Notified Body - The Standards Navigator

How to Audit a Medical Device QMS: The ISO 13485 Internal Audit Process (2026 Guide)

This guide walks medical device manufacturers through the ISO 13485 Clause 8.2.4 internal audit requirement — including audit program design, the six-step audit process, and the five most common findings auditors cite. It also covers what changed under the FDA QMSR and the new ISO 19011:2026 audit guidance.

A clause-by-clause guide to planning, conducting, and closing out ISO 13485 internal audits under the new FDA QMSR

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Internal Audit That Used to Be Private Isn’t Anymore

For years, medical device manufacturers treated the internal audit report as an internal document — useful for finding problems, but shielded from FDA inspectors under the confidentiality provision in the old 21 CFR 820.180(c). That protection is gone.

Since February 2, 2026, the FDA’s Quality Management System Regulation (QMSR) has been in effect, and it incorporates ISO 13485:2016 by reference rather than running a parallel U.S.-specific standard alongside it. FDA’s own Final Rule FAQ is direct about what that means for audits: “The QMSR gives the FDA the authority to inspect management review, quality audits, and supplier audit reports. The exceptions that existed in the QS regulation at § 820.180(c) are not maintained in the QMSR.” That’s not a third-party interpretation — it’s FDA’s own published position.

So this isn’t limited to internal audit reports. Management review minutes and supplier audit reports lost the same protection. A checklist you run through once a year to satisfy Clause 8.2.4 on paper is no longer a low-risk approach — it’s now a document an inspector may read line by line, and so are the meetings where leadership reviewed it.

From the Floor: I’ve built and run internal audit programs at facilities with 500-plus employees, and the finding that costs organizations the most isn’t a missing procedure — it’s a corrective action that gets closed on paper before the root cause is actually fixed. As a certified ISO 9001 Internal Auditor, I’ve sat across the table from auditors who catch that in about ninety seconds. Whether you’re auditing to ISO 9001 or ISO 13485, the internal audit only works if it’s harder on you than the external one will be.

Before your next surveillance audit, most quality teams don’t fail because they misunderstand Clause 8.2.4 — they fail because their audit program looks complete on paper but hasn’t been stress-tested against real objective evidence. Run your QMS through the free ISO 13485 Gap Assessment Checklist before an inspector or a Notified Body does it for you.

In This Guide

What ISO 13485 Clause 8.2.4 actually requires
How internal audits differ from supplier and certification audits
What Clause 6.2 actually requires of your auditors — and what “competent” really means
Building a risk-based annual audit program
The audit process: planning, evidence, reporting, and CAPA follow-up
A real finding-to-CAPA example, start to finish
The five most common internal audit findings — and how to avoid them
What changes if you’re audited under MDSAP
What changed under the FDA QMSR and ISO 19011:2026
Whether you need outside help or can run this internally

👉 Start Here (Top Resources)

9001Simplified — Build Your Audit Program Without a Consultant — documentation and procedure templates you can adapt for a Clause 8.2.4 internal audit program without hiring outside help.
ISO 13485:2016 — ANSI Webstore — the official standard, which every internal audit checklist should be built against directly, not from a secondhand summary. Use code CC2026 for 5% off your order through December 31, 2026.
ISO 13485 Training — BSI Group — formal internal auditor training if you need documented Clause 6.2 competence records for your audit team.

What Clause 8.2.4 Actually Requires

ISO 13485 requires internal audits under Clause 8.2.4 to verify that QMS processes are implemented and effective, catch nonconformities, and surface QMS deficiencies early enough that they don’t become product-safety or regulatory problems. That sounds close to ISO 9001’s internal audit clause, and it is — but ISO 13485 asks for more.

Clause 8.2.4 requires that internal audits determine conformity to planned arrangements, the requirements of the standard, the organization’s own QMS requirements, and applicable regulatory requirements — and unlike ISO 9001, ISO 13485 explicitly requires the audit program to account for regulatory requirements such as FDA 21 CFR Part 820, EU MDR, or MDSAP alongside the standard itself. Teams that build their audit program purely off the ISO 13485 clause structure, without folding in the regulatory layer, are the ones who get flagged.

Most common finding: auditors treat Clause 8.2.4 as a documentation-review exercise and skip the regulatory cross-reference entirely. If your audit checklist doesn’t ask “does this also satisfy 21 CFR Part 820 or MDR Article 10?” it isn’t finished.

Audits must assess conformity across critical processes — design and development under Clause 7.3, corrective action under Clause 8.5.2, preventive action under Clause 8.5.3, production under Clause 7.5, and document control under Clause 4.2 — using objective evidence like device history records, audit trails, and validation records. Auditors must be trained, qualified, and independent of the area they’re auditing, with that competence documented under Clause 6.2.

If you are already ISO 9001 certified → your internal audit infrastructure transfers directly, but your checklist needs a regulatory column added for every process area, not just a conformity column.

Internal Audits vs. Supplier Audits vs. Certification Audits

Comparison infographic showing internal audits, supplier audits, and certification audits under ISO 13485. — Understanding the differences between internal, supplier, and certification audits improves audit planning and regulatory compliance.

Manufacturers frequently conflate these three, and an auditor will notice immediately if your procedure does too.

Audit Type	Governing Clause	Performed By	Primary Purpose
Internal Audit	Clause 8.2.4	Trained internal personnel, independent of the area audited	Verify your own QMS conforms to the standard and your own procedures
Supplier Audit	Clause 7.4.1	Quality or supplier quality personnel	Verify external providers meet quality and regulatory requirements
Certification Audit	ISO/IEC 17021-1	Accredited third-party Notified Body or registrar	Determine whether the full QMS meets ISO 13485 for certification

ISO 13485 requires internal audits, just as its sister standard ISO 9001 does, and they exist for two reasons: to confirm the QMS meets the standard’s requirements, and to confirm the organization actually follows its own rules. A strong internal audit program is what makes a certification audit uneventful instead of a fire drill.

Auditor Competence: What Clause 6.2 Actually Requires

This is the section most audit programs get thin on, and it’s where a surprising number of otherwise solid internal audit programs fall apart under scrutiny.

Clause 6.2 requires that anyone doing work affecting product quality — and that includes auditors — be competent based on appropriate education, training, skills, and experience. ISO 13485 doesn’t spell out a fixed list of required knowledge areas the way a checklist would, but three areas consistently show up when a Notified Body reviews auditor files:

The standard itself. A working knowledge of ISO 13485:2016 clause structure, not just the SOPs written to satisfy it.
Audit methodology. Understanding of the audit cycle — planning, evidence gathering, reporting, follow-up — along with the difference between a minor observation and a major nonconformity. ISO 13485’s own note under Clause 8.2.4 points auditors toward ISO 19011 for this.
Applicable regulatory context. Basic familiarity with the regulations that apply to your product and markets — 21 CFR Part 820, EU MDR, MDSAP — not full legal mastery, but enough to recognize when a finding also touches a regulatory requirement.

Competence is not the same thing as certification. ISO 13485 does not require a certified internal auditor credential, and ISO 19011 doesn’t mandate formal training either — the standard’s actual requirement is that the audit process ensure objectivity and impartiality, and that competence be evaluated and documented. In practice, though, “read and understand the internal procedure” is not evidence Notified Bodies accept as sufficient. An auditor who can’t produce a training record, a completed course certificate, or documented on-the-job evaluation showing how their competence was assessed is a finding waiting to happen — even if that person is, in fact, good at the job.

What acceptable training records look like in practice:

A certificate of completion from an ISO 13485 internal auditor course (typically covering the standard itself plus ISO 19011 audit methodology) — see BSI vs. ISOQAR if you’re deciding where to send your team for that training
Internal on-the-job qualification records — a documented mentored audit or two, signed off by a qualified lead auditor
A training matrix that ties each auditor to the specific processes and clauses they’re qualified to audit, refreshed when the QMS or the standard changes

Auditor independence gets checked alongside competence. The most frequent failure here isn’t a skills gap — it’s a quality manager who owns a process auditing that same process, or an auditor rotation that never actually rotates the highest-risk areas like design controls.

If you are not confident your auditor files would hold up to this list → that’s a fifteen-minute file review, not a project, and it’s worth doing before your next Notified Body visit rather than during it.

Building a Risk-Based Audit Program

The audit program must cover every process, department, and site within your QMS scope, with audit frequency determined by the status and importance of each process along with the results of prior audits. High-risk processes — design and development, production, CAPA, and complaint handling — typically need at least annual coverage, while lower-risk support functions can be audited less frequently if previous results were consistently clean.

Most manufacturers get the frequency question backwards. They audit everything on a flat annual calendar instead of weighting toward where the last audit found something. If your CAPA process had a finding last year, auditing it again on the same twelve-month clock as your HR training records is a scheduling decision an inspector will question.

If you are preparing for your first surveillance audit under the new QMSR → build your program around the regulatory cross-reference first, then layer the standard’s clause structure on top of it — not the other way around.

The Internal Audit Process, Step by Step

Infographic illustrating the ISO 13485 internal audit process from planning through CAPA verification for medical device quality management systems. — The six-step ISO 13485 internal audit process helps medical device manufacturers identify nonconformities and verify corrective actions.

Prepare a checklist based on the relevant clauses of ISO 13485, your documented procedures, and applicable regulatory requirements — a good checklist prompts investigation rather than simply confirming what’s already assumed to be true.

