U.S.	iso.org/store
ANSI Bundle Package	ISO 14971 + ISO 13485 + related standards	$300–$500	Organizations purchasing multiple medical device standards — significant savings	Bundle Here

Where to buy ISO standards comparison showing ANSI Webstore, ISO Store, and other resellers with pros and risks — Compare ANSI, ISO, and other sources to safely buy ISO standards for certification and compliance

ANSI Webstore is the recommended source for U.S.-based organizations. ANSI is the official U.S. distributor of ISO standards — purchasing through ANSI guarantees the current edition, complete document, licensed PDF with immediate delivery, and a recognized distributor credential accepted by all certification bodies and regulatory authorities.

→ Use coupon code CC2026 for 5% off ISO and IEC standards at the ANSI Webstore through December 31, 2026

At this point, most organizations purchasing ISO 14971 for the first time should: → Purchase the bundle including ISO 13485:2016 and ISO 14971:2019 together from ANSI Standard Packages — the savings over individual purchases typically cover the cost of training materials, and you need both documents on hand before implementation begins.

ISO 14971 Formats Available

Format	Price Range	Best For	Notes
Single-user PDF	$150–$200	Individual quality managers and risk managers	Immediate delivery, searchable — cannot be shared simultaneously
Printed copy	$170–$220	Risk management teams, controlled document environments	Useful for annotating during implementation — slightly higher cost
Multi-user license	Contact ANSI	Organizations with multiple simultaneous users	Required if multiple team members need access at the same time
Bundle with ISO 13485	$300–$500	Any organization implementing ISO 13485	Best value — you need both; bundle saves 30–50% vs individual

Single-user PDF is the most common choice for quality managers implementing risk management programs. It is immediately accessible after purchase, searchable by clause number, and sufficient for a single implementer building the risk management framework.

Important licensing rule: A single-user PDF license cannot legally be shared across your organization. If your risk management team, design engineers, and regulatory affairs personnel all need simultaneous access, a multi-user license is required. Sharing a single-user PDF via email or shared drive violates the license terms — a detail that is often overlooked during implementation and can create legal exposure.

If you are implementing both ISO 14971 and ISO 13485, purchase them as a bundle. You will need both on hand from day one of your gap assessment — and the bundle consistently saves more than the coupon alone.

→ ISO Standards Packages — Save up to 50%

How Much Does ISO 14971:2019 Cost?

Item	Typical Price	Notes
Single-user PDF	$150–$200	Standard purchase from ANSI Webstore
Printed copy	$170–$220	Physical copy for reference
Multi-user license	Varies	Contact ANSI for pricing
Bundle: ISO 14971 + ISO 13485	$300–$500	Saves 30–50% vs individual purchase
Bundle: ISO 14971 + ISO 13485 + ISO 13485 collection	$350–$600	Full medical device standards set

Use coupon CC2026 for 5% off at ANSI through December 31, 2026 → Apply at ANSI

In the context of total ISO 13485 certification costs — which range from $15,000 to $100,000+ for most organizations — the ISO 14971 standard purchase is the lowest-cost line item in your entire budget. It is also the one with the highest leverage on audit outcomes. A risk management file built from the correct current edition is foundational. Everything else in your QMS depends on it.

For the complete ISO 13485 certification cost breakdown, see How Much Does ISO 13485 Cost?

Who Needs to Purchase ISO 14971?

ISO 14971:2019 must be purchased by anyone responsible for building, implementing, auditing, or maintaining a medical device risk management program. Specifically:

Risk managers and quality managers building a risk management program from scratch or updating from ISO 14971:2007 — the standard is the only authoritative source for what the process requires. Implementing from a summary or training slide deck rather than the official document is one of the most common reasons risk management files fail certification audits.

Design engineers and product development teams at organizations with design responsibility — risk management under ISO 14971 begins at design input and runs through every design stage. Engineers performing hazard analysis, risk estimation, and risk control selection need the standard directly.

Internal auditors conducting ISO 13485 internal audits — you cannot audit risk management effectiveness against a standard you have not read. Clause 7.1, 7.3, and the full risk management integration requirements across ISO 13485 require familiarity with ISO 14971 clause requirements.

Regulatory affairs professionals preparing FDA QMSR compliance documentation or EU MDR technical files — both regulatory frameworks expect ISO 14971 conformance, and regulatory submissions are evaluated against the standard’s exact requirements.

Organizations currently certified to ISO 14971:2007 planning their 2019 edition gap assessment — purchasing the 2019 edition is step one. The gap assessment cannot be conducted without it.

If you are at this stage:

If you are a quality manager building your first ISO 14971-based risk management program → purchase ISO 14971:2019 and ISO 13485:2016 together from ANSI Standard Packages, then enroll your team in BSI Group ISO 13485 Training before documentation development begins.

If you are currently ISO 14971:2007 compliant and planning your 2019 transition → purchase the 2019 edition, conduct a documented gap assessment focused on the ALARP removal, updated risk acceptability criteria, and post-production information requirements, and update your risk management plan before your next surveillance audit.

If you are a component supplier entering the medical device supply chain → your OEM customer will require ISO 14971-aligned risk management as part of supplier qualification. Purchase the standard before your first supplier audit.

What ISO 14971 Does NOT Include

Understanding what you are not buying is as important as understanding what you are.

ISO 14971 does not provide device-specific risk acceptability criteria. The standard defines the process for determining risk acceptability — it does not tell you what the acceptable residual risk level is for your specific device. That determination is your organization’s responsibility, informed by applicable regulations, clinical data, and the state of the art.

ISO 14971 does not replace clinical evaluation. Risk management and clinical evaluation are complementary but distinct requirements under ISO 13485 and EU MDR. ISO 14971 covers the risk management process — clinical evaluation has its own standards and guidance documents.

ISO 14971 does not provide implementation templates. The standard defines requirements — your organization must build the risk management plan, hazard identification tools, risk estimation worksheets, and risk control documentation. For ready-to-use ISO 13485 QMS documentation including risk management templates, see 9001Simplified Documentation Kits. 9001Simplified provides ready-to-use documentation kits that dramatically reduce the internal labor required to build a compliant QMS from scratch.

ISO 14971 does not satisfy IEC 62304. Organizations developing medical device software need IEC 62304 — software lifecycle processes for medical devices — in addition to ISO 14971. The two standards work together but address different scopes.

Common Purchasing Mistakes to Avoid

Buying ISO 14971:2007 instead of ISO 14971:2019. The 2007 edition is superseded. Third-party sellers frequently carry outdated editions without clear disclosure. Always verify the edition year before completing a purchase. If a price seems unusually low, check the edition.

Downloading unauthorized copies. Every “free ISO 14971 PDF” found through a search engine is an unauthorized copy — typically the 2007 edition, an incomplete document, or an altered version. Using it for risk management program development introduces certification risk. The standard costs $150–$200. A major nonconformance at Stage 2 costs multiples of that in re-audit fees and timeline delays.

Purchasing without checking the edition date. Even on legitimate platforms, searching “ISO 14971” can surface the 2007 edition alongside the 2019 edition. Always confirm “ISO 14971:2019” before adding to cart.

Treating ISO 14971 as a design-only requirement. The most common QMSR and ISO 13485 gap is a risk management program that lives only in design files. Under QMSR, risk-based thinking extends across supplier qualification, production processes, CAPA, complaint handling, and post-market surveillance. Purchasing the standard is step one — reading Clauses 3, 8, and 9 in their entirety is what reveals the full scope of implementation required.

Sharing a single-user PDF with your team. A single-user license covers one user. Sharing via email or shared drive violates the license terms. If multiple team members need simultaneous access, purchase a multi-user license.

Purchasing ISO 14971 without ISO 13485. ISO 14971 does not stand alone in a medical device QMS context. It is a required companion to ISO 13485 — and you need both documents to implement either correctly. Purchase them together.

At this point, most organizations who have identified they need ISO 14971 should: → Purchase the ISO Standards Bundle including ISO 14971:2019 and ISO 13485:2016 together — this is the lowest-cost, most operationally complete starting point for any medical device risk management implementation.

Why Organizations Delay This — And What It Costs Them

The most common reason manufacturers delay purchasing ISO 14971 and building a compliant risk management program is the belief that it can be addressed “during the certification project.”

Here is what consistently happens instead:

Organizations that arrive at Stage 1 of their ISO 13485 certification audit without a documented, ISO 14971-based risk management program receive a major nonconformance — delaying Stage 2 by 3–6 months and adding $5,000–$15,000 in re-audit fees and consultant costs. The risk management file is one of the first things a certification body auditor reviews.

Under QMSR, the stakes are higher. FDA investigators under CP 7382.850 use the risk management file as their inspection roadmap. An absent or inadequate risk management program does not just generate a finding — it gives the inspector a thread to pull through design controls, CAPA, and supplier qualification simultaneously.

The organizations that move first — purchasing the standard, conducting the gap assessment, and building ISO 14971 integration across the QMS before the certification audit — consistently report shorter audit cycles, fewer findings, and lower total certification costs. The ones that treat risk management as a later step discover that it is actually the foundation everything else is audited against.

📥 Free ISO 13485 & ISO 14971 Implementation Checklist — Identify your top 5 risk management gaps before your certification audit. → [Download Free Checklist]

ISO 14971 does not operate in isolation. Organizations building a medical device QMS will need these companion standards:

Standard	Purpose	Relationship to ISO 14971	Where to Buy
ISO 13485:2016	Medical device QMS requirements	Requires ISO 14971 throughout — cannot be implemented without it	ANSI Webstore
ISO/TR 24971:2020	Guidance on ISO 14971 application	Non-mandatory companion — practical guidance on applying ISO 14971 requirements	ANSI Webstore
IEC 62304	Software lifecycle for medical devices	Complements ISO 14971 for software risk management	ANSI Webstore
ISO 9001:2015	General QMS foundation	Useful reference for organizations building ISO 13485 on an existing ISO 9001 foundation	ANSI Webstore

Organizations implementing ISO 13485 for the first time should prioritize: ISO 14971:2019 + ISO 13485:2016. These two documents together define what your QMS must do and how risk must be managed within it.

→ Save up to 50% on ISO Standards Packages — ANSI Webstore

Frequently Asked Questions

What is ISO 14971:2019?

ISO 14971:2019 is the current edition of the international standard for risk management for medical devices. It defines the process for identifying hazards associated with medical devices, estimating and evaluating risks, implementing risk controls, and monitoring effectiveness throughout the device lifecycle. It is a required companion standard to ISO 13485:2016.

Is ISO 14971 required for ISO 13485 certification?

Yes — ISO 13485 explicitly requires risk management per ISO 14971 throughout the QMS. Certification bodies audit risk management processes against ISO 14971 requirements. Under the FDA’s QMSR, ISO 14971 conformance is embedded in U.S. regulatory expectations for all manufacturers subject to 21 CFR Part 820.

What is the difference between ISO 14971:2019 and ISO 14971:2007?

The 2019 edition clarified terminology, updated the risk acceptability framework by removing ALARP references, strengthened post-production information requirements, and enhanced benefit-risk analysis guidance. Any organization currently using the 2007 edition should conduct a gap assessment and transition to the 2019 edition before their next certification audit.

Where is the best place to buy ISO 14971:2019?

