Is ISO 13485 Certification Mandatory?

The author is frequently approached by medical device startup companies and other organizations requesting consulting support for ISO 13485 certification. However, ISO 13485 certification is not necessarily mandatory. Rather, the regulatory requirements that medical device companies must comply with vary depending on the regulatory system of the region where the product is commercialized.

Regional Regulatory Requirements and the Position of Certification

In Japan

In Japan, manufacturers and distributors of medical devices are required by law to establish and operate a Quality Management System (QMS) based on the Medical Device QMS Ordinance (Ministry of Health, Labour and Welfare Ordinance No. 6 of 2019). The Medical Device QMS Ordinance is highly harmonized with ISO 13485:2016, and compliance with this standard makes it possible to meet the requirements of the ordinance. However, obtaining ISO 13485 certification itself is not legally mandatory. When submitting a product application, manufacturers need only demonstrate in their application materials that their QMS complies with the Medical Device QMS Ordinance. In practice, however, obtaining ISO 13485 certification does provide merit in that it can reduce the extent of on-site inspections conducted by the Ministry of Health, Labour and Welfare during the application review process, thereby streamlining the application process.

In the United States

In the United States, medical device manufacturers are required to comply with Title 21 of the Code of Federal Regulations, Part 820 (Quality System Regulation: QSR). The QSR is a distinct regulatory framework that differs from ISO 13485 and has its own independent structure. When the objective is to demonstrate compliance with FDA regulations directly, ISO 13485 certification is not mandatory. Rather, when the goal is to comply with FDA regulations directly, establishing and maintaining a QMS based on QSR is required. However, for companies intending to enter both the U.S. and European markets, obtaining ISO 13485 certification allows for partial integration of compliance efforts across multiple regulatory frameworks, providing practical advantages. This integrated approach can reduce redundancy and streamline quality system management across different regulatory jurisdictions.

In Europe

In Europe, ISO 13485 certification is also not mandatory. This is because the European CE marking system is based on self-declaration (Declaration of Conformity: DoC). Medical device manufacturers must declare that their products comply with the requirements of either the European Medical Device Regulation (MDR, Regulation (EU) 2017/745) or the In Vitro Diagnostic Regulation (IVDR, Regulation (EU) 2017/746), and self-declare this conformity in a Declaration of Conformity document. By documenting in the Declaration of Conformity that the company has complied with ISO 13485 in the design and manufacture of its medical devices, manufacturers can demonstrate one method of proving compliance with regulatory requirements.

However, within the framework of EU regulations, compliance with harmonised standards carries significant merit. This is explained in detail in the following section.

The Role of Harmonised Standards under MDR and IVDR

In Europe, the role of harmonised standards is extremely important. Harmonised standards are international standards that technically implement the requirements of EU regulations and are formally designated by the European Commission. These standards serve as critical tools for manufacturers to demonstrate compliance with EU regulations.

On January 4, 2022, nine new standards were designated as European harmonised standards. These standards address medical device biological evaluation, sterilization, aseptic processing, quality management systems, and the use of symbols in product information. At that time, EN ISO 13485:2016 was officially recognized as a harmonised standard for MDR. Subsequently, the European Commission has continued to designate additional harmonised standards, with further standards being designated between 2024 and 2025.

The most up-to-date list of harmonised standards is continuously updated on the official website of the European Commission (NANDO: New Approach Notified and Designated Authorities), and medical device companies are recommended to review this list regularly to ensure their products maintain alignment with current regulatory requirements.

The Merits of Compliance with Harmonised Standards

The legal significance of complying with harmonised standards is stipulated in Article 8 of EU regulations. The following is the relevant provision of Article 8(1) of Regulation (EU) 2017/745 (MDR) of the European Parliament and of the Council.

Under the “presumption of conformity” principle established in Article 8(1), medical devices that comply with harmonised standards are presumed to be in conformity (presumed to be in conformity) with the requirements of MDR or IVDR in the scope covered by those harmonised standards. This is an extremely significant legal status. The reason is that regulatory authorities can verify compliance with harmonised standards and thereby avoid the need to directly verify compliance with EU regulatory requirements.

In other words, by complying with harmonised standards, medical device companies can substantially reduce technical and legal risks. Through the process of compliance with harmonised standards, design, manufacturing, and quality management that are systematically aligned with EU regulatory requirements are realized, and the factual basis for the Declaration of Conformity when affixing CE marking becomes much stronger.

Merits in the Japanese Market

In Japan, obtaining ISO 13485 certification provides the advantage that on-site inspections by the Ministry of Health, Labour and Welfare during the product application process may be reduced, thereby streamlining the application process. This is because the conformity assessment body’s third-party auditing has already confirmed compliance with the QMS Ordinance. Additionally, from a business management perspective, ISO 13485 certification serves as a tool to demonstrate to external parties that the company’s QMS operation has reached a certain level of maturity. This can enhance the company’s reputation and credibility with regulatory authorities, business partners, and customers.

Conclusion

While ISO 13485 certification is not mandatory for medical device companies, it is useful in many cases. In particular, for companies considering market entry in multiple regions or those seeking to rapidly gain the trust of regulatory authorities, the unified QMS construction that comes with ISO 13485 certification provides strategic value. However, when supplying to a single market only, or when seeking to establish a simplified QMS, prioritizing direct compliance with that particular region’s regulatory requirements may be more practically and economically rational. What is important is that each medical device company makes its own determination regarding the necessity of ISO 13485 certification based on its business circumstances and market strategy. The decision to pursue ISO 13485 certification should be made thoughtfully, taking into account the company’s specific goals, resources, and regulatory environment in each target market.