1. Scope and schedule. Define which processes, sites, and clauses are in scope for this audit cycle.

2. Documentation review. Analyze the quality manual, procedures, and prior audit reports before setting foot on the floor — this is where checklists get mapped to specific clauses.

3. Opening meeting. Confirm scope, objectives, and methodology with the auditee before evidence-gathering begins — this sets the tone for the entire audit.

4. Evidence gathering. Collect objective evidence through interviews, direct observation, and document/record review — no finding should be written down without evidence behind it.

5. Reporting. Findings get written up, classified by severity, and routed to the process owner and management.

6. CAPA follow-up. Every corrective action needs documented root cause analysis appropriate to the significance of the nonconformity, with effectiveness verified before the CAPA is closed.

Most teams execute steps 1 through 5 competently. Step 6 is where programs fall apart — a CAPA gets marked closed the day the immediate fix is implemented, with no verification that the fix actually held.

Trigger: If your last three internal audits found the same category of nonconformity in different words each time, that’s not three separate findings — that’s one root cause your CAPA process never actually reached.

Before your next audit cycle, check your CAPA closure process against what auditors actually verify — most teams don’t realize how thin their effectiveness checks are until someone else reviews them.

A Real Finding, Start to Finish

Steps on a page are easy to nod along with. Here’s what a properly closed finding actually looks like end to end, using one of the most common design-control gaps auditors find.

Stage	What It Looked Like
Finding	During a design and development audit, three of twelve design verification records sampled were missing the reviewer’s signature. Work was completed and dated, but sign-off wasn’t captured.
Objective Evidence	Design History File records DHF-114, DHF-119, and DHF-122, cross-referenced against the design review meeting minutes showing the reviews occurred.
Nonconformity Statement	“Design verification records DHF-114, DHF-119, and DHF-122 lack the required reviewer signature per QMS-SOP-014, Section 6.2. Design and development control per ISO 13485:2016 Clause 7.3.6 requires verification results, including necessary actions, to be recorded.”
Root Cause	Investigation traced it to a recent SOP revision that moved the sign-off step later in the workflow. Staff hadn’t been retrained on the updated sequence — the procedure changed, but the training that should have accompanied it under Clause 6.2 didn’t happen.
Correction	The three records were completed retroactively with the reviewer’s signature and a note explaining the delay, reviewed and accepted by the quality manager.
Corrective Action (CAPA)	Retrain design team on the revised sign-off sequence; add a mandatory signature field to the design review template so records can’t be filed incomplete.
Effectiveness Check	Sample the next ten design verification records over the following quarter. Zero missing signatures required to close the CAPA as effective.

Notice what makes this closeable rather than cosmetic: the root cause isn’t “people forgot” — it’s a training gap tied to a specific procedure change, and the corrective action addresses the system, not just the three records. That’s the difference between a finding that stays closed and one that reappears with different reference numbers next year.

The Five Most Common Findings

Infographic highlighting the five most common ISO 13485 internal audit findings in medical device quality management systems. — The most common ISO 13485 internal audit findings often involve documentation, CAPA effectiveness, auditor competence, and risk-based planning.

Incomplete audit records — missing reports, plans, or linked CAPAs — is one of the most frequently cited internal audit issues. A close second is failing to apply a risk-based approach to audit planning, or simply not maintaining the internal audit schedule at all. Beyond that, auditors regularly find no timely follow-up on actions from internal audits, no records showing auditor competence against the applicable regulations, and auditors who weren’t actually impartial — reviewing work they had a hand in.

Design and development controls remain the single most frequently cited nonconformity area globally — incomplete design inputs, missing verification or validation records, undocumented design changes, or no formal design transfer procedure. See Validation & Verification Requirements for how this plays out in practice.

⚠️ If your auditor rotation lets the same person audit design controls year after year without ever being audited themselves on that same process, that’s an impartiality gap that a Notified Body will flag before you do.

If you are not confident your last internal audit would hold up under this list → that’s exactly what a structured gap assessment is for, not a guess.

Check your program against these five findings before your next audit — most gaps take under 45 minutes to identify →

MDSAP: What Changes for Multi-Market Audits

If your devices sell into more than one of the five MDSAP markets — the U.S., Canada, Australia, Brazil, or Japan — your internal audit program needs to account for a different audit model, not just an extra regulatory reference.

The Medical Device Single Audit Program lets one audit by an accredited Auditing Organization satisfy the requirements of all five participating regulators at once, in place of separate national audits. It’s built on ISO 13485:2016, but it isn’t a straight overlay — MDSAP uses a process-based audit model with a defined sequence, rather than working straight down the ISO clause list, and it maps every audit task to both the relevant ISO 13485 clause and each country’s specific regulatory requirement.

The grading system is the biggest practical difference. Where an ISO 13485 certification audit typically classifies findings as minor or major, MDSAP uses a points-based Grade 1–5 scale: nonconformities affecting clauses with indirect QMS impact start lower, direct-impact clauses start higher, and points are added for repeat findings or for a nonconforming product that was actually released. Grade 4 and 5 findings must be resolved before a certificate is issued or maintained — there’s no ambiguity about severity once the math is run.

What this means for your internal audit program: if you’re pursuing or maintaining MDSAP, your internal audits should follow the MDSAP process sequence — not just walk through ISO 13485 clauses in order — so that gaps surface in the same structure an Auditing Organization will use. The recurring findings across published MDSAP audits track closely with the same weak points internal audits should already be hunting for: open CAPAs left unclosed past a reasonable window, supplier and purchasing controls that don’t demonstrate follow-through, and root cause analysis that’s thin enough to not survive a second look.

One benefit worth knowing about: MDSAP audit reports can substitute for the FDA’s routine biennial device inspections. A well-run MDSAP program isn’t just multi-market efficiency — it can reduce how often FDA shows up separately.

What Changed: QMSR and ISO 19011:2026

Two regulatory shifts affect how internal audits get run in 2026, and both are recent enough that older internal procedures may not reflect them.

Since February 2, 2026, the FDA’s QMSR has incorporated ISO 13485:2016 by reference, replacing the former Quality System Regulation, and FDA inspections now run under Compliance Program 7382.850 rather than the old QSR framework. As covered above, the practical effect for internal audits is direct: the confidentiality safe harbor that used to apply to internal audit reports, management review records, and supplier audit reports under the old 21 CFR 820.180(c) has been removed, and FDA’s own FAQ confirms it in plain language.

Separately, ISO published the fourth edition of ISO 19011 — Guidelines for auditing management systems — on May 27, 2026, replacing the 2018 edition that had guided audit programs for nearly eight years. ISO 13485 doesn’t mandate ISO 19011 compliance directly — Clause 8.2.4 references audit principles in its own language — but Notified Bodies and experienced auditors widely treat ISO 19011 as the authoritative reference for structuring an audit program, so if your internal audit SOPs still cite the 2018 edition, expect your Notified Body to ask why.

Neither change requires rebuilding your program from scratch. Both are reasons to review your internal audit SOP this year rather than next.

Quick Audit-Readiness Checklist

✅ Audit program covers every process, site, and department in your QMS scope ✅ Audit frequency is risk-weighted, not a flat annual calendar
✅ Every checklist item maps to a specific ISO 13485 clause and the applicable regulatory requirement
✅ Auditors are independent of the area they’re reviewing, with Clause 6.2 competence records on file — not just “read and understand” sign-offs
✅ Findings are backed by objective evidence — interviews, observation, or documented records
✅ CAPA effectiveness is verified before closure, not assumed
✅ If pursuing MDSAP, internal audits follow the MDSAP process sequence, not just the ISO clause order
✅ Internal audit SOP references ISO 19011:2026, not the 2018 edition
✅ Design and development records are current — this is the single most-cited finding category

FAQ

How often does ISO 13485 require internal audits?

The standard doesn’t specify a fixed interval — it requires audits “at planned intervals” based on process risk and prior audit history. Most manufacturers audit high-risk processes like design controls and CAPA annually at minimum, with lower-risk support functions audited less frequently if history is clean.

Can the same person who performs a process also audit it?

No. Clause 8.2.4 requires auditors to be independent of the area being audited. A quality manager who owns the CAPA process, for example, shouldn’t be the one auditing CAPA compliance.

Do internal auditors need a formal certification?

No. ISO 13485 requires documented competence — education, training, skills, and experience — but doesn’t mandate a specific certification. In practice, most Notified Bodies expect more than an internal read-and-understand sign-off, so a course certificate or documented mentored-audit record is the safer standard to work toward.

Does the FDA QMSR require a separate internal audit program from ISO 13485?

No. Since the QMSR incorporates ISO 13485:2016 by reference, there isn’t a separate U.S.-specific internal audit requirement layered on top — your Clause 8.2.4 program is the audit program the FDA now expects, with the regulatory cross-reference built in.

Are internal audit reports confidential from FDA inspectors?

Not anymore. FDA’s own QMSR Final Rule FAQ confirms the confidentiality exceptions under the old 21 CFR 820.180(c) — covering internal audits, management review, and supplier audits — are not maintained under the QMSR.

What’s the difference between an internal audit and a supplier audit under ISO 13485?

Internal audits (Clause 8.2.4) evaluate your own QMS. Supplier audits (Clause 7.4.1) evaluate external providers’ ability to meet your quality and regulatory requirements. Both are required, but they’re separate programs with separate scopes.

Does MDSAP replace our ISO 13485 internal audit requirement?