The ANSI Webstore is the recommended source for U.S. organizations — it is the authorized U.S. distributor for ISO standards and guarantees the current edition. Use coupon CC2026 for 5% off through December 31, 2026. → ISO 14971:2019 — ANSI Webstore

Can I share my ISO 14971 PDF with my design team?

No — a single-user PDF license cannot be shared simultaneously. If multiple team members need access at the same time, purchase a multi-user license or individual copies. Physically sharing a printed copy sequentially is permitted.

Do I need both ISO 14971 and ISO 13485?

Yes. ISO 14971 and ISO 13485 are required companions — neither can be fully implemented without the other. ISO 13485 defines your QMS framework; ISO 14971 defines how risk must be managed within it. Purchase them together for the best value. → ISO Standards Packages — Save up to 50%

Does ISO 14971 apply to software?

ISO 14971 applies to risk management for medical devices including software as a medical device (SaMD). For the software development lifecycle specifically, IEC 62304 is the companion standard. Risk management under ISO 14971 and software lifecycle management under IEC 62304 are intended to be implemented together.

What is ISO/TR 24971?

ISO/TR 24971:2020 is a technical report providing guidance on the application of ISO 14971. It is not a requirement — it is a non-mandatory companion document offering practical interpretation and application examples. Organizations new to ISO 14971 often find it valuable alongside the standard itself.

How much does ISO 14971:2019 cost?

A single-user PDF typically costs $150–$200 from the ANSI Webstore. Use coupon CC2026 for 5% off through December 31, 2026. Bundles including ISO 14971 with ISO 13485 offer savings of 30–50% compared to individual purchases.

📥 Free Resources

👉 Free ISO 13485 & ISO 14971 Implementation Checklist — Verify every required risk management document is in place before your certification audit 👉 Manufacturing Compliance Checklist — Assess your current compliance status across quality, environmental, and safety requirements 👉 Supplier Quality Checklist — Supplier qualification requirements applicable to medical device supply chains

Not Sure What to Do Next?

◆ You need the official ISO 14971:2019 standard → ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026

◆ You need the required companion standard ISO 13485:2016 → ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off

◆ You want to save buying both standards together → Save up to 50% on ISO Standards Packages — ANSI Webstore

◆ You need ISO 13485 training covering risk management requirements → BSI Group ISO 13485 Training

◆ You are ready to pursue ISO 13485 certification → ISOQAR ISO 13485 Certification

◆ You want to understand what ISO 14971 requires → What Is ISO 14971? — Complete Guide

◆ You want to understand the full FDA QMSR transition → FDA QSR vs ISO 13485: The Complete QMSR Transition Guide

◆ You want to understand how ISO 9001 and ISO 13485 differ → ISO 9001 vs ISO 13485 — Key Differences

◆ You want to understand what ISO 13485 requires → What Is ISO 13485? — Complete Guide

◆ You want to understand certification costs → How Much Does ISO 13485 Cost? → ISO Certification Cost Calculator

◆ You want to choose the right certification body → Best ISO Certification Bodies — Ranked & Reviewed

Still figuring out where to start?

If you are not ready to purchase yet — that is normal. ISO 14971 implementation decisions typically take 2–4 weeks from first research to commitment as organizations assess their current risk management program against what certification auditors expect.

The best next step for most organizations at this stage: → Download the free ISO 13485 & ISO 14971 Implementation Checklist — it takes 20 minutes and tells you exactly where your gaps are before you spend anything.

📥 [Download Free Checklist]

The Standard That Makes Everything Else Auditable

ISO 14971 is not a box to check. It is the document that makes every other part of your medical device QMS auditable — design controls, CAPA, supplier qualification, complaint handling, and post-market surveillance all connect back to the risk management file when a certification auditor or FDA investigator starts pulling threads.

Organizations that purchase the official standard, read it completely, and build their risk management program against its actual requirements consistently report fewer findings, shorter audit cycles, and lower total certification costs. The ones that work from summaries, training slides, or outdated editions discover those shortcuts at the worst possible moment.

The standard costs $150–$200. A failed Stage 2 audit costs multiples of that. Buy the official edition.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

👉 Get updates on new standards, implementation strategies, and compliance insights 👉 Be first to access new guides, tools, and checklists

Subscribe below to stay ahead.

ISO 14971 vs ISO 13485: What’s the Difference and How Do They Work Together? (2026 Guide)

ISO 13485 requires risk management throughout the quality management system. ISO 14971 defines exactly how that risk management must be conducted. This guide covers the precise differences between the two standards, where they integrate clause by clause, and what the FDA’s QMSR means for both.

Last Updated: May 2026

ISO 13485 requires risk management. ISO 14971 defines how to do it. Understanding the precise relationship between these two standards — and what it means under the FDA’s QMSR — is the difference between a QMS that holds up under inspection and one that doesn’t.

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

📋 Free Download: ISO 13485 Gap Assessment Checklist Identify your compliance gaps before your first audit — 64 items across 7 sections including ISO 14971 risk management integration and all four FDA QMSR bridge requirements. Download Free Checklist

ISO 13485 Tells You to Manage Risk. ISO 14971 Tells You How.

That single sentence is the most important thing to understand about the relationship between these two standards — and it’s the part most manufacturers either misread or oversimplify.

ISO 13485:2016 is a quality management system standard. It requires risk-based thinking throughout the QMS — in design and development planning, production controls, supplier controls, complaint handling, and post-market surveillance. It references ISO 14971 in a note to Clause 7.1. But it does not specify how risk management must be conducted. It tells you risk management is required. ISO 14971 tells you how to do it.

ISO 14971:2019 is a risk management standard. It provides the structured framework — hazard identification, risk estimation, risk evaluation, risk control, overall residual risk evaluation, risk management review, and post-production monitoring — that gives ISO 13485’s risk management requirements their practical content.

Together they form the twin pillars of medical device quality and safety assurance. Neither is complete without the other for a manufacturer operating in any major regulated market. And under the FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, the relationship between the two standards now carries federal regulatory weight.

In This Guide

What ISO 13485 covers and what it requires on risk
What ISO 14971 covers and what it adds
The key differences between the two standards
The precise points where ISO 13485 references ISO 14971
The important nuance about whether ISO 14971 is truly mandatory
How the FDA QMSR changes the practical answer to that question
How to implement both standards together
Which standard to buy first and why
Frequently asked questions

✅ Start Here (Top Resources)

📋 Buy ISO 13485:2016 (official standard) → ANSI Webstore — ANSI is the official U.S. distributor of ISO standards, ensuring you receive the controlled, compliant version required for certification audits. Use coupon CC2026 for 5% off.

📋 Buy ISO 14971:2019 (required companion) → ANSI Webstore — Purchase both standards together for maximum savings. Use coupon CC2026 for 5% off.

📋 Save buying both standards → ISO Standards Bundles — Up to 50% Off — Purchasing ISO 13485 and ISO 14971 as a bundle through the ANSI Webstore saves significantly compared to individual purchases.

📋 Get ISO 13485 trained before implementation → BSI Group ISO 13485 Training — BSI Group is a founding member of ISO and one of the world’s largest providers of ISO training courses, recognized by certification bodies globally.

📋 Get ISO 13485 certified → ISOQAR ISO 13485 Certification — ISOQAR is a UKAS-accredited certification body — one of the most recognized in the industry for ISO management system certification.

What Is ISO 13485?

Medical device quality management infographic showing ISO 13485 certification concept with medical equipment and headline “What Is ISO 13485? Complete Guide (2026)”. — ISO 13485 defines the quality management system requirements for medical device manufacturers, focusing on regulatory compliance, risk management, and consistent product quality.

ISO 13485:2016 is the international standard for quality management systems specific to the medical device industry. It specifies requirements for a QMS that enables an organization to consistently design, develop, produce, and deliver safe and effective medical devices and related services.

ISO 13485 is used as the baseline QMS framework by regulatory authorities and certification bodies in most major medical device markets — including Health Canada, the EU MDR, MDSAP, and since February 2, 2026, the FDA’s QMSR under 21 CFR Part 820.

ISO 13485 covers the full scope of quality management system requirements:

Context of the organization and QMS scope
Management responsibility, quality policy, and management review
Resource management — personnel, infrastructure, and work environment
Product realization — design and development, purchasing, production, and service provision
Measurement, analysis, and improvement — internal audits, complaint handling, CAPA, and corrective action

What ISO 13485 requires on risk: ISO 13485 requires risk-based thinking throughout the quality management system. Risk management must be planned as part of product realization (Clause 7.1), integrated into design and development (Clause 7.3), applied to supplier controls (Clause 7.4), and fed by post-market surveillance feedback (Clause 8.2). The standard references ISO 14971 explicitly in its Clause 7.1 note and implicitly throughout its design and development requirements.

What ISO 13485 does not do is specify the methodology for risk management. It does not define how to identify hazards, estimate risks, evaluate acceptability, or control residual risk. That is what ISO 14971 does.

For a complete overview of ISO 13485 requirements, see What Is ISO 13485? Complete Guide.

What Is ISO 14971?

ISO 14971:2019 is the international standard for the application of risk management to medical devices. It provides the structured methodology — terminology, principles, and process — for identifying hazards, estimating and evaluating risks, implementing risk controls, and monitoring risk throughout the entire device lifecycle.

ISO 14971 covers:

Risk management planning — scope, lifecycle phases, risk acceptability criteria
Hazard identification — under both normal use and fault conditions
Risk estimation — probability of harm and severity of harm
Risk evaluation — comparison against acceptability criteria
Risk control — priority order: design, protective measures, information for safety
Evaluation of overall residual risk — including benefit-risk analysis where required
Risk management review — pre-release review with identified reviewers
Production and post-production information — systematic feedback into the risk management file

What ISO 14971 adds beyond ISO 13485: While ISO 13485 says risk management is required throughout the QMS, ISO 14971 specifies exactly how that risk management must be structured, documented, and maintained. The Risk Management File (RMF) — the central documentation output of the ISO 14971 process — is the evidence base that demonstrates a manufacturer has systematically identified hazards, evaluated risks, implemented controls, and monitored effectiveness.

For a complete overview of ISO 14971 requirements, see What Is ISO 14971? Risk Management for Medical Devices Explained.

ISO 14971 vs ISO 13485 — Key Differences

Element	ISO 13485:2016	ISO 14971:2019
Standard type	Quality management system standard	Risk management standard
Purpose	Define QMS requirements for medical device manufacturers	Define the risk management process for medical devices
Scope	Entire quality management system	Risk management specifically
Risk coverage	Requires risk-based thinking throughout QMS	Specifies how risk management must be conducted
Key output	Certified, compliant QMS	Risk Management File (RMF)
Certification	Certifiable — third-party certification available	Not certifiable on its own
Published by	ISO Technical Committee 210 (ISO/TC 210)	ISO Technical Committee 210 (ISO/TC 210)
Current edition	ISO 13485:2016	ISO 14971:2019
Applies to	Manufacturers, suppliers, contract manufacturers	All organizations involved in device lifecycle
Risk methodology	Not specified	Six-step structured process
Hazard analysis	Referenced but not detailed	Defined in detail
Risk Management File	Not specified	Required
Benefit-risk analysis	Not addressed	Required when overall residual risk is unacceptable
Post-production monitoring	Addressed through complaint handling and feedback	Explicitly required as ongoing RMF input
QMSR status	Incorporated by reference into 21 CFR Part 820	Expected framework; referenced through ISO 13485

Best for:

ISO 13485: Any organization that designs, manufactures, or supplies medical devices and needs a certified quality management system
ISO 14971: The same organizations — it provides the risk management methodology that ISO 13485’s requirements assume is in place

Where ISO 13485 References ISO 14971

Infographic mapping ISO 13485 clauses to corresponding ISO 14971 risk management requirements, showing how quality management processes trigger risk management activities across the medical device lifecycle. — ISO 13485 establishes quality system requirements, while ISO 14971 provides the risk management framework that connects planning, design, purchasing, feedback, and improvement activities throughout the medical device lifecycle.

