A Different World From Management System Certification
For a certification body experienced in ISO 9001 or ISO 14001, entering the medical device certification space feels like stepping into a different industry. The standard itself — ISO 13485:2016 — shares structural similarities with other management system standards, but the scope framework, regulatory context, and audit requirements are fundamentally different.
The differences begin with how scope is defined and extend through every aspect of audit planning, team assignment, and certification decision-making. A CB that tries to manage ISO 13485 certification using the same tools and processes it uses for ISO 9001 will encounter problems quickly.
Device Classes Replace EA Codes
In management system certification, scope is classified using EA codes. A manufacturer of electronic components falls under EA 19. A food processor falls under EA 3. The system is straightforward: one classification framework applied consistently across standards.
ISO 13485 does not use EA codes. Instead, the scope of certification is defined by:
- •Device classification: Medical devices are classified into risk-based categories. In the EU, this means Class I, Class IIa, Class IIb, and Class III, with Class III representing the highest risk. In the US, the FDA uses a different classification system. In other jurisdictions, yet other systems apply.
- •Device type and intended use: The scope must describe what the organization actually manufactures or services — not just an industry category, but specific device types. "Orthopedic implants" is a different scope than "diagnostic imaging equipment," even though both might fall under the same device class.
- •Organizational role: ISO 13485 covers manufacturers, authorized representatives, importers, and distributors. The scope requirements differ based on the organization's role in the supply chain.
This means the CB's scope management system must accommodate device classifications that vary by regulatory jurisdiction, device types that are specific to each client, and organizational roles that affect which clauses of the standard apply.
Territory-Based Regulatory Requirements
Unlike ISO 9001, which is largely regulation-agnostic, ISO 13485 certification exists within a regulatory ecosystem. The standard itself references applicable regulatory requirements repeatedly. In practice, this means:
- •EU Medical Device Regulation (MDR): If the client sells devices in the EU, the CB must understand MDR requirements and how they interact with ISO 13485 certification. The CB may also need to be a Notified Body to perform conformity assessments under MDR — a separate accreditation with its own requirements.
- •FDA 21 CFR Part 820: If the client sells in the US, the quality system requirements overlap with but differ from ISO 13485. The audit must account for these differences.
- •MDSAP (Medical Device Single Audit Program): Some CBs participate in MDSAP, which allows a single audit to cover regulatory requirements for multiple jurisdictions (US, Canada, Brazil, Australia, Japan). This adds another layer of scope complexity.
For a CB like Vanguard Medical Certifications, managing these territorial requirements means tracking not just what the client manufactures but where they sell it. A client manufacturing Class IIa diagnostic devices sold in the EU and Canada has different scope requirements than a client manufacturing the same devices sold only domestically.
Technical Areas and Auditor Competence
The auditor competence requirements for ISO 13485 are more demanding than for general management system standards. An auditor must understand:
- •Medical device technology: Auditors need knowledge of the specific device technologies they audit. An auditor qualified for in-vitro diagnostic devices may not be qualified for active implantable devices. The CB must track technical area competence, not just standard-level qualification.
- •Regulatory knowledge: Auditors must understand the regulatory frameworks applicable to the client's markets. An audit of a company selling into the EU requires knowledge of MDR requirements. An audit covering MDSAP requires knowledge of multiple regulatory frameworks.
- •Sterile device manufacturing: If the client manufactures sterile devices, the auditor needs competence in sterilization processes, cleanroom operations, and the associated validation requirements.
- •Software as a medical device (SaMD): The growing category of software-based medical devices requires auditors with software development lifecycle expertise and understanding of IEC 62304.
This means auditor qualification in the ISO 13485 context is multi-dimensional. It is not enough to know that an auditor is "qualified for ISO 13485." The CB must know their specific technical areas, their regulatory jurisdiction knowledge, and their experience with particular device categories.
Where Standard CB Tools Break Down
A CB that manages medical device certification using tools designed for general management system certification encounters specific failures:
Scope records cannot accommodate the data. The system has fields for EA codes but no fields for device classification, device type, or applicable regulatory jurisdiction. The planner resorts to free-text descriptions that cannot be searched, validated, or used for auditor matching.
Auditor qualification matching fails. The system can match auditors to EA codes but not to medical device technical areas. A planner looking for an auditor with competence in active implantable devices and EU MDR knowledge must manually check CVs and qualification records.
Audit time calculations are wrong. The standard MD 5 audit time tables are designed for management system standards using EA codes and employee counts. Medical device certification has its own audit time considerations based on device risk class, number of device families, and regulatory scope. Using MD 5 tables produces incorrect estimates.
Certificate content is insufficient. ISO 13485 certificates must specify the scope in terms that reflect the medical device context — device types, classes, and applicable regulatory frameworks. A certificate template designed for ISO 9001, listing EA codes and a general scope statement, does not meet ISO 13485 requirements.
How Certiva Handles ISO 13485
Certiva addresses medical device certification through the same approach it uses for other specialized standards: a distinct scope model configured for the standard's requirements.
- •Device classification is tracked per client. The scope record includes device class, device type descriptions, organizational role, and applicable regulatory territories. This information is structured and searchable, not hidden in free-text fields.
- •Technical area qualifications are mapped for auditors. The auditor competence profile includes medical device technical areas, regulatory jurisdiction knowledge, and specific device category experience. The planner can filter auditors by these criteria when assembling an audit team.
- •Audit time calculations use the appropriate methodology. Certiva's deterministic calculator applies ISO 13485-specific audit time rules, accounting for device families, risk classification, and regulatory scope rather than defaulting to MD 5 tables.
- •Certificate templates reflect medical device scope. The certificate format for ISO 13485 clients includes device-specific scope descriptions, applicable regulatory frameworks, and the classification details required by accreditation bodies.
Entering the Medical Device Space
For CBs considering expansion into ISO 13485 certification, the operational infrastructure matters as much as the technical expertise. Having auditors with medical device knowledge is necessary but not sufficient. The CB also needs systems that can manage the complexity of medical device scope, track the multi-dimensional auditor qualifications, calculate audit times correctly, and produce certificates that meet the standard's specific requirements.
Certiva provides that infrastructure, configured for the realities of medical device certification rather than forcing it into a management system mold.