No, but it changes the structure. MDSAP is built on ISO 13485 and layers in country-specific regulatory requirements from up to five markets, using a process-based sequence and a points-based Grade 1–5 nonconformity system rather than the minor/major classification used in standard certification audits.

What’s the most common reason internal audit programs fail a certification audit?

Incomplete records — missing audit reports, plans, or linked CAPAs — combined with no evidence of a risk-based approach to scheduling. Both are findings a Notified Body catches quickly because they’re procedural gaps, not technical ones.

Should we hire a consultant to run our internal audits, or can we do it ourselves?

Either can work if the auditor is properly trained and genuinely independent of the process. Many manufacturers use in-house auditors for most cycles and bring in an outside auditor periodically to test whether their internal program is actually rigorous or just familiar with its own blind spots.

📥 Free Resources

ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements
AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification

Not Sure What to Do Next?

🔹 Still researching your audit obligations? Start with ISO 13485 Documentation Requirements to understand what your QMS needs on paper before you audit it.

🔹 Ready to build or strengthen your audit program? 9001Simplified’s documentation templates can shortcut the SOP-writing process without a consultant retainer.

🔹 Need the standard itself to build your checklist against? Get ISO 13485:2016 from ANSI Webstore — code CC2026 takes 5% off through the end of 2026.

An internal audit program that only exists to satisfy Clause 8.2.4 on paper was already a risk before the QMSR removed the confidentiality safe harbor. Now it’s a document an inspector can read directly. The Standards Navigator will keep tracking what QMSR enforcement and ISO 19011:2026 mean for how medical device manufacturers actually run their audit programs — not just what the clause says.

Most manufacturers don’t lose a certification over one bad audit finding — they lose it over a pattern of findings their own internal audit program should have caught first. Organizations that treat Clause 8.2.4 as a paperwork requirement get surprised at surveillance. Organizations that treat it as their first line of defense rarely do.

The Standards Navigator tracks how ISO 13485, the FDA QMSR, and the standards that govern medical device audits actually work in practice — not just what the clause text says.

👉 Get updates on ISO 13485 audit requirements and QMSR enforcement changes 👉 Be first to access new medical device compliance checklists and gap assessment tools

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

ISO 10993 Contact Duration Matrix- How to Select Tests (2026 Guide)

ISO 10993-1:2025 retired the old Table A.1 checklist approach to biocompatibility testing. This guide explains the current contact duration categories, how total exposure period is calculated for reusable devices, and which biological endpoints apply — including FDA’s partial recognition of the new edition.

ISO 10993 Contact Duration Matrix and Biological Endpoint Selection Explained

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Matrix Changed. If Your Biological Evaluation Plan Still Reads Like 2018, You Have a Gap

Table A.1 is gone. For seven years, biological evaluation plans were built around a single grid in Annex A of ISO 10993-1:2018 — cross-reference device category and contact duration, check the boxes, done. That table has been retired. ISO 10993-1:2025, published November 18, 2025, split it into four separate tables and rebuilt the exposure-duration logic underneath them.

ISO 10993-1:2025 is the international standard that guides biocompatibility and biological evaluation of medical devices using a risk-based framework, replacing the prescriptive checklist approach of the 2018 edition.

If your BEP still cites the 2018 ISO 10993 contact duration matrix, or if you categorized a reusable device’s contact duration based on a single use rather than total exposure period, you may already be carrying a documentation gap — one that surfaces exactly when a reviewer or notified body opens your file.

Regulatory affairs teams are asking a narrower question than “what is ISO 10993”: which biological endpoints does this specific device trigger under the current framework, and why. That’s what this guide walks through.

I’ve sat across the table from an auditor reviewing a biological evaluation plan where the contact duration category didn’t match the device’s actual use pattern — a reusable component that looked like “limited” contact on paper but was accumulating well past 24 hours across a single patient’s treatment course. The documentation existed. The categorization logic behind it didn’t hold up. That’s the gap this guide is built to close before it becomes a finding.

👉 Before you finalize your next biological evaluation plan, run it against a structured QMS gap check first. Get the free ISO 13485 Gap Assessment Checklist and confirm your documentation controls support the categorization decisions your BEP depends on.

In This Guide

What changed in the ISO 10993-1:2025 evaluation matrix and why Table A.1 was retired
The current contact duration categories and how “total exposure period” is calculated
How to categorize daily contact, intermittent contact, and reusable devices correctly
Which biological endpoints apply to each contact duration and body-contact combination
What FDA’s partial recognition of ISO 10993-1:2025 means for your submission
Common categorization mistakes that trigger additional testing requirements
Where to buy the current standard and where to get ISO 13485-aligned training

👉 Start Here (Top Resources)

ISO 10993-1:2025 — ANSI Webstore — the current edition, direct from the accredited source. Use code CC2026 for 5% off. (Eric: insert the exact ANSI product link for ISO 10993-1:2025 here.)
If you’re weighing whether to buy standards individually or as a set, the ANSI bundle option is worth checking before you purchase the 10993 series piece by piece.
ISO 13485 Training — BSI Group — for teams building biological evaluation competency into a certified QMS.
ISO Training Courses — ISOQAR — a second accredited training option worth comparing against BSI on schedule and price.

Why the Evaluation Matrix Was Restructured

Under ISO 10993-1:2018, Annex A Table A.1 organized devices by body contact category — surface, external communicating, implant — crossed with three contact duration bands, and listed an “X” for every biological endpoint a reviewer might expect to see addressed. Industry insiders came to call it the “Table A.1 mentality”: manufacturers treated the X’s as a mandatory checklist rather than a starting point for risk-based justification. Tests got run because they appeared in a cell, not because a documented risk assessment called for them.

ISO 10993-1:2025 splits that single table into four separate tables, each tied to a specific evaluation context, and embeds the framework more tightly into the ISO 14971 risk management process. The standard now expects a Biological Evaluation Plan built on the device’s actual risk profile — chemical characterization, materials history, intended use, contact pattern — with the tables used to check completeness, not generate a test order.

Most common finding: biological evaluation plans that cite “Table A.1” by name, or that list endpoints without a documented rationale tied to the device’s specific exposure profile. Under the current standard, that’s a gap a reviewer will flag.

If you are still building your first BEP for a device entering the medical device space, start with what the supplier controls requirements under ISO 13485 expect from your materials documentation — biological evaluation depends heavily on having reliable supplier and materials data before you ever get to a test matrix.

Contact Duration Categories, Defined

The three contact duration categories are unchanged in name but recalculated in practice:

Category	Cumulative Contact	Typical Devices
Limited	Up to 24 hours total	Diagnostic swabs, single-use syringes, short procedural instruments
Prolonged	More than 24 hours, up to 30 days total	Wound dressings changed over several weeks, indwelling catheters (short-term), orthodontic devices
Long-term / Permanent	More than 30 days total	Implants, permanent orthopedic hardware, long-term catheters

The category itself hasn’t moved. What changed is how you calculate “total contact” for a device that isn’t used in one continuous stretch — and that recalculation is where most categorization errors happen.

If you are evaluating a device used in short, repeated sessions → don’t categorize based on a single session length. The standard expects you to sum all contact time across the device’s full use pattern before assigning a category.

Daily Contact vs. Intermittent Contact

Comparison infographic explaining daily contact and intermittent contact under ISO 10993-1:2025 for biological evaluation of medical devices. — ISO 10993-1:2025 distinguishes between daily and intermittent contact when determining cumulative exposure for biological evaluation.

ISO 10993-1:2025 formalizes two exposure patterns that the 2018 edition handled inconsistently:

Daily contact — the device touches the body every day, for any portion of a day, across a defined treatment course. Total exposure is counted as calendar days from first use to last use (or replacement) on a single patient.
Intermittent contact — use with at least 24 hours between consecutive contacts. This is treated as repeated use of the same device, or a replacement device, under evaluation.

A wound contact layer changed daily over three weeks is the textbook example: under the 2018 edition, each dressing change might have been assessed as its own “limited” exposure. Under the current standard, the 21 cumulative contact days push the device into prolonged territory — and that shift can add endpoints your original evaluation never considered.

If you are re-evaluating a device that was cleared under the 2018 categorization logic → don’t assume your existing category still holds. Run the total exposure period calculation against the current definitions before you finalize anything for a new submission.

Reusable Devices and Total Exposure Period

Reusable devices are now categorized based on cumulative contact time for a single patient across the device’s full use pattern — not the duration of any one use, and not a multi-patient device service-life total. A reusable surgical instrument sterilized and reused across a procedure series looks brief per individual contact, but the relevant figure is how many total contact days that one patient accumulates across their treatment course, including reasonably foreseeable misuse such as use beyond the labeled reprocessing cycle count.

Bioaccumulation is a related but less settled consideration. FDA’s Supplementary Information Sheet for ISO 10993-1:2025 (Recognition No. 2-313) notes that ISO/TC 194 Working Group 1 is still developing technical reports specifically addressing bioaccumulation, intermittent contact, and reasonably foreseeable misuse. In practice: if chemical characterization data — extractables and leachables — raises a bioaccumulation concern, that finding should inform your risk assessment and may support escalating the device’s category, but document it as a risk-based judgment rather than treating it as a fixed clause requirement until the supporting technical reports are finalized.

For teams managing this inside a certified QMS, it’s a judgment call that needs to trace back to a documented decision — not a verbal risk call made in a meeting. Clause 9 of ISO 10993-1:2025 requires that biological evaluations be planned, conducted, and reported by competent personnel, with the evaluation report documenting the rationale behind risk decisions like this one. The CAPA requirements under ISO 13485 apply just as much to a categorization correction as to a nonconformance on the shop floor.