ISO 13485 references ISO 14971 at specific points throughout its clause structure. Understanding exactly where these references occur is critical for building a compliant integrated system.

Clause 7.1 — Planning of Product Realization

Clause 7.1 requires that risk management activities be planned as part of product realization. The note to this clause states: “Further information can be found in ISO 14971.” This is the most direct reference to ISO 14971 in the standard.

Clause 7.3 — Design and Development

The design and development requirements of ISO 13485 are where ISO 14971 integration is most intensive. Design inputs must include risk management outputs. Design verification and validation activities must address risks. The Design and Development File (DDF) must reference risk management records.

Clause 7.4 — Purchasing

ISO 13485 Clause 7.4 requires that purchasing controls be proportionate to the risk the external provider poses to the finished device. The extent of supplier qualification, incoming inspection, and monitoring is determined by risk — which requires a risk framework to apply.

Clause 8.2 — Monitoring and Measurement

Post-market surveillance and complaint handling data collected under Clause 8.2 must feed back into the risk management process. ISO 14971 Clause 11 (Production and Post-Production Information) specifies how this information must be systematically reviewed and how it triggers updates to the Risk Management File.

Clause 8.5 — Improvement

CAPA activities under Clause 8.5 must consider risk. Significant quality failures identified through corrective action must evaluate whether the risk management file needs to be updated — connecting the two standards at the improvement level of the QMS.

At this point, most organizations beginning ISO 13485 implementation should:

📋 Purchase both ISO 13485:2016 and ISO 14971:2019 together as a bundle — the clause-by-clause integration means implementing one without the other creates immediate documentation gaps that auditors will identify.

→ ISO Standards Bundle — ANSI Webstore — Save up to 50% purchasing both standards together

Is ISO 14971 Actually Mandatory Under ISO 13485?

This is one of the most debated questions in the medical device quality community, and the honest answer is more nuanced than most articles present.

The technical answer: ISO 14971 is not formally mandated by ISO 13485. The reference in Clause 7.1 is a note — informative guidance, not a normative requirement. A manufacturer could theoretically implement a risk management process using a different methodology and still demonstrate conformance to ISO 13485’s risk-based requirements.

The practical answer: In the real world, ISO 14971 is effectively mandatory for any organization pursuing ISO 13485 certification or operating in regulated markets. Here’s why:

Certification bodies expect it. When a UKAS-accredited certification body audits your ISO 13485 QMS, the auditors evaluating your risk management program will be assessing it against the ISO 14971 framework — because that is the internationally recognized methodology for medical device risk management. A risk management program that doesn’t follow ISO 14971’s structure will face significant findings regardless of the technical argument about normative versus informative references.

Regulatory bodies reference it. The EU MDR, Health Canada, TGA, and MDSAP all reference ISO 14971 as the expected risk management framework. Operating without it creates regulatory exposure in every major market.

FDA QMSR changes the equation significantly — which brings us to the most important development of 2026.

The QMSR Changes the Practical Answer

The FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, incorporated ISO 13485:2016 by reference into 21 CFR Part 820. Since ISO 13485 explicitly references ISO 14971, that reference now carries federal regulatory weight.

Under the FDA’s new inspection program — Compliance Program 7382.850 — FDA investigators are expected to start inspections by reviewing the risk management file and following risk documentation into other quality system areas. The risk management file is the inspection roadmap. If your risk management program is not structured against ISO 14971, your risk management file will not hold up under that inspection approach.

Additionally, the QMSR extended risk management expectations beyond design controls — where the old QSR concentrated them — to the entire quality system. This is precisely what ISO 14971 requires: risk management planning, hazard identification, risk control, and post-production monitoring integrated across the device lifecycle, not just in the design phase.

The bottom line under QMSR: Whether or not ISO 14971 is technically mandatory in the normative sense of ISO 13485, it is the framework FDA investigators will use to evaluate your risk management program. Operating without it under the current inspection regime is an inspection liability.

⚠️ QMSR effective February 2, 2026: If your risk management program is not built on the ISO 14971 framework, this is your highest-priority gap for QMSR compliance.

For the complete QMSR transition guide, see FDA QSR vs ISO 13485 — The Complete QMSR Transition Guide.

How the Two Standards Work Together in Practice

The integration of ISO 13485 and ISO 14971 is not a separate parallel process — it is woven into how the QMS functions. Here is how the two standards interact at each stage of the device lifecycle:

Concept and Planning Stage

ISO 13485 Clause 7.1 requires risk management to be planned as part of product realization. ISO 14971 provides the Risk Management Plan — the document that defines scope, lifecycle phases, risk acceptability criteria, and the methods that will be used throughout the device’s life.

Design and Development

ISO 13485 Clause 7.3 requires design inputs to include risk management outputs and design outputs to be reviewed against inputs. ISO 14971 provides hazard identification and risk analysis — the outputs of which flow directly into design input requirements, design verification criteria, and design validation protocols.

Purchasing and Supplier Controls

ISO 13485 Clause 7.4 requires supplier controls proportionate to supplier risk. ISO 14971’s risk framework defines what “risk” means in this context — the severity and probability of harm that could result from supplier failures. Risk level drives supplier classification, incoming inspection intensity, and qualification requirements.

Production

ISO 13485 Clause 7.5 requires controlled production conditions and validation of special processes. Risk management under ISO 14971 determines which processes require validation (those where outputs cannot be fully verified) and what monitoring is required during production.

Post-Market Surveillance and CAPA

ISO 13485 Clause 8.2 requires systematic collection of post-market information. ISO 14971 Clause 11 requires that production and post-production information be systematically reviewed and fed back into the risk management file. When complaint data or CAPA findings reveal new hazards or indicate that risk estimates were incorrect, the Risk Management File must be updated.

This is where the most common gap exists in practice: organizations that treat risk management as a design-phase deliverable and do not maintain the connection between post-market data and the risk management file. Under QMSR, this gap is visible to FDA investigators within the first day of an inspection.

📋 Free Download: ISO 13485 Gap Assessment Checklist Section 6 covers ISO 14971 risk management integration specifically — risk management plan requirements, RMF structure and completeness, post-production feedback, and QMSR inspection implications. Download Free Checklist

The Risk Management File — Where They Intersect Most Clearly

Infographic comparing ISO 9001 risk-based thinking with ISO 13485 and ISO 14971 medical device risk management requirements using an integrated Venn diagram layout. — Both standards require risk management — but the depth and formality differ significantly. ISO 9001 uses general risk-based thinking, while ISO 13485 requires formal medical device risk management aligned with ISO 14971 throughout the product lifecycle.

The Risk Management File (RMF) is the single most important integration point between ISO 13485 and ISO 14971. It is the documentation output of the ISO 14971 process, and it is the record that connects risk management to every other element of the ISO 13485 QMS.

The RMF is not a single document. It is an organized collection of records that includes:

Risk Management Plan — scope, lifecycle phases, acceptability criteria, methodology
Risk analysis records — hazard identification, risk estimation
Risk evaluation records — comparison against acceptability criteria
Risk control records — selected measures, implementation records, verification
Overall residual risk evaluation — benefit-risk analysis where required
Risk Management Review — pre-release review with identified reviewers
Post-production information records — systematic review of real-world performance data

Under ISO 13485, the DDF (Design and Development File) must contain or reference risk management records. Under the QMSR and CP 7382.850, the RMF is where FDA investigators begin their inspection — tracing risk documentation into design controls, CAPA, complaint handling, and post-market surveillance.

A Risk Management File that was completed at device release and has not been updated since is one of the most common and most significant findings under the current inspection approach. The RMF is a living document. It must be updated throughout the device’s commercial life as post-production information is gathered and evaluated.

If your organization is already ISO 13485 certified and is assessing QMSR readiness, the current state of your Risk Management File is the single most important thing to evaluate first.

At this point, most organizations preparing for QMSR inspection should:

📋 Conduct a formal review of whether your Risk Management File has been updated since device release — and whether post-market complaint and CAPA data is systematically feeding into it. This is the highest-frequency inspection gap under CP 7382.850.

From the Shop Floor

After 25 years in heavy industrial manufacturing and quality systems, the most consistent pattern I see when organizations implement both ISO 13485 and ISO 14971 is this: they implement risk management well during design and development, and then they stop.

The Risk Management File is completed before device release. The risk management review is signed off. The certification audit passes. And then for the next three years, every complaint, every CAPA, every production nonconformance is handled in its own system — with no connection back to the risk management file that is supposed to be the living record of everything known about how the device can cause harm.

Three years later, an FDA investigator arrives under CP 7382.850 with the risk management file as their starting point. They trace a complaint about device malfunction into the CAPA system. They find a corrective action that was opened and closed. They look for the connection back to the risk management file — the evaluation of whether this complaint revealed a new hazard or indicated that an existing risk estimate was incorrect. The connection doesn’t exist.

That is not an ISO 13485 finding. It is not an ISO 14971 finding. It is a QMSR finding, because under the QMSR that connection is an expected element of a functioning integrated quality and risk management system.

The organizations that handle this well are the ones that treat the RMF update as a standing agenda item in management review — not a corrective action triggered by an audit finding. Post-market data goes into the RMF review process because the system requires it, not because an investigator asked for it.

That is what the integration of ISO 13485 and ISO 14971 is supposed to produce. It is also what separates manufacturers who pass inspections from those who merely survive them.

Which Standard Do You Buy First?

Both ISO 13485 and ISO 14971 are required for any serious medical device quality management implementation. The practical question is which to acquire and read first.

Buy ISO 13485 first if your organization is beginning the certification journey. ISO 13485 defines the overall QMS framework — understanding its requirements first gives you the context for understanding where and why ISO 14971 integrates.

Buy ISO 14971 immediately after — or together as a bundle. You cannot build a compliant risk management program from summaries or paraphrases. Both standards must be purchased, controlled as external documents within your QMS (as required under QMSR), and read by the people building your system.

For a complete overview of available medical device standards, see the Standards Library — Medical Devices Section.

The bundle option saves significantly. The ANSI Webstore offers the ISO 13485 and ISO/TR 14969 Quality Management Systems Medical Devices Package which includes both documents together at a meaningful discount versus individual purchases.

📋 ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off

📋 ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off

📋 ISO Standards Bundle — Save up to 50%

Frequently Asked Questions

What is the main difference between ISO 14971 and ISO 13485?

ISO 13485 is a quality management system standard that defines what a medical device manufacturer’s QMS must cover — including the requirement that risk management be applied throughout the system. ISO 14971 is a risk management standard that defines how risk management must be conducted — the six-step process, the required documentation, and the Risk Management File structure. ISO 13485 requires risk management. ISO 14971 specifies how to do it.

