ISO 9001 vs ISO 13485: Which Do You Need?
ISO 9001 and ISO 13485 are both quality management system standards, and they share a lot of DNA. ISO 13485 was derived from ISO 9001, and both use a process approach built around planning, doing, checking and acting.
They are written for different purposes, though. ISO 9001 is a general standard for any organization that wants consistent products and satisfied customers. ISO 13485 is written for the medical device industry, where the main concern is safe, effective devices and meeting regulatory requirements.
Here is how to decide which one you need.
Who ISO 9001 fits
ISO 9001 applies to any organization in any industry. It is the common choice for:
Manufacturers of industrial, consumer and commercial products
Contract manufacturers and machine shops
Component and material suppliers
Service providers whose customers ask for a certified quality system
The current edition is ISO 9001:2026, published on September 16, 2026. It emphasizes leadership, quality culture and ethical behavior, and it separates the handling of risks and opportunities. For the details, see our ISO 9001:2026 changes post.
Who ISO 13485 fits
ISO 13485:2016 is for organizations involved in the life cycle of medical devices, including:
Medical device manufacturers
Contract manufacturers and sterilizers serving device companies
Suppliers of components, materials or services to device makers
Distributors, importers and service providers in the device supply chain
If you sell devices in the United States, ISO 13485 now matters directly. FDA's Quality Management System Regulation (QMSR) took effect on February 2, 2026. It amends 21 CFR Part 820 to incorporate ISO 13485:2016 by reference, along with clause 3 of ISO 9000:2015 for terms and definitions. Where the standard conflicts with the FD&C Act or FDA regulations, the FDA requirements control.
The QMSR incorporates ISO 13485, not ISO 9001. The new edition of ISO 9001 does not change QMSR requirements.
Key differences
Purpose and regulatory focus
ISO 9001 centers on customer satisfaction and continual improvement. It does not mandate any industry-specific regulations, beyond requiring you to meet the statutory and regulatory requirements that apply to your products.
ISO 13485 centers on meeting regulatory requirements and on device safety and performance. Regulatory requirements appear throughout the standard, from document control to complaint handling and reporting to regulatory authorities.
Continual improvement
ISO 9001 expects continual improvement of the QMS. In the 2026 edition, leadership is expected to promote it as part of a quality culture.
ISO 13485 places less emphasis on continual improvement. It focuses on establishing processes and maintaining their effectiveness. The reasoning is that in a regulated environment, a stable, validated, controlled process is worth more than constant change, and changes need evaluation before they happen.
Customer satisfaction
ISO 9001 asks you to monitor customer perceptions of whether their needs and expectations have been met. ISO 13485 replaces that with feedback, a systematic process to gather and use information from customers and the market, which feeds risk management and post-market activities.
Documentation
ISO 9001 is flexible. It does not require a quality manual or specific procedures, and it leaves much of the documentation decision to you.
ISO 13485 is more prescriptive. It requires:
A quality manual
Documented procedures for many processes
A medical device file for each device type or family
Records retained for at least the lifetime of the device as defined by the organization, but not less than two years from product release, or longer if regulations require
Expect a larger, more detailed document set under ISO 13485.
Risk management
ISO 9001 uses risk-based thinking. You determine risks and opportunities that affect the QMS and its intended results, and act in proportion to their impact.
ISO 13485 applies risk management to product realization, focused on device safety and performance. In practice, device manufacturers follow ISO 14971 for product risk management across the device life cycle.
Product-specific requirements
ISO 13485 includes requirements ISO 9001 does not address, such as cleanliness and contamination control, sterile device processes, software validation for QMS and production software, process validation, traceability for implantable devices, and reporting to regulatory authorities.
When a dual-standard system makes sense
Some organizations need both. Typical cases:
Suppliers serving both industrial and medical customers. A machine shop or molder may need ISO 9001 for most customers and ISO 13485 for device makers.
Device companies whose customers or tenders ask for ISO 9001. Some contracts specify ISO 9001 even for device work.
Companies moving into medical devices. An ISO 9001 manufacturer adding a device line can extend its system rather than start over.
Multi-division businesses. One integrated system can be easier to run than two parallel ones.
A dual-standard system works best as one integrated QMS. Write procedures that meet the stricter ISO 13485 requirements where they apply, and add ISO 9001 elements such as continual improvement, customer satisfaction monitoring, quality culture and the 2026 risk and opportunity structure.
Keep the scope clear. Your QMS scope statement and certificates should state which sites, products and processes fall under which standard.
If you are dual-certified, review where ISO 9001:2026 touches shared procedures. Management review inputs, internal audit planning and change control are common places where small updates are needed.
How to decide
Ask three questions:
Do you design, make or supply medical devices, or parts and services for them? If yes, you likely need ISO 13485. If you sell devices in the US, the QMSR makes it the basis for FDA compliance.
Do any customers require ISO 9001 specifically? If yes and you also serve device makers, consider a dual-standard system.
Is your business outside medical devices entirely? ISO 9001 is likely the right choice.
When in doubt, ask your customers what certificate they expect and check with a certification body about scope options.
Documents for each path
A.P. Lyon offers editable Word and Excel documents for all three paths. They work on paper or in an eQMS and include one year of free updates.
ISO 9001 QMS: three packages (Base $595, Standard $995, Complete $1,295) and 58 individual procedures
Dual-Standard ISO 9001 + ISO 13485 QMS: three packages from $1,345 and 76 procedures
ISO 13485 & FDA QMSR QMS: three packages from $1,195 and 81 procedures
See all packages side by side on Compare QMS Packages, or pick the procedures you need in Build Your QMS, where volume discounts start at 20% off for five procedures. For QMSR background, visit the FDA QMSR and ISO 13485 Resource Center.
Not sure which standard fits? A.P. Lyon founder Aaron Lyon has more than 30 years in product design, development and global manufacturing and is a former Senior Director of Regulatory Affairs. Contact us about consulting.
For the bigger picture, including transition timing and how to choose a package, see our ISO 9001:2026 Guide.
Comments