Flowchart explaining cumulative single-patient exposure for reusable medical devices under ISO 10993-1:2025. — Reusable medical devices are categorized using cumulative single-patient exposure rather than the duration of a single procedure.

Mapping Contact Category to Biological Endpoints

The biological effects under consideration haven’t fundamentally changed — cytotoxicity, sensitization, irritation, systemic toxicity, genotoxicity, implantation effects, and hemocompatibility remain the backbone, and ISO 10993-1 remains a risk-based framework, not a mandatory testing checklist. What changed is the scope of consideration required, particularly for genotoxicity:

Contact Duration	Body Contact	Genotoxicity Consideration
Limited	Any	Case-by-case, per risk assessment
Prolonged	All tissues except intact skin	Generally expected to be addressed per Tables 2–4 and Clause 6.5.7
Long-term / Permanent	All tissues except intact skin	Generally expected to be addressed per Tables 2–4 and Clause 6.5.7

Under the 2018 edition, genotoxicity was consistently expected for implants and long-term tissue contact, but inconsistently applied to prolonged-contact devices touching mucosal membranes or breached surfaces. ISO 10993-1:2025 narrows that inconsistency: per Tables 2–4 and Clause 6.5.7, any device requiring systemic toxicity evaluation due to prolonged or long-term contact is now generally expected to address genotoxicity as well, intact skin excepted — though this remains a risk assessment expectation to be justified within your Biological Evaluation Plan, not an automatic in vivo test order. Where existing data (toxicological risk assessment under ISO 10993-17, chemical characterization, or literature) already addresses the risk adequately, testing may not be necessary. Carcinogenicity consideration was similarly extended for long-term contact with intact mucosal membranes.

Worth flagging directly: FDA’s Supplementary Information Sheet for ISO 10993-1:2025 (Recognition No. 2-313) identifies a genuine discrepancy here. ISO 10993-1:2025 lists genotoxicity as an endpoint for consideration across all prolonged-contact device categories, while FDA’s own Table A.1 (Attachment A of its 2023 Biocompatibility Guidance) limits the genotoxicity endpoint to implanted devices, externally communicating devices with tissue/bone/dentin contact, and externally communicating devices with circulating blood contact. For a U.S. submission, don’t assume the broader ISO scope automatically controls — confirm which framework your reviewer expects you to follow.

Most common finding: biological evaluation plans for prolonged-contact mucosal devices that address systemic toxicity but don’t document a genotoxicity rationale one way or the other — an omission that was easier to overlook under the 2018 matrix and is more likely to draw a question under the current one.

If your device’s evaluation also touches sterilization residuals, review our sterilization standards overview — ethylene oxide and other sterilization residues are a recurring driver of chemical characterization findings that reshape a biological evaluation.

FDA’s Partial Recognition — What’s Excluded

FDA recognized ISO 10993-1:2025 on May 25, 2026 (Recognition No. 2-313 in FDA’s Recognized Consensus Standards database), but the recognition is partial, not full. Two carve-outs from the Supplementary Information Sheet matter for submission strategy:

The phrase “consumer products or” in Clause 6.5.11.3 (Low Risk Intact Skin Contacting Medical Devices) is not recognized — FDA states it conflicts with Attachment G of its 2023 biocompatibility guidance, which limits which historical-use materials qualify for reduced testing on skin-contacting devices.
Clause 6.9, Biological risk estimation, is not recognized — FDA holds it conflicts with the risk estimation approach already established under ISO 14971:2019, which FDA separately recognizes.

If you are preparing a 510(k), PMA, or De Novo submission → you cannot submit a full Declaration of Conformity without addressing these two exclusions directly, and the genotoxicity discrepancy above is a separate, related point worth raising with your reviewer proactively. Cite the standard, but demonstrate compliance for the excluded clauses through FDA’s existing biocompatibility guidance rather than assuming automatic alignment. FDA’s recognized standard entry and Supplementary Information Sheet have already been updated since publication — verify the current version directly against FDA’s Recognized Consensus Standards database before finalizing any submission.

For the broader shift this represents in medical device documentation expectations, see our breakdown of validation and verification requirements under ISO 13485 and the FDA QMSR.

Common Categorization Mistakes

Infographic highlighting common ISO 10993 biological evaluation and contact duration categorization mistakes for medical device manufacturers. — Many ISO 10993 audit findings result from incorrect categorization logic or incomplete biological evaluation documentation rather than testing failures.

⚠️ Categorizing by single-use duration instead of cumulative single-patient exposure. The single most common error on reusable and repeat-use devices — it understates the contact category more often than it overstates it.

⚠️ Citing “Table A.1” in a current BEP. A reference to the old table structure is a documentation red flag on its own, independent of whether the underlying science holds up.

⚠️ Assuming genotoxicity doesn’t need to be addressed for prolonged mucosal contact. Teams working from older templates default to a 2018-era endpoint list and skip documenting a rationale either way — under the current tables, that gap is more likely to draw a question.

⚠️ Assuming FDA recognition is full, or that ISO and FDA genotoxicity scope match. Building a submission strategy around blanket alignment, without addressing the excluded clauses and the genotoxicity scope discrepancy, invites an avoidable deficiency letter.

If you are unsure whether existing biological evaluation plans need revisiting → they don’t automatically require retesting, but ISO 10993-1:2025 does expect a documented review confirming prior categorization and endpoint rationale still hold under current definitions.

Quick Audit Checklist

✅ Contact duration category calculated from cumulative single-patient exposure, not single-use duration
✅ Reusable/repeat-use devices assessed for total contact days for one patient across their treatment course
✅ Genotoxicity rationale documented for prolonged/long-term contact except intact skin, per Tables 2–4 and Clause 6.5.7
✅ Biological Evaluation Plan references current ISO 10993-1:2025 structure, not legacy Table A.1
✅ FDA submission strategy accounts for the two partially-recognized clauses and the genotoxicity scope discrepancy
✅ Bioaccumulation signals from chemical characterization data reviewed and documented as a risk judgment, not assumed to require automatic escalation ✅ Existing (pre-2025) biological evaluations documented as reviewed against current definitions

FAQ

Does ISO 10993-1:2025 require me to retest devices already on the market?

No. The standard doesn’t mandate automatic retesting for devices with an acceptable safety history. It does expect a documented review confirming prior categorization and evaluation still hold, and an update if a Clause 10 production change triggers a re-review.

Is ISO 10993-1:2018 still valid to use?

FDA’s recognized standards database is the authority for U.S. submissions — verify current recognition status before relying on either edition. For new evaluation plans, aligning with the 2025 edition is the safer long-term position.

What’s the difference between “prolonged” and “long-term” contact?

Prolonged contact covers cumulative contact exceeding 24 hours but not exceeding 30 days. Long-term (permanent) contact covers cumulative contact exceeding 30 days, driven by total exposure period rather than packaging or labeling.

Does the 2025 edition apply to devices regulated under the EU MDR?

It’s generally treated as state of the art for MDR purposes, but grace periods and notified body expectations vary — confirm directly with your notified body.

Is genotoxicity testing now mandatory for every prolonged-contact device?

Not automatically. Per Tables 2–4 and Clause 6.5.7, genotoxicity is generally expected to be addressed through risk assessment for prolonged and long-term contact with all tissues except intact skin — but “addressed” can mean justified through existing toxicological or chemical characterization data, not necessarily new in vivo testing. Note also that FDA’s own Table A.1 applies genotoxicity more narrowly than ISO does, so confirm which framework governs your specific submission.

Do I need a new Biological Evaluation Plan for every device?

No blanket requirement to start over. Most manufacturers can update an existing BEP to reflect current categorization logic and endpoint scope, provided the underlying risk assessment and chemical characterization data are still valid.

How does ISO 14971 relate to my biological evaluation?

ISO 10993-1:2025 is now more tightly embedded in the ISO 14971 risk management process. See our guide on risk management in medical devices under ISO 14971 for how that framework applies.

Where do I buy the current edition of ISO 10993-1?

Through an authorized reseller such as the ANSI Webstore, which also serves international buyers and offers standards in multiple languages. ISO 10993-1:2025 — ANSI Webstore — Coupon code CC2026 applies through December 31, 2026.

📥 Free Resources

ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements

Not Sure What to Do Next?

🔹 Still researching how the current standard applies to your device? Read our Biocompatibility Standards Overview for the full picture before you build a test matrix.

🔹 Ready to build or update your Biological Evaluation Plan? Download the ISO 13485 Gap Assessment Checklist and confirm your documentation controls support the categorization decisions you’re about to make.

🔹 Need to purchase the current standard? ISO 10993-1:2025 — ANSI Webstore — code CC2026 takes 5% off, and international buyers can access the standard in multiple languages through the same source.

The Standard Changed. Your Categorization Logic Should Too.

Table A.1 was a shortcut, and shortcuts age out. ISO 10993-1:2025 asks for a defensible, risk-based answer instead of a checked box — and that’s a better position to defend in front of a reviewer regardless of which edition your notified body is citing this quarter. The Standards Navigator will keep tracking how FDA recognition and international adoption evolve as this transition plays out.

Don’t Let a Reviewer Find the Gap First

Most biological evaluation gaps don’t get caught in your own review — they get caught by a notified body auditor or an FDA reviewer, months after the plan was finalized. Manufacturers who treat contact duration categorization as a one-time exercise tend to carry that risk forward through every product change. Manufacturers who build a documented, repeatable categorization process into their QMS catch the drift before it becomes a submission delay.