Is ISO 14971 required if you have ISO 13485?

ISO 14971 is not formally mandated by ISO 13485’s normative requirements — the reference in Clause 7.1 is a note, not a normative requirement. However, certification bodies evaluate risk management programs against the ISO 14971 framework, and under the FDA’s QMSR (effective February 2, 2026), risk management expectations now carry federal regulatory weight. For practical purposes, ISO 14971 is effectively required for any organization pursuing ISO 13485 certification or operating in regulated markets.

Can you be certified to ISO 14971?

No. ISO 14971 is not a certifiable standard — there is no third-party certification to ISO 14971 itself. ISO 13485 is the certifiable standard. However, ISO 13485 certification implicitly requires that risk management is conducted in a way consistent with ISO 14971, since that is the framework certification bodies evaluate against.

Which came first — ISO 13485 or ISO 14971?

Both standards have long histories. ISO 14971 was first published in 2000, with major revisions in 2007 and 2019. ISO 13485 was first published in 1996, revised in 2003, and again in 2016. The 2016 edition of ISO 13485 was developed with the intent of aligning more closely with the 2012 draft of ISO 14971, ensuring stronger integration between the two standards.

Does ISO 14971 apply to software as a medical device?

Yes. ISO 14971:2019 explicitly applies to Software as a Medical Device (SaMD). The companion document ISO/TR 24971 provides specific guidance on applying ISO 14971 to software, including cybersecurity risk considerations.

How does the QMSR affect the relationship between ISO 13485 and ISO 14971?

The QMSR (effective February 2, 2026) incorporated ISO 13485 by reference into 21 CFR Part 820. Since ISO 13485 references ISO 14971, that reference now carries federal regulatory weight. FDA investigators under the new Compliance Program 7382.850 start inspections with the risk management file — which is the primary output of the ISO 14971 process. The QMSR also extended risk management expectations across the entire QMS rather than concentrating them in design controls as the old QSR did.

What is the Risk Management File and which standard requires it?

The Risk Management File (RMF) is the organized collection of records that documents all risk management activities for a specific medical device — risk management plan, hazard analysis records, risk evaluation records, risk control records, overall residual risk evaluation, risk management review, and post-production information records. It is required by ISO 14971, not ISO 13485 directly. However, under ISO 13485, the Design and Development File must contain or reference risk management records — and under the QMSR, the RMF is what FDA investigators use as their inspection roadmap.

Do I need ISO/TR 24971 as well?

ISO/TR 24971:2020 is the technical report companion to ISO 14971:2019. It provides practical guidance on implementing ISO 14971’s requirements — methods for hazard identification, risk estimation, benefit-risk analysis, and software risk management. Unlike ISO 14971, it is guidance rather than a standard with requirements. For organizations building or rebuilding their risk management program, ISO/TR 24971 is a valuable implementation companion. It is not required, but it is practically useful.

How does ISO 14971 differ from ISO 31000?

ISO 14971 is specific to medical device risk management and defines risk in terms of patient harm — the combination of probability and severity of harm to people. ISO 31000 is a broader enterprise risk management standard with a wider definition of risk that includes any effect on objectives. The two are not interchangeable in the medical device context. ISO 14971 is the expected framework for medical device risk management. ISO 31000 is not.

✅ Free Resources

📋 ISO 13485 Gap Assessment Checklist — 64 items across 7 sections including ISO 14971 risk management integration requirements and all four FDA QMSR bridge requirements. Identify your gaps before your first audit.

📋 Manufacturing Compliance Checklist — ISO 9001, 14001, 45001 & OSHA — 50 items with gap scoring across all compliance systems.

📋 Supplier Quality Checklist — ISO 9001 Clause 8.4 — all supplier controls auditors evaluate, 45 items with scoring.

📋 ISO 9001 Implementation Roadmap — The exact 5-phase process from gap assessment to Stage 2 audit clearance.

Not Sure What to Do Next?

✅ You need the official ISO 13485:2016 standard 📋 ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off

✅ You need the official ISO 14971:2019 standard 📋 ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off

✅ You want to save buying both standards together 📋 ISO Standards Bundle — ANSI Webstore — Save up to 50%

✅ You want to identify your ISO 13485 and QMSR compliance gaps before spending anything 📋 Download the Free ISO 13485 Gap Assessment Checklist

✅ You need ISO 13485 training before implementation 📋 ISO 13485 Training — BSI Group

✅ You are ready to pursue ISO 13485 certification 📋 ISOQAR ISO 13485 Certification

✅ You want to understand what ISO 13485 requires 📋 What Is ISO 13485? Complete Guide

✅ You want to understand what ISO 14971 requires 📋 What Is ISO 14971? Risk Management for Medical Devices

✅ You want to understand the FDA QMSR and its impact 📋 FDA QSR vs ISO 13485 — The Complete QMSR Transition Guide

✅ You want to compare ISO 9001 and ISO 13485 📋 ISO 9001 vs ISO 13485 — Key Differences

✅ You want to understand ISO 13485 purchase options and cost 📋 Buy ISO 13485 — Complete Guide 📋 How Much Does ISO 13485 Cost?

✅ You want to browse all available medical device standards 📋 Standards Library — Medical Devices & Regulated Manufacturing 📋 Popular Standards — Most Frequently Purchased

Still Figuring Out Where to Start?

If you’re not ready to purchase or certify yet — that’s normal. ISO 13485 and ISO 14971 implementation decisions typically take three to six months from first research to commitment.

The best next step for most organizations at this stage:

📋 Download the free ISO 13485 Gap Assessment Checklist — it covers all 64 clause requirements including the ISO 14971 integration section and the four QMSR bridge requirements. It takes 30 minutes and tells you exactly where your gaps are before you spend anything.

Download Free Checklist — No Cost

ISO 13485 and ISO 14971 Are Not Optional to Each Other

ISO 13485 tells you risk management is required across your quality management system. ISO 14971 tells you how to conduct it. One without the other produces either a QMS with undefined risk methodology or a risk management program without a quality system framework to integrate it.

Under the FDA’s QMSR, effective February 2, 2026, that integration is no longer just a best practice — it is what federal regulatory inspection expects. FDA investigators start with the risk management file. They follow it into design controls, CAPA, complaint handling, and post-market surveillance. A quality management system that treats risk management as a design-phase deliverable rather than a lifecycle discipline will not hold up under that inspection approach.

The organizations that get this right are the ones that treat the Risk Management File as a living operational document — not a certification artifact. They update it because post-market data flows into it systematically. They connect CAPA to it because the system requires the connection. They identify new hazards from real-world performance data because that is what ISO 14971 Clause 11 requires and what QMSR now enforces.

That is what implementing both standards properly actually produces.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

✅ Get updates on new standards, implementation strategies, and compliance insights ✅ Be first to access new guides, tools, and checklists

Subscribe below to stay ahead.

What Is ISO 14971? Risk Management for Medical Devices Explained (2026 Guide)

ISO 14971 is not optional supplementary guidance for ISO 13485 — it is the required risk management framework woven throughout the medical device lifecycle. This guide covers what ISO 14971:2019 requires clause by clause, how its six-step process works across the device lifecycle, what changed in the 2019 edition, and why the FDA’s QMSR makes a well-maintained Risk Management File more critical than ever.

ISO 14971 is not optional supplementary guidance for ISO 13485 — it is the required risk management framework woven throughout the medical device lifecycle. Here’s what it requires, how it works, and why the FDA’s QMSR makes understanding it more important than ever.

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

From the Shop Floor

Risk management in manufacturing is not a new concept. Every process engineer who has ever run a failure modes and effects analysis on a production line understands the core logic: identify what can go wrong, estimate how likely it is and how bad it would be, put controls in place, and verify those controls work.

What ISO 14971 adds to that foundation is structure, lifecycle scope, and documentation discipline.

After 25 years in heavy industrial manufacturing — including quality systems, process control, and operational risk — the single most consistent gap I see in medical device risk management is the treatment of the Risk Management File as a design-phase deliverable rather than a living operational document. Teams build an impressive RMF during product development, get through their certification audit, and then let the file sit static while the real world generates new information about how the device actually performs.

That approach worked well enough under the old QSR. It does not work under the QMSR.

FDA investigators under CP 7382.850 are not looking at your RMF to confirm it was done — they are using it as a roadmap to evaluate whether your entire quality system is functioning as an integrated risk management framework. A risk management file that hasn’t been updated since device release is not a minor documentation gap. It is evidence that your risk management process is not integrated with complaint handling, CAPA, and post-market surveillance the way the QMSR requires.

The organizations I have seen handle this well treat the RMF update as a standing agenda item in management review — not a corrective action triggered by an audit finding. If post-market data is generating complaints, those complaints are being evaluated in the context of the risk management file every quarter. That is the operating model QMSR expects.

ISO 14971 Is the Standard Your QMS Is Already Required to Implement

If you are pursuing ISO 13485 certification, operating under the FDA’s QMSR, or manufacturing medical devices for any major regulated market, ISO 14971 is not a standard you get to choose whether to implement.

ISO 13485:2016 explicitly requires risk management per ISO 14971 throughout the medical device lifecycle — in design controls, production processes, supplier controls, complaint handling, and post-market surveillance. Under the FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, that requirement now carries federal regulatory weight. FDA investigators under Compliance Program 7382.850 are expected to use the risk management file as their inspection roadmap.

Yet despite being one of the most referenced standards in medical device regulation, ISO 14971 remains one of the least understood. Most manufacturers know it exists. Far fewer understand what it actually requires, how its six-step process works across the device lifecycle, or why the 2019 edition introduced changes that many organizations still haven’t fully implemented.

This guide covers all of it — what ISO 14971 is, what it requires clause by clause, how it integrates with ISO 13485 and the QMSR, and what your risk management program needs to look like in practice.

In This Guide

What ISO 14971 is and why it exists
Who needs ISO 14971
The six-step ISO 14971 risk management process
Key clause-by-clause breakdown
What changed in the 2019 edition
The Risk Management File — what it contains and how it’s structured
ISO 14971 and ISO 13485 — how they integrate
ISO 14971 under the FDA QMSR
ISO/TR 24971 — the companion guidance document
How to buy the official standard
Frequently asked questions

✅ Start Here (Top Resources)

📋 Purchase the official ISO 14971:2019 standard → ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026

📋 Purchase the official ISO 13485:2016 standard — required companion → ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off

📋 Save up to 50% buying both standards as a bundle → ISO Standards Packages — ANSI Webstore

📋 Get ISO 13485 training that covers ISO 14971 integration → BSI Group ISO 13485 Training

📋 Get ISO 13485 certified with an accredited certification body → ISOQAR ISO 13485 Certification

What Is ISO 14971?

ISO 14971 is the international standard for the application of risk management to medical devices. The current version — ISO 14971:2019 — is the third edition, published in December 2019. It specifies the terminology, principles, and a structured process for identifying hazards associated with medical devices, estimating and evaluating the associated risks, controlling those risks, and monitoring the effectiveness of controls throughout the entire device lifecycle.