The Standards Navigator tracks ISO 10993, ISO 13485, and the broader medical device compliance landscape as it evolves — including regulatory recognition changes like FDA’s partial recognition of ISO 10993-1:2025.

👉 Get updates on medical device biocompatibility and QMS requirements
👉 Be first to access new gap assessment tools and implementation resources

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

MDR vs. ISO 13485: What’s the Difference and Which One Do You Actually Need in 2026?

EU MDR and ISO 13485 solve different problems — one is law, the other is a certifiable QMS standard. This guide breaks down the core differences, current 2026–2027 MDR transition timelines, and a decision framework for regulatory affairs teams navigating both.

A regulatory affairs guide to two rules that get confused constantly — and cost time when they are

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Question That Stalls Every EU Market Entry Meeting

Somewhere in almost every medical device compliance kickoff, someone asks it: “We already have ISO 13485. Doesn’t that cover MDR?”

It doesn’t. And the gap between MDR vs ISO 13485 — a certified quality management system and an EU-compliant technical file — is where CE marking timelines quietly slip by six to twelve months.

MDR (Regulation (EU) 2017/745) and ISO 13485 aren’t competing standards. They aren’t interchangeable either. One is EU law. The other is a voluntary international standard that EU law happens to lean on heavily. Confusing the two doesn’t just cost time — it costs Notified Body findings, delayed submissions, and in some cases, a device that can’t legally reach the European market on schedule.

From the floor: I’ve sat in a management review where a director insisted the ISO 13485 certificate meant the technical documentation was “basically done” for an EU submission. It wasn’t. The certificate covered their quality system — design controls, CAPA, document control. It said nothing about the clinical evaluation report, MDR classification requirements, or the device-specific evidence required for conformity assessment. They spent the next quarter closing that gap instead of reviewing it calmly six months earlier. That’s the exact mistake this article exists to prevent.

👉 Before you assume your QMS certification covers your EU submission, run the gap check. Most regulatory affairs teams don’t fail because they misunderstand ISO 13485 — they fail because they assumed certification and market access were the same milestone. Get the ISO 13485 Gap Assessment Checklist and find out before a Notified Body does.

In This Guide

What EU MDR 2017/745 actually regulates
What ISO 13485 actually certifies
The core differences, side by side
Why “ISO 13485 certified” doesn’t mean “MDR compliant”
Where the two genuinely overlap — risk management, CAPA, design controls, and more
Current MDR transition timelines and 2026 developments
Which one you need — and when you need both
Common documentation mistakes that surface in Notified Body reviews
FAQ

👉 Start Here

ISO 13485:2016 — Purchase the Official Standard — the current edition, direct from ANSI Webstore, available in multiple languages for international regulatory teams.
ISO 13485 Training Courses — BSI Group — structured training for teams building out clause-by-clause understanding ahead of certification or an MDR technical file build.

What Is EU MDR 2017/745?

MDR is law, not a certifiable management system standard. Regulation (EU) 2017/745 governs what a manufacturer must prove — about a specific device — before that device can carry a CE mark and legally reach the EU market.

It covers device classification (Class I through III), clinical evaluation and clinical data requirements, technical documentation per Annexes II and III, post-market surveillance and post-market clinical follow-up (PMCF), Unique Device Identification (UDI) and EUDAMED registration, and — for higher-risk devices — Notified Body conformity assessment under Annex IX.

MDR replaced the older Medical Device Directive (MDD) and Active Implantable Medical Devices Directive (AIMDD), and it raised the bar substantially on clinical evidence and post-market obligations compared to both.

What Is ISO 13485?

ISO 13485 is a voluntary, internationally recognized quality management system standard for organizations involved in the design, production, or servicing of medical devices. It’s certifiable — a Notified Body or accredited certification body audits your QMS against the standard’s clauses and issues a certificate if you pass.

ISO 13485 uses maintaining effectiveness language throughout, not the continual improvement language found in ISO 9001. It’s structured around risk-based thinking applied specifically to design controls, document and record control, supplier controls, CAPA, and management review — the operational backbone a device manufacturer needs regardless of which market it sells into.

Since FDA’s QMSR took effect February 2, 2026, 21 CFR Part 820 incorporates ISO 13485:2016 by reference — making it the enforceable quality management system standard for U.S. device manufacturers, not merely a reference point.

MDR vs. ISO 13485: Core Differences

Category	EU MDR 2017/745	ISO 13485
Nature	EU law — mandatory for CE marking	Voluntary international standard
Scope	Device-specific: classification, clinical evidence, technical file	Organization-wide: the QMS itself
Who assesses it	Notified Body (device-level conformity assessment)	Certification body (QMS audit)
Grants market access?	Yes — required for CE marking in the EU	No — supports it, doesn’t grant it
Geographic reach	EU/EEA market only	Recognized globally; now foundational to FDA QMSR
What it produces	Technical documentation, CER, PMS/PMCF plan, EUDAMED registration	A certificate covering your quality management system
Update cycle	Amended by EU legislative process (ongoing 2025–2027 reform)	Revised through ISO’s standard TC 210 process

Professional infographic comparing EU MDR 2017/745 and ISO 13485:2016, highlighting differences in regulatory requirements, quality management systems, CE marking, clinical evaluation, and technical documentation for medical device manufacturers. — This infographic compares EU MDR and ISO 13485, illustrating how one governs market access while the other establishes the quality management system that supports regulatory compliance.

Quick Answer:

Need CE marking? → MDR is required.
Need a compliant medical device QMS? → ISO 13485 is required.
Selling medical devices in the EU? → You almost certainly need both.

The stakes behind that table are real: the European Commission’s most recent Notified Bodies survey, published March 2026, showed roughly half of submitted MDR applications had reached certificate issuance — a gap driven largely by device misclassification, incomplete technical documentation, and thin clinical evidence, not by Notified Body capacity alone.

Why Manufacturers Conflate the Two

The most common objection I hear: “We’re ISO 13485 certified — why do we need a separate MDR effort?”

Here’s the resolution: ISO 13485 certification tells a Notified Body your quality system is sound. It says nothing about whether a specific device’s clinical evidence, risk classification, or technical file meets MDR’s requirements. A company can hold a spotless ISO 13485 certificate and still receive a Notified Body finding on a device submission because the clinical evaluation report was thin, the PMCF plan was missing, or the classification rule was misapplied under Annex VIII.

Think of it this way: ISO 13485 certifies the kitchen is clean and the process is controlled. MDR conformity assessment asks whether this specific dish meets the recipe, the nutrition label is accurate, and there’s a plan to keep checking it after it ships. You need both, but they answer different questions.

👉 If you are relying on your ISO 13485 certificate as your MDR readiness proof, that’s the gap to close first. Run the ISO 13485 Gap Assessment Checklist against your current technical files before your next Notified Body interaction.

Where MDR and ISO 13485 Overlap

Venn diagram infographic showing where EU MDR 2017/745 and ISO 13485:2016 overlap, highlighting shared quality management processes including risk management, design controls, CAPA, complaint handling, and supplier controls for medical device manufacturers. — This infographic illustrates the operational areas shared by EU MDR and ISO 13485 while distinguishing the unique regulatory and quality management requirements of each framework.

If they’re really two separate things, why does everyone talk about them in the same breath? Because the same five operational areas show up in both — just assessed from different angles.

Risk management — MDR requires risk management per Annex I general safety and performance requirements; ISO 13485 Clause 4.1.2 requires a risk-based approach throughout the QMS. Most manufacturers run one risk management process (typically ISO 14971-aligned) that satisfies both.
CAPA — ISO 13485 Clause 8.5 governs corrective and preventive action as a QMS requirement. MDR’s post-market surveillance and vigilance obligations feed directly into that same CAPA process when a field issue is identified.
Design controls — ISO 13485 Clause 7.3 sets design and development requirements; MDR’s technical documentation under Annex II leans on those same design records as evidence of a controlled development process.
Supplier controls — ISO 13485 Clause 7.4 requires supplier evaluation and monitoring; MDR expects that same supplier oversight to extend into the technical file wherever a supplier-controlled process affects device safety or performance.
Complaint handling — ISO 13485 Clause 8.2.2 sets complaint-handling requirements; MDR’s vigilance reporting obligations under Article 87 depend on that same complaint intake process to catch reportable events.

This is the practical reason ISO 13485 certification and MDR technical documentation feel like the same conversation even though they’re legally distinct: a well-run QMS produces most of the raw material an MDR technical file needs. The gap is rarely in these five areas — it’s in whether that raw material gets assembled into a device-specific technical file the way MDR expects.

MDR Transition Timelines: Where Things Stand in 2026

The transition provisions have shifted more than once since MDR took effect in May 2021, and manufacturers still working under legacy MDD or AIMDD certificates need to track the current deadlines carefully:

Class III custom-made implantable devices: compliance required by May 26, 2026
Class III and certain implantable Class IIb devices: transition extends to December 31, 2027
Most other Class IIb, IIa, and Class I devices: transition extends to December 31, 2028

Legacy device status under these extended timelines requires a valid MDD/AIMDD certificate, no significant design or intended-use change, continued compliance with the original directive, and a signed agreement with an MDR-designated Notified Body.