The standard applies to:

Physical medical devices of all classifications
Software as a Medical Device (SaMD)
In vitro diagnostic (IVD) medical devices
Combination products where the device constituent part requires risk management

Before ISO 14971, there was no universally accepted methodology for risk management in the medical device industry. Different manufacturers used different approaches, different terminology, and different standards for what constituted acceptable risk. ISO 14971 introduced a standardized process that could be consistently applied across the industry globally — giving regulators, certification bodies, and trading partners a shared framework for evaluating whether a manufacturer’s risk management is adequate.

Risk, as defined by ISO 14971, is the combination of two components:

The probability that harm will occur
The severity of that harm

This definition is important because it shapes the entire risk management process. A high-severity potential harm that is extremely unlikely to occur produces a different risk level than a moderate-severity harm that occurs frequently. ISO 14971 requires manufacturers to evaluate both dimensions systematically — not rely on intuition or experience alone.

Who Needs ISO 14971?

ISO 14971 is effectively required for any organization involved in the medical device supply chain. Specifically:

Organizations that must implement ISO 14971:

Medical device manufacturers — it is explicitly required by ISO 13485 and referenced throughout FDA QMSR, EU MDR, Health Canada, TGA (Australia), and most other major regulatory frameworks
Design-responsible organizations developing medical devices or device software
Contract manufacturers producing devices under a design owner’s technical file

Organizations that should implement ISO 14971:

Component suppliers whose products are incorporated into medical devices — risk management requirements are increasingly flowed down through quality agreements
Software developers producing SaMD or software incorporated into medical devices
Sterilization service providers — sterilization process risk must be managed within the device’s overall risk management framework

A critical distinction: ISO 14971 is not legally mandated in the same way a regulation is — regulators like the FDA do not list it as a statutory requirement. However, regulators worldwide recognize ISO 14971 as the state of the art for medical device risk management. Non-conformance with ISO 14971 — or the absence of a risk management program built on its framework — creates significant regulatory exposure. For practical purposes, ISO 14971 is mandatory for any organization intending to demonstrate that their device is safe and effective.

The ISO 14971 Risk Management Process — Six Steps

Infographic illustrating the six-step ISO 14971 medical device risk management process: Risk Analysis, Risk Evaluation, Risk Control, Overall Residual Risk, Risk Management Review, and Post-Production Information. — The six-step ISO 14971 risk management process creates a structured lifecycle approach for identifying hazards, controlling risks, evaluating residual risk, and continuously improving medical device safety.

ISO 14971 defines a six-step risk management process that applies across the entire device lifecycle — from initial concept through design, production, and post-market activities.

Step 1 — Risk Analysis

Risk analysis is the systematic use of available information to identify hazards and estimate the risks associated with a medical device. It consists of two activities:

Hazard identification: Identifying all reasonably foreseeable hazards associated with the device under both normal use conditions and fault conditions. The 2019 edition specifically requires both normal and fault conditions to be considered — a change from the 2007 edition which emphasized fault conditions primarily.

Sources of hazards include:

Device energy sources (electrical, thermal, mechanical, radiation)
Device materials and their biological interactions
Use environment and user characteristics
Reasonably foreseeable misuse
Software failures and cybersecurity vulnerabilities
Interactions with other devices

Risk estimation: For each hazardous situation identified, estimating the risk by determining the probability of occurrence of harm and the severity of that harm. ISO 14971 does not specify acceptable risk levels — manufacturers must establish their own objective criteria based on regulatory requirements, industry standards, and clinical context.

Step 2 — Risk Evaluation

Risk evaluation is the process of comparing estimated risks against the manufacturer’s defined risk acceptability criteria to determine whether risk reduction is required. If the estimated risk exceeds acceptable levels, the process moves to risk control. If the risk is within acceptable limits, it is documented as acceptable residual risk and monitored.

Step 3 — Risk Control

Risk control is the process of implementing and verifying measures to reduce risks that exceed acceptable levels. ISO 14971 requires risk control measures to be implemented in a defined priority order:

Inherent safety by design — eliminate or reduce hazards through design decisions (preferred)
Protective measures — guards, alarms, interlocks in the device or manufacturing process
Information for safety — warnings, instructions for use, training requirements (last resort)

After implementing risk control measures, the residual risk — the risk remaining after controls — must be estimated and evaluated again. The process is iterative: if residual risk is still unacceptable, additional risk control measures must be implemented.

Risk control measures must also be evaluated for introduced risks — a control measure that eliminates one hazard may introduce a new one.

Step 4 — Evaluation of Overall Residual Risk

After all individual risks have been addressed, the overall residual risk of the device must be evaluated — not just each individual risk in isolation. If the overall residual risk is not acceptable using the manufacturer’s risk acceptability criteria, a benefit-risk analysis must be performed.

Benefit-risk analysis (introduced as a formal requirement in the 2019 edition) evaluates whether the clinical benefits of the device outweigh the overall residual risk in the context of the device’s intended use. If the benefits outweigh the risks, and appropriate information is provided to users, the device may be released. If the benefits do not outweigh the risks, the device cannot be released — additional risk control measures are required.

Step 5 — Risk Management Review

Before a device is released for distribution, a formal risk management review must be completed. The 2019 edition changed the title of this clause from “Risk Management Report” to “Risk Management Review” — a deliberate signal that this is an active review activity, not simply a summary document.

The review must confirm:

The risk management plan has been fully implemented
The overall residual risk is acceptable
Appropriate methods are in place to collect and review production and post-production information

Reviewers must be identified in the risk management plan in advance — they cannot be appointed after the fact.

Step 6 — Production and Post-Production Information

Risk management does not end when the device is released. ISO 14971 requires a systematic process for collecting and reviewing information from production and post-market activities throughout the device’s commercial life. This includes:

Complaint data and adverse event reports
Post-market surveillance information
Production nonconformances and CAPA trends
New scientific and technical information relevant to device safety

When this information indicates that the risk management process needs to be updated — that a new hazard has been identified, or that an existing risk estimate was incorrect — the risk management file must be revised and risk control measures re-evaluated.

ISO 14971 Clause-by-Clause Breakdown

Clause	Title	Key Content
1	Scope	Applicability to all medical devices, SaMD, IVDs, combination products
2	Normative references	ISO 9000:2015 for defined terms
3	Terms and definitions	31 defined terms including risk, hazard, harm, hazardous situation, benefit
4	General requirements	Risk management system requirements, management responsibilities, competence requirements
5	Risk management planning	Risk management plan requirements — device scope, lifecycle phases, risk acceptability criteria
6	Risk analysis	Intended use, hazard identification, risk estimation
7	Risk evaluation	Comparison to acceptability criteria, benefit-risk analysis (Clause 7.4)
8	Risk control	Control option analysis, measure implementation, residual risk evaluation, introduced risks
9	Evaluation of overall residual risk	Overall residual risk acceptability, benefit-risk if needed
10	Risk management review	Pre-release review requirements, reviewer identification
11	Production and post-production activities	Information collection, new hazard identification, risk file updates

What Changed in ISO 14971:2019

The 2019 edition is the third edition of ISO 14971, replacing the 2007 version. Several changes have practical implementation implications:

Benefit-risk analysis is now a formal requirement. The 2019 edition formally introduced benefit-risk analysis as a defined process step (Clause 7.4) when overall residual risk is not acceptable under the manufacturer’s criteria alone. The 2007 edition referenced this concept but did not treat it as a structured requirement. The FDA’s influence here is direct — the FDA revised its language to place “benefit” before “risk” for novel device submissions, and the ISO 14971 committee adopted this framing in the 2019 revision.

Both normal and fault conditions must be analyzed. Clause 5.4 of the 2019 edition explicitly requires identification of anticipated hazards under both normal use and fault conditions. The 2007 edition emphasized fault conditions — the 2019 edition closes that gap. This has direct implications for FMEA and hazard analysis documentation.

Post-production requirements are more prescriptive. The requirements for production and post-production information collection (Clause 11) are more detailed in the 2019 edition, with stronger emphasis on systematic feedback of real-world performance data into the risk management file.

Risk Management Review replaces Risk Management Report. The title change in Clause 9 (from “report” to “review”) reflects a substantive intent: the activity must be an active review with identified reviewers, not a passive summary document compiled at device release.

EN ISO 14971:2019 + A11:2021 for EU MDR. The European version of the standard includes Amendment A11:2021, which maps ISO 14971 requirements to the General Safety and Performance Requirements (GSPR) of the EU Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR). Organizations selling into the EU need the A11 annex — organizations selling only in the U.S. do not, but the normative requirements are identical in both versions.

The Risk Management File

The Risk Management File (RMF) is the central documentation output of the ISO 14971 process. It is the organized collection of records that demonstrates a manufacturer has systematically identified hazards, evaluated risks, implemented controls, and monitored the effectiveness of those controls throughout the device lifecycle.

The RMF is not a single document. It is a defined collection of records that includes:

Risk Management Plan (RMP): Defines the scope of risk management activities, the lifecycle phases covered, the risk acceptability criteria, the risk estimation methodology, and the verification activities planned
Risk Analysis records: Hazard identification outputs, risk estimation records, FMEA or other analysis tool outputs
Risk Evaluation records: Comparison of estimated risks against acceptability criteria
Risk Control records: Selected control measures, implementation records, verification that controls achieved their intended risk reduction, evaluation of introduced risks
Overall Residual Risk evaluation: Documentation of the overall residual risk assessment and benefit-risk analysis if required
Risk Management Review: Pre-release review record with identified reviewers
Post-Production information records: Systematic records of production and post-market information reviewed against the risk management file

A common audit finding is a Risk Management File that functions as a static document compiled at device release — rather than a living record updated throughout the device’s commercial life as post-production information is gathered. Under the QMSR, FDA investigators start inspections with the risk management file. A static RMF that hasn’t been updated since initial device release is a significant inspection vulnerability.

📋 How does your risk management program measure up? Section 6 of the free ISO 13485 Gap Assessment Checklist covers ISO 14971 integration specifically — risk management plan requirements, RMF structure, post-production feedback, and the QMSR inspection implications. Download Free Checklist

ISO 14971 and ISO 13485 — How They Integrate

ISO 14971 and ISO 13485 are companion standards — not alternatives. ISO 13485 is the quality management system framework. ISO 14971 is the risk management framework that ISO 13485 requires to be implemented throughout that QMS.

ISO 13485 references ISO 14971 in multiple clauses:

Clause 7.1 — Planning of product realization: Risk management activities must be planned as part of product realization
Clause 7.3 — Design and development: Risk management must be integrated throughout design and development activities
Clause 7.4 — Purchasing: Supplier controls must reflect risk — suppliers of higher-risk components require more rigorous qualification
Clause 8.2.1 — Feedback: Post-market feedback must be evaluated in the context of risk management
Clause 8.5 — Improvement: CAPA and continual improvement activities must consider risk management outputs

ISO 14971 is not optional supplementary guidance for ISO 13485. Organizations implementing ISO 13485 must purchase and implement ISO 14971. It is an external document that must be controlled under ISO 13485 Clause 4.2.4 — registered, version-controlled, and accessible to relevant personnel.

For a complete comparison of how ISO 13485 and risk management requirements interact, see ISO 9001 vs ISO 13485 — Key Differences.

📋 Buy ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off

ISO 14971 Under the FDA QMSR

The FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, incorporated ISO 13485:2016 by reference into 21 CFR Part 820 — and with it, ISO 13485’s explicit requirement for risk management per ISO 14971.

Under QMSR, several specific changes elevate the practical importance of ISO 14971:

Risk management now extends across the entire QMS. Under the old QSR, risk management was concentrated primarily in design controls. Under QMSR, risk-based thinking is required throughout the entire quality system — supplier controls, production processes, CAPA, complaint handling, and post-market surveillance. ISO 14971 is the expected framework for implementing this expanded risk management scope.

FDA investigators start inspections with the risk management file. Under Compliance Program 7382.850 — the new inspection program that replaced QSIT on February 2, 2026 — FDA investigators are expected to begin inspections by reviewing the risk management file and following risk documentation into other quality system areas. A well-maintained, current risk management file is inspection preparation. An incomplete or static risk management file is an inspection liability.

Post-market surveillance feeds the risk management file. The QMSR’s requirements for production and post-production information — complaint handling, MDR, field corrections — are expected to feed systematically into the risk management file. Organizations that maintain complaint handling and risk management as separate, unconnected systems have a QMSR gap.

For the complete QMSR transition guide, see FDA QSR vs ISO 13485: The Complete QMSR Transition Guide.

ISO/TR 24971 — The Companion Guidance Document

ISO/TR 24971:2020 is the technical report published as a companion to ISO 14971:2019. Unlike ISO 14971, which is a normative standard (its requirements are mandatory for certification purposes), ISO/TR 24971 is guidance — it does not add requirements but provides practical methodology for implementing ISO 14971’s requirements.

ISO/TR 24971:2020 covers:

Guidance on risk management planning
Practical methods for hazard identification and risk estimation
Guidance on benefit-risk analysis
Application of risk management to software
Application of risk management to usability and human factors
Guidance on production and post-production information processes

For organizations building or rebuilding their risk management program, ISO/TR 24971 is the practical implementation companion to ISO 14971’s requirements. Many experienced quality and regulatory professionals recommend reading both together.

📋 ISO/TR 24971:2020 — ANSI Webstore — use coupon CC2026 for 5% off

How to Buy ISO 14971

ISO 14971 is a copyrighted document and must be purchased from an authorized source. It cannot be legally downloaded for free.

ANSI Webstore — Recommended U.S. Source

The ANSI Webstore is the authorized U.S. distributor for ISO standards. ISO 14971:2019 is available in PDF format with immediate download after purchase.

📋 ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026

Bundle with ISO 13485 — Save Up to 50%

Organizations implementing ISO 13485 need both standards. Purchasing as a bundle through the ANSI Webstore saves significantly compared to individual purchases.

📋 ISO Standards Bundles — Save up to 50%

For the complete guide to purchasing ISO 13485, see Buy ISO 13485 — Complete Purchasing Guide.

Frequently Asked Questions

What is ISO 14971 used for?

ISO 14971 is the international standard for applying risk management to medical devices. It provides the structured process — hazard identification, risk estimation, risk evaluation, risk control, overall residual risk evaluation, and post-production monitoring — that manufacturers must use to demonstrate that their devices are safe for their intended use.

Is ISO 14971 required for ISO 13485 certification?

Yes. ISO 13485 explicitly requires risk management per ISO 14971 throughout the medical device quality management system. Organizations cannot achieve ISO 13485 certification without demonstrating that their risk management program is built on the ISO 14971 framework. ISO 14971 must be controlled as an external document within the ISO 13485 QMS.

Is ISO 14971 required by the FDA?

ISO 14971 is not listed as a statutory FDA requirement. However, the FDA recognizes ISO 14971 as the state of the art for medical device risk management. Under the QMSR, effective February 2, 2026, ISO 13485 is incorporated by reference into 21 CFR Part 820 — and ISO 13485 explicitly requires ISO 14971. FDA investigators under CP 7382.850 use the risk management file as their inspection starting point. For practical purposes, ISO 14971 is effectively mandatory for any FDA-regulated medical device manufacturer.

What is the difference between ISO 14971:2007 and ISO 14971:2019?

The 2019 edition introduced several substantive changes: benefit-risk analysis is now a formal requirement when overall residual risk is not acceptable; both normal use and fault conditions must be analyzed during hazard identification; post-production requirements are more prescriptive; and the Risk Management Report was renamed Risk Management Review to signal an active review activity rather than a passive document.

What is the Risk Management File?

The Risk Management File (RMF) is the organized collection of records that demonstrates a manufacturer has systematically implemented the ISO 14971 risk management process. It includes the Risk Management Plan, hazard analysis records, risk evaluation records, risk control records, overall residual risk evaluation, risk management review, and post-production information records. The RMF is a living document — it must be updated throughout the device’s commercial life as post-production information is gathered.

What is ISO/TR 24971?

ISO/TR 24971:2020 is the technical report companion to ISO 14971:2019. It provides practical guidance on implementing ISO 14971’s requirements — methods for hazard identification, risk estimation, benefit-risk analysis, software risk management, and post-production information processes. It does not add normative requirements but is an essential practical companion for organizations building or rebuilding their risk management programs.

What is the difference between ISO 14971 and ISO 31000?

ISO 14971 is specific to medical device risk management and defines risk purely in terms of harm to people — the combination of probability of harm and severity of that harm. ISO 31000 is a broader enterprise risk management standard with a wider definition of risk that includes any effect on objectives, including positive risks (opportunities). The two standards serve different purposes and are not interchangeable in the medical device context.

Does ISO 14971 apply to software as a medical device?

Yes. ISO 14971:2019 explicitly applies to Software as a Medical Device (SaMD). ISO/TR 24971 provides specific guidance on applying ISO 14971 to software. The companion standard IEC 62304 — Medical Device Software Lifecycle Processes — also references ISO 14971 risk management requirements throughout its software development lifecycle requirements.

📥 Free Resources

👉 ISO 9001 Roadmap — Step-by-Step Implementation Guide
👉 Manufacturing Compliance Checklist — verify all compliance areas before your certification audit
👉 Supplier Quality Checklist — material supplier and tooling supplier qualification requirements

Not Sure What to Do Next?

✅ You need the official ISO 14971:2019 standard 📋 ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026

✅ You also need ISO 13485:2016 — the required companion QMS standard 📋 ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off

✅ You need the ISO/TR 24971 implementation guidance companion 📋 ISO/TR 24971:2020 — ANSI Webstore — use coupon CC2026 for 5% off

✅ You want to save buying multiple standards together 📋 ISO Standards Bundles — Save up to 50% — ANSI Webstore

✅ You need ISO 13485 training that covers ISO 14971 integration 📋 BSI Group ISO 13485 Training

✅ You are ready to pursue ISO 13485 certification 📋 ISOQAR ISO 13485 Certification

✅ You want to understand what ISO 13485 requires 📋 What Is ISO 13485? — Complete Guide

✅ You want to understand the FDA QMSR and how ISO 14971 fits 📋 FDA QSR vs ISO 13485 — The Complete QMSR Transition Guide

✅ You want to compare ISO 9001 and ISO 13485 📋 ISO 9001 vs ISO 13485 — Key Differences

✅ You want to understand ISO 13485 purchase options and cost 📋 Buy ISO 13485 — Complete Purchasing Guide 📋 How Much Does ISO 13485 Cost?

Risk Management Is Not a Deliverable. It’s an Operating Model.

ISO 14971 is not a checkbox on a certification audit list. It is the framework that determines whether the medical devices your organization produces — or supplies components for — are demonstrably safe for their intended use.

Under the FDA’s QMSR, effective February 2, 2026, that framework now carries federal regulatory weight. Risk management under QMSR extends across the entire quality system, and FDA investigators under CP 7382.850 are using the risk management file as their inspection roadmap.

The organizations that navigate this environment successfully are the ones that treat risk management as an operating discipline — not a documentation exercise. The Risk Management File is updated because post-market data is being systematically reviewed, not because an audit is scheduled. CAPA is connected to the risk management file because the quality system is integrated, not because an investigator asked to see the connection.

That is what ISO 14971, properly implemented, actually produces.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

✅ Get updates on new standards, implementation strategies, and compliance insights ✅ Be first to access new guides, tools, and checklists

Subscribe below to stay ahead.

FDA QSR vs ISO 13485: The Complete QMSR Transition Guide (2026)

The FDA replaced the legacy Quality System Regulation on February 2, 2026. The new QMSR incorporates ISO 13485:2016 by reference — making the international medical device quality standard the structural backbone of U.S. federal regulation. This guide covers exactly what changed, what FDA-specific requirements remain in force beyond ISO 13485, and what your quality system needs to address now that the QMSR is in full effect.

What changed on February 2, 2026, what stayed, and exactly what your quality system needs to address now that the FDA’s QMSR is in full force.

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The FDA Replaced the QSR. Here’s What That Actually Means.

On February 2, 2026, the FDA’s legacy Quality System Regulation — the QSR under 21 CFR Part 820 — was replaced.

Not updated. Not revised. Replaced.

The new Quality Management System Regulation (QMSR) restructured 21 CFR Part 820 around a single foundational document: ISO 13485:2016. The FDA incorporated the international medical device quality standard by reference — meaning ISO 13485 is now the structural backbone of U.S. medical device quality regulation. It is no longer a voluntary international standard that sophisticated manufacturers pursue for global market access. It is what the FDA expects your quality system to be built on.

If your quality system was built against the old QSR framework — DMRs, DHFs, QSIT audit language — you are now operating against a framework that has been retired. The FDA’s inspectors are using a new compliance program. The terminology has changed. The inspection scope has changed. The risk management expectations have changed.

This guide covers exactly what the QSR was, what the QMSR replaced it with, where ISO 13485 fits into the new regulatory structure, what FDA-specific requirements remain in force beyond ISO 13485, and what your quality system needs to address right now.

In This Guide

What the FDA QSR was and why it was replaced
What the QMSR actually is — and what it is not
How FDA QSR, ISO 13485, and QMSR relate to each other
The four FDA-specific requirements that ISO 13485 does not cover
Key changes under the QMSR manufacturers need to act on
Does ISO 13485 certification satisfy QMSR?
The role of ISO 14971 in QMSR compliance
QMSR gap assessment — where to start
From the Shop Floor — what this transition actually looks like
Getting ISO 13485 certified under the QMSR framework

✅ Start Here (Top Resources)

📋 Start with a structured gap assessment before engaging a certification body. The free ISO 13485 Gap Assessment Checklist covers every clause area plus all four QMSR bridge requirements — so you know exactly where you stand before you spend money on implementation. Download Free Checklist

📋 Purchase the official ISO 13485:2016 standard → ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026

📋 Purchase the required companion standard → ISO 14971:2019 Risk Management — ANSI Webstore — use coupon CC2026 for 5% off

📋 Get ISO 13485 training for your team → BSI Group ISO 13485 Training

📋 Get ISO 13485 certified with an accredited certification body → ISOQAR ISO 13485 Certification

📋 Save up to 50% buying ISO standards as a bundle → ISO Standards Packages — ANSI Webstore

What Was the FDA QSR?

Professional infographic explaining the FDA Quality System Regulation under 21 CFR Part 820, featuring medical device manufacturing, CGMP requirements, and regulatory compliance history. — The FDA Quality System Regulation under 21 CFR Part 820 established the foundational CGMP requirements governing medical device manufacturing quality systems in the United States.