Separately, the European Commission published a proposal on December 16, 2025 to simplify and reduce administrative burden under both MDR and its IVDR counterpart — including changes to PRRC availability requirements and certificate validity limits. That proposal is still moving through the EU’s ordinary legislative process, and current projections put final adoption no earlier than the second quarter of 2027. Nothing in that proposal changes your obligations today. Manufacturers should keep building technical documentation to the current MDR text rather than waiting on a reform that hasn’t been adopted.

Timeline infographic showing the EU MDR transition deadlines for legacy medical devices in 2026, 2027, and 2028, along with ongoing requirements for technical documentation, clinical evaluation, post-market surveillance, and Notified Body agreements. — This timeline summarizes the current EU MDR transition deadlines for legacy medical devices while highlighting the ongoing compliance activities manufacturers must maintain throughout the transition period.

Do You Need Both? A Decision Framework

If you are selling into the EU market → MDR compliance is mandatory, full stop. ISO 13485 certification is not legally required by MDR text, but in practice Notified Bodies expect it as evidence your QMS can sustain the technical file over time.
If you are U.S.-only and not yet EU-bound → FDA’s QMSR incorporates ISO 13485:2016 by reference into 21 CFR Part 820, making alignment with ISO 13485 the foundation of U.S. medical device QMS compliance as of February 2, 2026. Third-party certification isn’t mandated by FDA, but the standard’s substance now is.
If you are already ISO 13485 certified and expanding into the EU → treat MDR as a device-level project layered on top of your existing QMS, not a QMS rebuild. The gap is almost always in clinical evidence and technical documentation, not in your quality processes.
If you are under customer or investor pressure to move fast → get the ISO 13485 gap assessment done first. It surfaces documentation gaps in days instead of finding them mid-audit.

Common Mistakes That Surface in Notified Body Review

Most common finding: Clinical evaluation reports that summarize literature but never tie evidence back to the specific device’s risk profile under Annex I general safety and performance requirements.

Other recurring gaps: PMCF plans that exist as a template but were never executed against real post-market data; UDI and EUDAMED registration treated as an afterthought instead of a parallel workstream; and design change records that don’t clearly show which MDR classification rule applied after a design modification.

⚠️ A Notified Body finding on any of these doesn’t necessarily mean your ISO 13485 QMS has failed — it usually means the QMS and the MDR technical file were built as two separate projects instead of one connected effort.

Quick Reference Checklist

✅ ISO 13485 certificate current and audit-ready
✅ Technical documentation mapped to current MDR Annex II/III requirements ✅ Clinical evaluation report tied to device-specific risk profile
✅ PMCF plan active and generating real post-market data
✅ UDI assigned and EUDAMED registration current
✅ Notified Body agreement in place if relying on legacy transition timelines
✅ Design change records show which classification rule applies post-modification

FAQ

Does ISO 13485 certification satisfy MDR requirements?

No. ISO 13485 certifies your quality management system. MDR requires separate, device-specific technical documentation, clinical evidence, and — for most devices — Notified Body conformity assessment. Certification supports MDR compliance; it doesn’t substitute for it.

Is ISO 13485 mandatory for the EU market?

MDR text doesn’t explicitly mandate ISO 13485 certification, but in practice, Notified Bodies expect a certified QMS as part of demonstrating your ability to sustain compliance. Most manufacturers pursuing MDR conformity hold ISO 13485 certification for this reason.

Do U.S.-only manufacturers need to worry about MDR?

Not directly, unless you plan to sell into the EU. However, FDA’s QMSR — effective February 2, 2026 — makes ISO 13485:2016 the operative U.S. regulation, so ISO 13485 alignment now matters regardless of whether MDR applies to you.

What’s the current MDR transition deadline for legacy devices?

It depends on device classification: Class III custom-made implantables faced a May 26, 2026 deadline, Class III and certain implantable Class IIb devices extend to December 31, 2027, and most other devices extend to December 31, 2028 — provided legacy status conditions are met.

Is the EU actually changing MDR requirements soon?

The European Commission proposed simplification changes on December 16, 2025, but the proposal is still in the EU legislative process, with final adoption not expected before the second quarter of 2027. Current MDR requirements remain fully in effect in the meantime.

What’s the biggest documentation gap Notified Bodies flag?

Clinical evaluation reports that summarize literature broadly without tying the evidence directly to the specific device’s risk profile under the general safety and performance requirements.

Can one gap assessment cover both ISO 13485 certification readiness and MDR technical file readiness?

A well-structured gap assessment should flag both, but they’re different reviews at their core — one audits your QMS against ISO 13485 clauses, the other audits your technical documentation against MDR annexes. Treat them as connected but distinct workstreams.

Where should a manufacturer start if pursuing both?

Start with the QMS. A certified, functioning ISO 13485 system gives you the document control, CAPA, and design control infrastructure that MDR technical documentation depends on. Building MDR documentation on top of a shaky QMS just relocates the problem.

📥 Free Resources

ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements before certification or a Notified Body review.
ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system from the ground up.
Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements across production environments.

Not Sure What to Do Next?

🔹 Still researching the difference between MDR and ISO 13485? Start with What Is ISO 13485? and FDA QSR vs. ISO 13485 to ground the fundamentals before your next planning meeting.

🔹 Ready to close the documentation gap? Review ISO 13485 Documentation Requirements and Validation & Verification Requirements against your current technical files.

🔹 Need to purchase the standard itself? Get ISO 13485:2016 directly from ANSI Webstore — available internationally, with multi-language editions for global regulatory teams. Use code CC2026 for 5% off through December 31, 2026.

MDR and ISO 13485 solve different problems, and treating them as one project is how audit-ready timelines slip by a quarter or more. The Standards Navigator will keep tracking both as EU reform proposals and FDA QMSR guidance continue to evolve through 2026 and 2027.

Stop Guessing Where Your MDR Gap Actually Is

Regulatory teams that treat MDR and ISO 13485 as one combined project usually discover the gap during a Notified Body review — the worst possible time to find it. Teams that separate the two, and check each on its own terms, walk into that review with documentation that already matches what’s being asked.

The Standards Navigator tracks EU MDR developments, FDA QMSR alignment, and ISO 13485 implementation detail so medical device teams aren’t relying on outdated guidance six months into a submission.

👉 Get updates on MDR, ISO 13485, and medical device regulatory changes as they happen
👉 Be first to access new gap assessment tools and documentation resources for regulatory affairs teams

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

Medical Device Compliance Standards: What Manufacturers Need to Know in 2026

Medical device manufacturers face a layered compliance framework — ISO 13485, ISO 14971, FDA QMSR, and EU MDR each impose specific requirements that must work together as an integrated system. This guide explains the core standards, how they interact, and what manufacturers need to prioritize at each stage of the compliance process.

The regulatory framework every medical device manufacturer must understand before the first audit

Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.

The Compliance Gap That Gets Medical Device Manufacturers in Trouble

Most medical device manufacturers don’t fail audits because they ignored the requirements. They fail because they didn’t understand how the requirements connect — and which standards they were actually obligated to meet.

The medical device compliance standards landscape is layered. ISO 13485 sets the QMS framework. ISO 14971 governs risk management. FDA regulations run parallel to international standards and don’t always align. Supplier controls, sterilization validation, design controls, and labeling each carry their own standard reference. A manufacturer who treats these as independent checkboxes instead of an integrated system is building toward an audit finding — or worse, a product recall.

The stakes are not abstract. The FDA issued 483 observations totaling thousands of findings in the medical device sector last year. Most cited documentation gaps, inadequate CAPA processes, or failure to meet design control requirements — all areas governed by the standards covered in this guide.

I’ve worked in quality systems that span heavy industrial, energy, and manufacturing environments — and the pattern I’ve seen across every sector is the same: organizations that struggle with audits are usually managing compliance requirements in silos. In the medical device world, that problem is amplified because the regulatory framework is both more complex and less forgiving than most industrial standards. Getting the structure right before your first audit is not optional — it’s the difference between certification and a warning letter.

Before you map your compliance requirements, download the ISO 13485 Gap Assessment Checklist — it walks you through every clause so you can identify exactly where your QMS falls short before an auditor does → ISO 13485 Gap Assessment Checklist

In This Guide:

The core standards every medical device manufacturer must know
How ISO 13485, ISO 14971, and FDA regulations interact
US vs. EU regulatory requirements compared
Supplier control and special process standards
Decision-stage guidance: what to prioritize based on where you are in the compliance process

👉 Start Here — Top Resources

Buy ISO 13485:2016 — ANSI Webstore — the official QMS standard for medical device manufacturers (use code CC2026 for 5% off)
ISO 13485 Training — BSI Group — training courses and certification services for ISO 13485
Buy ISO 14971:2019 — ANSI Webstore — risk management standard required alongside ISO 13485

The Core Standard: ISO 13485:2016

ISO 13485:2016 infographic showing clause structure and comparison of ISO 13485 versus ISO 9001 requirements for medical device quality management systems. — A visual breakdown of ISO 13485:2016 requirements and how they differ from ISO 9001 for medical device manufacturers.

ISO 13485:2016 is the international standard for quality management systems specific to medical device manufacturers and their supply chains. It is the foundation of medical device compliance worldwide.