The FDA’s Quality System Regulation was codified under 21 CFR Part 820. First authorized in July 1978 and significantly revised in 1996, the QSR established the current good manufacturing practice (CGMP) requirements for finished medical device manufacturers distributing products in the United States.

The QSR covered the core pillars of a medical device quality management system: management responsibility, design controls, document and record controls, purchasing controls, production and process controls, corrective and preventive action (CAPA), labeling, and complaint handling. It was written in FDA-specific language and structured around FDA-specific documentation concepts:

Device Master Record (DMR) — the compiled documentation defining how a device is manufactured
Design History File (DHF) — records demonstrating the device was designed in accordance with an approved plan
Device History Record (DHR) — production records for each manufactured unit or lot
Quality System Inspection Technique (QSIT) — the FDA’s subsystem-by-subsystem inspection approach

For decades, the FDA QSR and ISO 13485 ran in parallel. They covered similar ground but used different terminology, different structural frameworks, and different documentation concepts. Manufacturers selling devices in both the U.S. and international markets often maintained two parallel compliance frameworks — one for the FDA, one for ISO 13485 or MDSAP. That dual-track approach created overhead, redundancy, and audit complexity that manufacturers had been managing for years.

That parallel structure is over.

What Is the QMSR?

The Quality Management System Regulation (QMSR) is the amended version of 21 CFR Part 820, effective February 2, 2026. The FDA issued the final rule in February 2024, providing a two-year implementation window before the regulation took effect.

The core structural change: instead of writing QMS requirements directly into the regulation, the FDA incorporated ISO 13485:2016 by reference. Part 820 now points to ISO 13485 as the source document for quality system requirements. The regulation itself became significantly shorter — most of its text now simply directs manufacturers to the relevant ISO 13485 clause.

What this means in practice: ISO 13485:2016 compliance is now a regulatory expectation under 21 CFR Part 820 — not a voluntary international best practice. Manufacturers who have never engaged with ISO 13485 are now operating under a framework built on it.

The QMSR also updated the FDA’s inspection program. As of February 2, 2026, the FDA retired the Quality System Inspection Technique (QSIT) and implemented Compliance Program 7382.850 — a revised inspection approach built around the ISO 13485 process-based structure rather than the subsystem-by-subsystem approach of the old QSR.

FDA QSR vs ISO 13485 vs QMSR — How They Relate

This is where manufacturers get confused, so it is worth being precise.

The old QSR was a standalone FDA regulation with its own requirements, its own terminology, and its own documentation structure. It has been retired.

ISO 13485:2016 is the international standard for medical device quality management systems, published by the International Organization for Standardization. It has always been used by regulatory authorities globally — including Health Canada, the EU MDR framework, and MDSAP participating countries — as the baseline for QMS requirements.

The QMSR is the new version of 21 CFR Part 820. It uses ISO 13485:2016 as its foundation by incorporating it by reference, while layering on U.S.-specific regulatory requirements that ISO 13485 does not fully address on its own.

Think of it this way: the QMSR is ISO 13485 plus the FDA-specific additions the agency determined were necessary to cover U.S. statutory obligations that go beyond what the international standard requires.

ISO 13485 does most of the heavy lifting. But QMSR is not simply “ISO 13485 with a new name.” Several FDA-specific obligations remain fully in force and cannot be satisfied by ISO 13485 conformance alone.

What the QMSR Kept — The Four FDA Bridge Requirements

The QMSR retained four categories of U.S.-specific requirements that remain unchanged and fully enforceable. These are sometimes called the QMSR “bridge requirements” — the FDA-specific obligations that ISO 13485 does not cover:

1. Medical Device Reporting (MDR)

Manufacturers must continue to report adverse events, malfunctions, and deaths or serious injuries involving their devices to the FDA under 21 CFR Part 803. ISO 13485 addresses post-market surveillance at a high level but does not specify MDR reporting timelines or mechanisms. The QMSR cross-references MDR explicitly in §820.10.

2. Unique Device Identification (UDI)

The UDI system — requiring device labeling to carry a unique identifier traceable in the FDA’s Global Unique Device Identification Database (GUDID) — continues unchanged under QMSR. ISO 13485 does not address UDI requirements. §820.10 explicitly cross-references UDI compliance.

3. Corrections and Removals

Reporting obligations for corrections and removals under 21 CFR Part 806 remain in force. Manufacturers must report corrections or removals initiated to reduce a risk to health or remedy a violation.

4. Device Tracking

Tracking requirements for certain high-risk device categories under 21 CFR Part 821 continue to apply.

A manufacturer whose QMS is fully ISO 13485 compliant but has not addressed these four areas is not QMSR compliant. This is the most important distinction in the entire QMSR framework.

What Changed Under the QMSR

Beyond the structural shift to ISO 13485, several specific changes affect how manufacturers need to operate:

Terminology Alignment

The QMSR adopts ISO 13485 and ISO 9000 vocabulary, replacing legacy QSR-specific terms:

Old QSR Term	QMSR / ISO 13485 Term
Device Master Record (DMR)	Medical Device File (MDF)
Design History File (DHF)	Design and Development File (DDF)
Device History Record (DHR)	Manufacturing Records
Quality System Record	Distributed across QMS documentation

Manufacturers are not required to rename every document immediately — but QMS documentation, training materials, and internal audit programs should be progressively aligned to ISO 13485 terminology to avoid confusion during inspections.

Risk Management Extends Across the Entire QMS

Under the old QSR, risk management was concentrated primarily in design controls. Under QMSR — consistent with ISO 13485 and its companion standard ISO 14971 — risk-based thinking now extends across the entire quality system, including supplier controls, manufacturing processes, CAPA, complaint handling, and post-market activities. This is a substantive operational shift, not a documentation update.

Internal Audits and Management Reviews Are Now Inspection Territory

Under QSR, internal audits were required but the FDA’s QSIT inspection process did not focus on them directly. Under QMSR and Compliance Program 7382.850, internal audits and management reviews are within the FDA’s inspection scope. Investigators will evaluate whether your internal audit program functions as a process-based system consistent with ISO 13485 Clause 8.2.4 requirements.

Inspection Structure Changed

The FDA’s inspection approach under CP 7382.850 evaluates how quality subsystems function as an interconnected framework rather than auditing them in isolation. Inspectors follow issues across processes — a finding in complaint handling may lead directly into CAPA, risk management, and design controls in the same inspection.

ISO 13485 Must Be Controlled as an External Document

Because QMSR incorporates ISO 13485 by reference, manufacturers are required to control the standard as an external document within their QMS under ISO 13485 Clause 4.2.4. This means purchasing the official standard and maintaining version control — a detail many manufacturers miss entirely.

📋 Buy the Official ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off

Does ISO 13485 Certification Satisfy QMSR?

Corporate infographic explaining whether ISO 13485 certification satisfies FDA QMSR requirements, including compliance gaps, FDA bridge requirements, inspection readiness, and the path to full QMSR compliance. — ISO 13485 certification provides the foundation for QMSR compliance — but manufacturers must still address FDA-specific bridge requirements, inspection readiness, and process-based audit expectations.

This is the most common question manufacturers ask after the QMSR took effect, and the answer requires precision.

ISO 13485 certification helps significantly — but does not automatically guarantee QMSR compliance.

ISO 13485 certification from an accredited certification body demonstrates that your QMS meets the international standard’s requirements. Under QMSR, that foundation now aligns with what the FDA expects at the structural level. If your organization is already ISO 13485 certified, the gap between your current QMS and QMSR compliance is substantially smaller than it was under the old QSR.

However, ISO 13485 certification does not cover the four FDA bridge requirements — MDR, UDI, corrections and removals, and device tracking. It also does not replace FDA inspections. The FDA retains full enforcement authority under U.S. law regardless of third-party certification status. An ISO 13485 certificate is not a substitute for FDA inspection readiness.

The practical position: ISO 13485 certification gets you approximately 80–85% of the way to QMSR compliance. The remaining work is ensuring the FDA bridge requirements are explicitly addressed in QMS documentation, records and labeling controls map to both ISO 13485 and FDA expectations, and your internal audit program is prepared for the process-based inspection approach under CP 7382.850.

If you are not yet ISO 13485 certified and are subject to QMSR, pursuing certification is the most efficient path to demonstrating compliance with the regulation’s foundation.

📋 Buy ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off

The Role of ISO 14971 Under QMSR

ISO 14971 — Risk Management for Medical Devices — plays a critical role in QMSR compliance that is consistently underestimated.

Under the old QSR, risk management was primarily concentrated in design controls. Under QMSR, risk-based thinking is expected throughout the entire quality system. ISO 14971 provides the formal risk management framework — hazard identification, risk estimation, risk evaluation, risk control, and residual risk evaluation — that ISO 13485 requires manufacturers to implement but does not itself specify in detail.

ISO 13485 explicitly requires compliance with ISO 14971. Under QMSR, that requirement carries federal regulatory weight. FDA investigators under CP 7382.850 are expected to start inspections with the risk management file as their roadmap — following risk documentation into design controls, production controls, CAPA, and post-market surveillance.

If your QMS does not have a well-documented, lifecycle-integrated risk management program built on ISO 14971, this is your highest-priority gap under QMSR.

📋 ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off

For the complete relationship between ISO 13485 and ISO 14971, see ISO 9001 vs ISO 13485 — Key Differences.

QMSR Gap Assessment — Where to Start

Manufacturing compliance gap assessment scale showing audit readiness levels with 0–2 gaps as audit ready, 3–5 gaps as moderate risk, and 6+ gaps as high risk — A simple gap assessment can quickly show whether your operation is audit-ready — or at risk of failure.

For manufacturers currently operating under the old QSR framework, a structured gap assessment is the most efficient starting point. Key areas to evaluate:

Documentation and terminology. Map your existing QMS documents to ISO 13485 clause requirements. Identify where legacy QSR terminology (DMR, DHF, DHR) appears and plan progressive alignment to ISO 13485 vocabulary. Your team and your auditors need to understand the mapping.

Risk management integration. Assess whether your risk management program is limited to design controls or extends across supplier qualification, production processes, CAPA, complaint handling, and post-market surveillance as ISO 14971 and QMSR require.

FDA bridge requirements. Confirm that MDR, UDI, corrections and removals, and device tracking obligations are explicitly addressed in QMS procedures and cross-referenced in §820.10 documentation.

Internal audit program. Update your internal audit program to reflect process-based auditing across interconnected QMS elements rather than subsystem-by-subsystem evaluation. Ensure auditors understand the QMSR inspection approach under CP 7382.850.

Supplier controls. ISO 13485 Clause 7.4 has more prescriptive supplier control requirements than the old QSR. Review supplier qualification procedures, quality agreements, and monitoring programs against ISO 13485 requirements.

External document control. Confirm that ISO 13485:2016 and ISO 14971 are registered as external documents in your QMS with version control — this is now a regulatory requirement, not optional housekeeping.

From the Shop Floor

Professional manufacturing team conducting a QMS transition planning meeting focused on gap assessments, operational involvement, and ISO 13485 documentation remediation. — Successful QMSR transitions are driven by honest gap assessments, operational team involvement, and proactive cleanup of long-standing documentation and compliance weaknesses.