ISO 13485 is not simply ISO 9001 with medical device language added. The two standards share structural similarities through the harmonized high-level clause structure, but ISO 13485 imposes stricter requirements in several critical areas ISO 9001 leaves to organizational discretion:

Requirement Area	ISO 9001:2015	ISO 13485:2016
Risk management	Risk-based thinking (general)	Formal risk management required (links to ISO 14971)
Design controls	Required	More prescriptive — validation, verification, design transfer
CAPA	Required	More detailed — specific investigation and effectiveness checks
Regulatory requirements	Not addressed	Explicitly required — must identify and meet applicable regs
Sterile product controls	Not addressed	Specific controls for sterile devices
Supplier controls	Required	More stringent — supplier qualification and monitoring
Document and record retention	Not specified	Specific retention periods tied to device lifetime

If you are ISO 9001 certified and entering the medical device market, you are not starting from scratch — but you are adding significant requirements. The gap is larger than most manufacturers expect.

If you need the standard itself, ISO 13485:2016 is available through the ANSI Webstore — use code CC2026 for 5% off through December 31, 2026.

Most common finding: Inadequate document control — specifically, failure to control the review and approval of documents and maintain records of changes. ISO 13485 Clause 4.2 is one of the most frequently cited areas in FDA 483 observations.

Risk Management: ISO 14971:2019

ISO 14971 is the international standard for risk management applied to medical devices. It is not optional if you are manufacturing medical devices — ISO 13485 explicitly requires you to apply risk management throughout the product lifecycle, and ISO 14971 is the recognized method for doing it.

ISO 14971:2019 defines the process for:

Identifying hazards associated with a medical device
Estimating and evaluating associated risks
Controlling those risks
Monitoring the effectiveness of controls

The relationship between ISO 13485 and ISO 14971 is not optional. ISO 13485 Clause 7.1 requires organizations to establish risk management requirements for product realization. ISO 14971 is the standard that defines what “proper” risk management looks like. Auditors will look for evidence that your risk management file connects directly to your design controls, production processes, and post-market surveillance activities.

ISO 14971 vs. ISO 13485 — understanding how they interact is one of the most common questions from manufacturers building a QMS for the first time.

If your risk management files exist independently of your design control documentation — that is an audit finding waiting to happen. Most teams miss the linkage between hazard identification in the risk management file and the verification/validation activities in the design history file.

Run your gap assessment before you go further — most QMS gaps in medical device companies trace back to missing connections between ISO 14971 risk files and ISO 13485 design controls: ISO 13485 Gap Assessment Checklist

US Regulatory Requirements: FDA QMSR and 21 CFR Part 820

US medical device manufacturers operate under FDA jurisdiction. The Quality Management System Regulation (QMSR), which took effect February 2, 2026, replaced the legacy Quality System Regulation (QSR) under 21 CFR Part 820.

The QMSR represents a significant shift: it incorporates ISO 13485:2016 by reference as the baseline for device QMS requirements. This means FDA-regulated manufacturers who are ISO 13485 certified are closer to QMSR compliance than they were under the old QSR — but important differences remain.

Area	ISO 13485:2016	FDA QMSR (2026)
Scope	International	US market devices only
Complaints	Required	Required + specific MDR reporting timelines
Corrections and removals	Addressed in CAPA	Specific FDA reporting requirements (21 CFR Part 806)
UDI	Not addressed	Required for most device classes
Electronic records	Not specified	21 CFR Part 11 compliance required
Third-party audits	Required for ISO 13485 certification	FDA inspections — not third-party certification

Understanding the relationship between FDA QSR and ISO 13485 is essential for US manufacturers — the two frameworks are now more aligned than before, but they are not identical.

If you are selling devices in the US market, FDA QMSR compliance is a legal requirement, not a voluntary certification. ISO 13485 certification does not satisfy FDA obligations — it demonstrates QMS capability but does not substitute for an FDA inspection.

Comparison infographic showing US FDA QMSR and EU MDR regulatory pathways for medical device manufacturers and ISO 13485 quality system requirements. — A side-by-side comparison of US FDA QMSR and EU MDR pathways showing how medical device compliance differs across global markets.

EU Requirements: MDR and CE Marking

Selling medical devices in the European Union requires CE marking under the EU Medical Device Regulation (MDR 2017/745), which replaced the Medical Device Directive (MDD) and came into full effect in 2021. The transition deadline for legacy MDD-certified devices has been extended but enforcement has tightened significantly.

Key MDR requirements relevant to QMS:

MDR Requirement	Connection to ISO 13485
Technical documentation	Design history file / DHF requirements
Clinical evaluation	Post-market clinical follow-up (PMCF)
Unique Device Identification (UDI)	Traceability requirements
Post-market surveillance (PMS)	Customer feedback and complaint monitoring
Notified Body audit	ISO 13485 certification is typically required
Person Responsible for Regulatory Compliance (PRRC)	Management responsibility — ISO 13485 Clause 5

The MDR is more prescriptive than ISO 13485 in clinical evidence requirements. If you are exporting to the EU, your clinical evaluation report and post-market surveillance plan must meet MDR requirements that go beyond what ISO 13485 explicitly requires.

If you are selling in both the US and EU markets, you are managing two regulatory frameworks simultaneously. This is where a well-structured ISO 13485 QMS becomes particularly valuable — it provides the common foundation that both frameworks build on.

Supplier Controls and Special Process Standards

ISO 13485 Clause 7.4 imposes stricter supplier control requirements than most manufacturers new to the medical device space expect. You are not simply verifying that a supplier has a quality system — you are responsible for ensuring that purchased products and services meet specified requirements and that critical suppliers are evaluated, approved, and monitored.

For medical device manufacturers, supplier controls must address:

Supplier qualification — documented criteria for evaluation and approval
Incoming inspection — defined acceptance criteria for purchased product
Critical supplier monitoring — ongoing performance data, not just initial qualification
Supplier audits — for high-risk or critical component suppliers
Flow-down requirements — pushing your quality requirements into the supply chain

Special processes — sterilization, biocompatibility testing, coating, welding on implantable components — require additional validation documentation. The relevant standards include:

Process	Standard Reference
Sterilization (EO, radiation, steam)	ISO 11135, ISO 11137, ISO 17665
Biocompatibility	ISO 10993 series
Packaging validation	ASTM F2132, ISO 11607
Software validation	IEC 62304
Electrical safety	IEC 60601 series

These are not optional for manufacturers of the relevant device types. If your device is sterilized, you need sterilization validation documentation. If it contacts patient tissue, you need biocompatibility data. Gaps in special process validation are among the most serious findings an FDA inspector or Notified Body auditor can cite.

Design Controls and Validation Standards

ISO 13485 design controls infographic showing the Design History File process from inputs through outputs, verification, validation, and design transfer. — A visual guide to the ISO 13485 design controls process and how design inputs become validated, production-ready medical devices.

Design controls are where ISO 13485 certification and FDA compliance intersect most directly. ISO 13485 Clause 7.3 requires a structured design and development process covering:

Design and development planning
Design inputs (requirements)
Design outputs (specifications)
Design review at defined stages
Design verification (does it meet inputs?)
Design validation (does it meet user needs?)
Design transfer (can it be manufactured consistently?)
Design changes (controlled and documented)

The design history file (DHF) is the physical record of this entire process. It is the first thing an FDA inspector or Notified Body auditor will request. Manufacturers who build their DHF as a collection of unconnected documents — rather than as a traceable record linking inputs to outputs to verification to validation — create significant risk for themselves.

If you are new to building a medical device QMS and need a structured path through these requirements, the ISO 13485 Implementation Roadmap on The Standards Navigator covers the full sequence from gap assessment through certification.

BSI Group offers ISO 13485 training covering both requirements understanding and implementation — useful for teams building their first medical device QMS or transitioning from a general ISO 9001 system.

Labeling and Traceability Standards

Labeling compliance is a specific, frequently cited area in FDA 483 observations. Under both FDA QMSR and MDR requirements, device labeling must meet defined content and format requirements — and the label must be controlled as a quality record.

Key labeling standards and requirements:

ISO 15223-1 — symbols used in medical device labeling (required for EU MDR compliance)
21 CFR Part 801 — FDA labeling requirements for US devices
UDI requirements — FDA requires Unique Device Identification on most device labels, with submission to the GUDID database

Traceability connects directly to your CAPA and complaint handling processes. If a complaint involves a specific lot or device unit, your traceability records must be sufficient to identify affected products, investigate the root cause, and determine corrective action scope. ISO 13485 Clause 7.5.9 addresses traceability explicitly — and auditors will test it.

How the Standards Work Together

Layered medical device compliance standards infographic showing ISO 13485 as the foundation with ISO 14971, FDA QMSR, EU MDR, supplier controls, CAPA, and traceability requirements. — A visual framework showing how ISO 13485, FDA QMSR, EU MDR, and supporting standards connect into an integrated medical device compliance system.

The most important thing to understand about medical device compliance is that these standards are not independent — they form an integrated system. Here is how they connect:

Standard	Role in the System
ISO 13485:2016	QMS framework — the backbone that everything else connects to
ISO 14971:2019	Risk management process — required by ISO 13485, referenced throughout
FDA QMSR	US regulatory layer — builds on ISO 13485, adds FDA-specific requirements
EU MDR	EU regulatory layer — requires ISO 13485 certification via Notified Body
IEC 62304	Software lifecycle — required if your device includes software
ISO 10993	Biocompatibility — required for patient-contacting devices
ISO 15223	Labeling symbols — required for EU MDR labeling compliance

A manufacturer who has ISO 13485 certification, a complete ISO 14971 risk management file, and solid FDA QMSR documentation has built the framework that all additional standards layer onto. The common mistake is treating each standard as a separate compliance project rather than building the integrated system first.