After 25 years managing quality systems in heavy industrial manufacturing, I have watched more regulatory transitions than I care to count. Most follow the same pattern: the announcement creates anxiety, the implementation period creates confusion, and the actual change — once you get to it — turns out to be more manageable than the noise suggested.

The QMSR transition is no different, with one important caveat.

The manufacturers who are struggling right now are the ones who treated the QSR as a compliance exercise rather than an operational system. If your QMS was built as a documentation binder rather than a living process framework, QMSR is going to expose that gap — not because the regulation is fundamentally harder, but because the ISO 13485 process-based approach assumes your quality system actually runs your operations, not the other way around.

The manufacturers I have seen navigate transitions like this most effectively do three things. They conduct an honest gap assessment before anyone from the outside asks them to. They involve their operations team — not just regulatory affairs — in the remediation. And they treat the transition as an opportunity to clean up years of accumulated documentation debt rather than a compliance burden to minimize.

QMSR gives you a cleaner, more internationally aligned framework. The manufacturers who approach it that way will come out of this transition with stronger systems and less audit friction. The ones who treat it as a box-checking exercise will find the new inspection approach under CP 7382.850 less forgiving than the old QSIT was.

Getting ISO 13485 Certified Under the QMSR Framework

If your organization is not yet ISO 13485 certified, QMSR provides a clear incentive to pursue it. An accredited ISO 13485 certificate demonstrates to customers, regulators, and trading partners that your QMS meets the international standard that now forms the foundation of U.S. medical device regulation.

For certification: ISOQAR is a UKAS-accredited certification body with experience in medical device quality management system assessments.

📋 ISO 13485 Certification — ISOQAR

For training: BSI Group offers ISO 13485 training covering requirements interpretation, internal auditing, and implementation — suitable for quality managers, regulatory affairs professionals, and internal auditors preparing for the QMSR inspection environment.

📋 ISO 13485 Training — BSI Group

Quick Reference Comparison Table

Element	Old FDA QSR	ISO 13485:2016	QMSR (Current)
Effective date	1996 (revised)	2016	February 2, 2026
Regulatory basis	U.S. federal regulation	International standard	U.S. federal regulation
Structure	FDA-specific requirements	ISO Harmonized Structure	ISO 13485 by reference + FDA additions
Terminology	DMR, DHF, DHR	MDF, DDF, manufacturing records	ISO 13485 terms (progressive alignment)
Risk management scope	Primarily design controls	Full lifecycle (ISO 14971)	Full QMS — ISO 14971 expected
MDR requirements	Yes	No	Yes (§820.10 cross-reference)
UDI requirements	Yes	No	Yes (§820.10 cross-reference)
Inspection program	QSIT	Third-party certification audit	CP 7382.850 (process-based)
ISO 13485 certification	Not required	Third-party certification	Strongly recommended, not sufficient alone

Frequently Asked Questions

What is the QMSR and when did it take effect?

The Quality Management System Regulation (QMSR) is the amended version of 21 CFR Part 820, effective February 2, 2026. It replaced the legacy FDA Quality System Regulation (QSR) by incorporating ISO 13485:2016 by reference as the foundational quality system framework for U.S. medical device manufacturers.

What is the difference between the FDA QSR and the QMSR?

The old QSR was a standalone FDA regulation with its own requirements and terminology — DMRs, DHFs, DHRs, and the QSIT inspection approach. The QMSR replaced it with a framework built on ISO 13485:2016, adopted by reference, while retaining four U.S.-specific bridge requirements: Medical Device Reporting, UDI, corrections and removals, and device tracking.

Does ISO 13485 certification satisfy QMSR requirements?

ISO 13485 certification provides approximately 80–85% of the foundation for QMSR compliance. However, it does not cover the four FDA-specific bridge requirements and does not replace FDA inspections. A targeted QMSR gap assessment is necessary even for fully ISO 13485 certified organizations.

Is ISO 14971 required under QMSR?

Yes. ISO 13485 explicitly requires risk management per ISO 14971, and under QMSR that requirement carries federal regulatory weight. Risk-based thinking under QMSR extends across the entire quality system — not just design controls as under the old QSR. ISO 14971 is the expected framework.

What are the four QMSR bridge requirements that ISO 13485 does not cover?

Medical Device Reporting (MDR) under 21 CFR Part 803, Unique Device Identification (UDI), Corrections and Removals under 21 CFR Part 806, and Device Tracking under 21 CFR Part 821. These remain fully enforceable under QMSR regardless of ISO 13485 certification status.

What happened to the old QSR terminology — DMR, DHF, DHR?

The QMSR adopts ISO 13485 terminology. Device Master Record (DMR) becomes Medical Device File (MDF), Design History File (DHF) becomes Design and Development File (DDF), and Device History Record (DHR) maps to Manufacturing Records. Manufacturers are not required to rename documents immediately but should plan progressive alignment to ISO 13485 terminology.

What is FDA Compliance Program 7382.850?

CP 7382.850 is the FDA’s new inspection program implemented February 2, 2026, replacing the retired Quality System Inspection Technique (QSIT). It uses a process-based inspection approach aligned with ISO 13485 structure, evaluating how quality subsystems function as an interconnected framework rather than auditing them in isolation.

Does ISO 9001 certification satisfy QMSR?

No. ISO 9001 and ISO 13485 share a structural framework but serve different regulatory purposes. ISO 9001 certification does not satisfy ISO 13485 requirements and is not accepted by the FDA under QMSR. See ISO 9001 vs ISO 13485 for the complete comparison.

📥 Free Resources

👉 ISO 9001 Roadmap — Step-by-Step Implementation Guide — build your ISO 9001 foundation before adding ISO 13485
👉 Manufacturing Compliance Checklist — assess your current compliance status across quality, environmental, and safety
👉 Supplier Quality Checklist — supplier qualification requirements applicable to medical device supply chains

Not Sure What to Do Next?

✅ Start with a structured gap assessment before engaging a certification body. The free ISO 13485 Gap Assessment Checklist covers every clause area plus all four QMSR bridge requirements — so you know exactly where you stand before you spend money on implementation. Download Free Checklist

✅ You need the official ISO 13485:2016 standard 📋 ISO 13485:2016 — ANSI Webstore — use coupon CC2026 for 5% off through December 31, 2026

✅ You need the required ISO 14971 risk management companion 📋 ISO 14971:2019 — ANSI Webstore — use coupon CC2026 for 5% off

✅ You want to save buying both standards together 📋 ISO Standards Packages — Save up to 50% — ANSI Webstore

✅ You need ISO 13485 training before your gap assessment or implementation 📋 BSI Group ISO 13485 Training

✅ You are ready to pursue ISO 13485 certification 📋 ISOQAR ISO 13485 Certification

✅ You want to understand what ISO 13485 requires 📋 What Is ISO 13485? — Complete Guide

✅ You want to understand how ISO 9001 and ISO 13485 differ 📋 ISO 9001 vs ISO 13485 — Key Differences

✅ You want to understand ISO 13485 purchase options and cost 📋 Buy ISO 13485 — Complete Purchasing Guide 📋 How Much Does ISO 13485 Cost?

✅ You want to understand certification costs and timelines 📋 ISO Certification Cost Calculator 📋 How Long Does ISO Certification Take? 📋 Best ISO Certification Bodies

The QSR Is Gone. The QMSR Is What the FDA Expects Now.

The FDA replaced 21 CFR Part 820 on February 2, 2026. ISO 13485:2016 is now the structural backbone of U.S. medical device quality regulation. That is not an update to a voluntary standard — it is a fundamental shift in what federal regulation requires from every manufacturer in the U.S. medical device supply chain.

For manufacturers previously operating only under the QSR framework: your system needs to be restructured around ISO 13485. For ISO 13485 certified organizations: your certification provides a strong foundation, but the four FDA bridge requirements and the updated inspection approach under CP 7382.850 require targeted attention. For ISO 9001 certified manufacturers in the medical device supply chain: the supply chain pressure is coming. The pattern that played out in automotive and aerospace — sector-specific quality standards flowing down the supply chain — is now playing out in medical devices.

At The Standards Navigator, complex standards are translated into practical, real-world guidance you can act on.

✅ Get updates on new standards, implementation strategies, and compliance insights ✅ Be first to access new guides, tools, and checklists

Subscribe below to stay ahead.

If You’re Sourcing AS9100, You Need to Get This Right

Table of Contents

👉 Start Here — Top Resources for AS9100

Where to Buy AS9100 Rev D

Pricing and Formats

What the Standard Includes

Related Aerospace Standards Worth Buying Together

The IA9100 Transition — What Buyers Need to Know in 2026

How to Verify Your Certification Body Is OASIS-Listed

Frequently Asked Questions

Where can I buy AS9100 Rev D officially?

How much does AS9100 Rev D cost?

Is AS9100 Rev D the same as ISO 9001?

Should I wait for IA9100 before implementing AS9100?

Can I share the AS9100 PDF with my whole team?

Do I need to buy AS9101 separately?

What’s the difference between AS9100, AS9110, and AS9120?

Is a free version of AS9100 available anywhere?

📥 Free Resources for Aerospace QMS Implementation

Not Sure What to Do Next?

Stay Ahead of AS9100 and IA9100 Changes

Subscribe

AS9100 Is Not Optional in Aerospace. It Is the Price of Entry.

In This Guide

Table of Contents

👉 Start Here (Top Resources)

What Is AS9100?

AS9100 Rev D — The Current Edition

What Rev D Changed From Rev C

AS9100 vs ISO 9001 — Key Differences

Aerospace-Specific Requirements

Product Safety (Clause 8.1.1)

Counterfeit Parts Prevention (Clause 8.1.4)

Configuration Management (Clause 8.1.3)

Key Characteristics (Clause 8.1.2)

First Article Inspection (FAI)

Human Factors (Clause 8.1.5)

The Five Core Tools of AS9100

Who Needs AS9100 Certification?

Prime Contractors and Tier 1 Suppliers

OASIS Database Registration

Defense Contractors

MRO and Repair Stations

Aviation Parts Distributors

The AS9100 Certification Process

Stage 1 — Documentation Review

Stage 2 — System Audit

Surveillance Audits

Recertification

AS9100 Certification Costs

Typical Cost Ranges (2026)

Factors That Drive Cost Up

The ROI Case

IA9100 — The Upcoming Revision

Why the Timing Matters

Timeline

What This Means for Your Organization

Where to Buy the AS9100 Standard

AS9100 Training and Certification Resources

Training Options

Choosing an AS9100 Certification Body

AS9100 Implementation Checklist

Download the Free AS9100 Rev D Gap Assessment Checklist

Frequently Asked Questions

What is AS9100 certification?

What is the difference between AS9100 and ISO 9001?

What does AS9100 Rev D mean?

How long does AS9100 certification take?

Do I need AS9100 if I already have ISO 9001?

What is OASIS and why does it matter?

What is IA9100 and when will it replace AS9100?

How much does AS9100 certification cost?

📥 Free Resources

Not Sure What to Do Next?

AS9100 Is the Standard. The Question Is When.

Subscribe

Three Standards. Three Transition Clocks. One Planning Problem Most Manufacturers Haven’t Solved Yet.

In This Guide

Table of Contents

Start Here (Top Resources)