If you are deciding between prioritizing FDA QMSR or ISO 13485 certification first: in most cases, building to ISO 13485 gives you the QMS foundation that both US and EU regulatory compliance require. The ISO 13485 Documentation Requirements article covers what your QMS documentation set must include.

Quick Compliance Checklist

Use this as a starting reference — not a substitute for a clause-by-clause gap assessment.

✅ ISO 13485:2016 obtained and QMS scope defined
✅ Risk management procedure in place referencing ISO 14971
✅ Design controls documented — inputs, outputs, verification, validation, transfer
✅ CAPA process established with effectiveness verification
✅ Supplier qualification and monitoring program documented
✅ Document and record control procedures in place with defined retention periods
✅ Internal audit program scheduled and resourced
✅ Management review process defined and conducted
✅ Complaint handling and MDR/vigilance reporting process established
✅ UDI requirements evaluated and implemented where applicable
✅ Applicable special process validations identified and documented
✅ Labeling reviewed against ISO 15223 (EU) and 21 CFR Part 801 (US)

⚠️ If you cannot check most of these — complete a formal gap assessment before committing to a certification timeline.

FAQ

Is ISO 13485 certification required to sell medical devices?

ISO 13485 certification is not legally required by US law — the FDA requires QMSR compliance, not ISO 13485 certification specifically. However, ISO 13485 certification is required to sell devices in the EU under MDR, and it is increasingly required by OEM customers and contract manufacturers as a condition of doing business. Most manufacturers targeting both markets pursue certification.

How is ISO 13485 different from ISO 9001?

ISO 13485 is a sector-specific standard derived from ISO 9001 but with significantly stricter requirements in risk management, design controls, CAPA, supplier controls, and regulatory compliance. It does not include the continual improvement emphasis that ISO 9001 requires — instead it focuses on consistent compliance with regulatory requirements. A detailed comparison is covered here.

Do I need ISO 14971 if I am ISO 13485 certified?

Yes. ISO 13485 explicitly requires risk management throughout the product lifecycle and references ISO 14971 as the applicable method. You are not ISO 13485 compliant if your risk management process does not meet ISO 14971 requirements. The two standards work together — you cannot separate them.

What is the FDA QMSR and how is it different from the old QSR?

The Quality Management System Regulation (QMSR) took effect February 2, 2026 and replaced 21 CFR Part 820 (the Quality System Regulation). The QMSR incorporates ISO 13485:2016 by reference, making it more aligned with the international standard. Key differences remain around FDA-specific reporting requirements, UDI obligations, and 21 CFR Part 11 electronic records requirements. A full breakdown of FDA QSR vs ISO 13485 is here.

How long does it take to get ISO 13485 certified?

For a manufacturer building a QMS from scratch, 12–18 months is a realistic timeline. Organizations with an existing ISO 9001 QMS can often close the gap in 6–12 months, depending on how many medical device-specific requirements need to be added. The ISO 13485 Implementation Roadmap covers the full timeline in detail.

What is a Notified Body and do I need one?

A Notified Body is an organization designated by EU member states to assess conformity of medical devices under the MDR. If you are seeking CE marking for Class IIa, IIb, or Class III devices, you must engage a Notified Body — they conduct the audits that verify ISO 13485 compliance and technical documentation. BSI Group is one of the major Notified Bodies offering both training and certification services.

What are the most common ISO 13485 audit findings?

The most frequently cited areas include: inadequate document and record control (Clause 4.2), incomplete CAPA processes with missing effectiveness verification (Clause 8.5.2), insufficient supplier qualification documentation (Clause 7.4), and gaps in design control records — particularly missing design verification and validation evidence (Clause 7.3). Common mistakes in ISO 13485 QMS implementation covers these in detail.

Do my suppliers need to be ISO 13485 certified?

Not necessarily — but you are responsible for ensuring purchased product meets specifications regardless. Whether a supplier needs ISO 13485 certification depends on their criticality and what they supply. Critical component suppliers and contract manufacturers of finished devices are typically expected to be certified. Commodity suppliers may only require documented incoming inspection.

📥 Free Resources

ISO 13485 Gap Assessment Checklist — free checklist for medical device manufacturers assessing their QMS against ISO 13485 requirements — medical device articles only

ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system

Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments

Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts

AS9100 Rev D Gap Assessment Checklist — 74-item clause-by-clause checklist for aerospace suppliers assessing their QMS before certification

Not Sure What to Do Next?

🔹 Still researching your compliance requirements? Start with a gap assessment against ISO 13485 before you invest in implementation. Download the free ISO 13485 Gap Assessment Checklist — it maps every clause so you know exactly where you stand.

🔹 Ready to build your QMS? ISO 13485 training through BSI Group covers requirements, implementation, and internal auditor training — the right sequence for a team building their first medical device QMS.

🔹 Need the standard itself? Buy ISO 13485:2016 through the ANSI Webstore — use code CC2026 for 5% off through December 31, 2026. International buyers can purchase in multiple languages.

Medical device compliance is not a single standard — it is a framework of interconnected requirements that must be built and maintained as a system. Understanding how ISO 13485, ISO 14971, FDA QMSR, and EU MDR relate to each other is the first step toward building a QMS that holds up under audit. The Standards Navigator covers each of these standards in depth — start with the resources above and build from there.

Stay Current on Medical Device Compliance

Regulatory changes in the medical device space don’t slow down. FDA QMSR took effect in 2026. EU MDR enforcement is intensifying. ISO 14971 continues to be misapplied by manufacturers who treat risk management as a documentation exercise rather than an integrated process.

Organizations that keep pace with these changes have one thing in common — they’re not waiting for an audit finding to tell them something changed. The ones that struggle are managing compliance reactively, updating their QMS only when a customer or inspector forces the issue.

The Standards Navigator covers ISO 13485, ISO 14971, FDA regulatory requirements, and the full medical device compliance framework — from standard purchase through certification and ongoing surveillance.

👉 Get updates when new medical device compliance articles publish
👉 Be first to access the ISO 13485 Documentation Kit when it launches

Subscribe below to stay ahead.

The Standards Navigator — Industrial Compliance. Clearly Explained.

The Internal Audit That Used to Be Private Isn’t Anymore

In This Guide

Table of Contents

👉 Start Here (Top Resources)

What Clause 8.2.4 Actually Requires

Internal Audits vs. Supplier Audits vs. Certification Audits

Auditor Competence: What Clause 6.2 Actually Requires

Building a Risk-Based Audit Program

The Internal Audit Process, Step by Step

A Real Finding, Start to Finish

The Five Most Common Findings

MDSAP: What Changes for Multi-Market Audits

What Changed: QMSR and ISO 19011:2026

Quick Audit-Readiness Checklist

FAQ

How often does ISO 13485 require internal audits?

Can the same person who performs a process also audit it?

Do internal auditors need a formal certification?

Does the FDA QMSR require a separate internal audit program from ISO 13485?

Are internal audit reports confidential from FDA inspectors?

What’s the difference between an internal audit and a supplier audit under ISO 13485?

Does MDSAP replace our ISO 13485 internal audit requirement?

What’s the most common reason internal audit programs fail a certification audit?

Should we hire a consultant to run our internal audits, or can we do it ourselves?

📥 Free Resources

Not Sure What to Do Next?

Subscribe for Medical Device Compliance Updates

Subscribe

The Matrix Changed. If Your Biological Evaluation Plan Still Reads Like 2018, You Have a Gap

In This Guide

Table of Contents

👉 Start Here (Top Resources)

Why the Evaluation Matrix Was Restructured

Contact Duration Categories, Defined

Daily Contact vs. Intermittent Contact

Reusable Devices and Total Exposure Period

Mapping Contact Category to Biological Endpoints

FDA’s Partial Recognition — What’s Excluded

Common Categorization Mistakes

Quick Audit Checklist

FAQ

Does ISO 10993-1:2025 require me to retest devices already on the market?

Is ISO 10993-1:2018 still valid to use?

What’s the difference between “prolonged” and “long-term” contact?

Does the 2025 edition apply to devices regulated under the EU MDR?

Is genotoxicity testing now mandatory for every prolonged-contact device?

Do I need a new Biological Evaluation Plan for every device?

How does ISO 14971 relate to my biological evaluation?

Where do I buy the current edition of ISO 10993-1?

📥 Free Resources

Not Sure What to Do Next?

The Standard Changed. Your Categorization Logic Should Too.

Don’t Let a Reviewer Find the Gap First

Subscribe

The Question That Stalls Every EU Market Entry Meeting

In This Guide

Table of Contents

👉 Start Here

What Is EU MDR 2017/745?

What Is ISO 13485?

MDR vs. ISO 13485: Core Differences

Why Manufacturers Conflate the Two

Where MDR and ISO 13485 Overlap

MDR Transition Timelines: Where Things Stand in 2026

Do You Need Both? A Decision Framework

Common Mistakes That Surface in Notified Body Review

Quick Reference Checklist

FAQ

Does ISO 13485 certification satisfy MDR requirements?

Is ISO 13485 mandatory for the EU market?

Do U.S.-only manufacturers need to worry about MDR?

What’s the current MDR transition deadline for legacy devices?

Is the EU actually changing MDR requirements soon?

What’s the biggest documentation gap Notified Bodies flag?

Can one gap assessment cover both ISO 13485 certification readiness and MDR technical file readiness?

Where should a manufacturer start if pursuing both?

📥 Free Resources

Not Sure What to Do Next?

Stop Guessing Where Your MDR Gap Actually Is

Subscribe