TL;DR
- "ISO 13485 accreditation" usually means accredited certification: a certification body (CB) certifies your organization, and an accreditation body such as ANAB or UKAS accredits the CB.
- Accredited CBs follow ISO/IEC 17021-1 and IAF MD 9, which govern auditor competence, audit time, nonconformities, and the three-year cycle.
- Before signing, check the CB's accredited scope, technical areas, and fit with target markets such as MDSAP or EU MDR.
- No certificate exempts you from FDA inspection under the QMSR, and no software guarantees certification.
Most medical device and IVD teams searching for ISO 13485 accreditation want to know who signs their certificate and whether it will hold up with customers and regulators. This guide explains that chain of oversight, how to pick and verify a certification body, and how the audit cycle works once you sign. For the internal preparation steps (scope, gap assessment, implementation), see our ISO 13485 certification process guide.
What Does ISO 13485 Accreditation Mean?
Accreditation vs certification
ISO defines certification as written assurance from an independent body that a system meets specific requirements. Accreditation is formal recognition that the certification body itself operates according to international standards (ISO). Organizations get certified; certification bodies get accredited. A questionnaire asking if you are "ISO 13485 accredited" almost always means "do you hold an accredited ISO 13485 certificate?"
By contrast, under ISO/IEC 17025 the laboratory itself is accredited (see our ISO 17025 accreditation guide).
Who does what in the chain
- ISO publishes ISO 13485:2016 but does not certify anyone or issue certificates (ISO).
- Accreditation bodies such as ANAB (US) and UKAS (UK) assess CBs against ISO/IEC 17021-1 and IAF MD 9 (ANAB).
- Certification bodies (also called registrars) audit your QMS and issue the certificate for a defined scope.
Accreditation bodies in the IAF Multilateral Recognition Arrangement are peer-evaluated, which is why accredited certificates travel across borders (IAF MD 9).
Is accredited certification required?
ISO notes that accreditation is not compulsory (ISO), but customers and regulatory programs often expect it:
- United States: The FDA's Quality Management System Regulation (QMSR) took effect on February 2, 2026 and incorporates ISO 13485:2016 by reference into 21 CFR Part 820. FDA neither requires nor issues ISO 13485 certificates, and one does not exempt you from inspection (FDA QMSR FAQ).
- MDSAP: Under the Medical Device Single Audit Program, a recognized Auditing Organization runs one regulatory audit that covers the requirements of Australia, Brazil, Canada, Japan, and the US (FDA MDSAP).
- European Union: Under the MDR and IVDR, QMS conformity assessment is carried out by notified bodies. EU Member States designate these bodies, and they are listed in NANDO (European Commission).
How to Choose an Accredited ISO 13485 Certification Body
Check the accreditation scope, not just the logo
Accredited CBs are recognized as competent only within their scope of accreditation. IAF MD 9 sorts medical device work into technical areas, such as non-active implants, IVD devices, and sterilization processes. Auditors must be competent in the technical area they audit (IAF MD 9). Ask the CB to show that your device types fall inside its accredited scope.
Verify the accreditation independently
Use IAF CertSearch or your national accreditation body's directory to confirm a CB's accreditation, or to check a supplier's certificate (ISO). IAF MD 9 requires the CB to document the certification scope precisely (IAF MD 9), so check that the sites, activities, technical areas, and standard edition (ISO 13485:2016) on the certificate match what you need.
Match the CB to your regulatory roadmap
If you plan to sell in Canada, Japan, Brazil, or Australia, check whether the CB is also a recognized MDSAP Auditing Organization (FDA list). For CE marking, check its notified body designation codes in NANDO.
The ISO 13485 Certification Audit Cycle
Stage 1 and Stage 2 audits
Under ISO/IEC 17021-1, every initial certification audit runs in two stages (ISO/IEC 17021-1, via IAS). Stage 1 reviews your documented QMS and checks readiness. For higher-risk devices (GHTF Class C and D), IAF MD 9 says Stage 1 should be performed on-site. Stage 2 tests whether the system is implemented and effective. The CB calculates audit duration using IAF MD 9 Annex D.
Nonconformities and the certification decision
IAF MD 9 lists examples of major nonconformities, which need accepted and verified correction and corrective action before certification (IAF MD 9):
- A required process is missing, such as complaint handling or training
- No corrective action when post-market data shows a pattern of defects
- Marketed products that do not meet specifications or regulatory requirements
- Nonconformities repeated from previous audits
Surveillance, unannounced audits, and recertification
The three-year cycle starts on the certification decision date. The first surveillance audit must happen within 12 months of that decision, later ones at least once per calendar year, and recertification before expiry (ISO/IEC 17021-1, via IAS). For ISO 13485, surveillance also reviews how you handled adverse event notifications, advisory notices, and recalls. CBs may also run short-notice or unannounced audits after significant safety information or major site and process changes (IAF MD 9).
Costs and timelines depend on headcount, sites, technical areas, and QMS maturity, so get written quotes from accredited CBs rather than relying on published averages.
How to Prepare for Accredited Certification
Make the evidence trail easy to follow
Auditors trace sampled records back through procedures, training, risk files, and approvals. Before Stage 1, map each clause to its evidence with our ISO 13485 requirements guide. Confirm that your ISO 13485 document control works as written.
Validate the software inside your QMS
Clause 4.1.6 requires documented procedures for validating computer software used in the QMS, both before first use and after changes, with the effort proportionate to risk (PMDA). That includes your eQMS, LIMS, and ELN. Vendor evidence can support validation, but intended-use validation remains your responsibility.
Rehearse with an internal audit
Run a full internal audit against Clauses 4 to 8 with our ISO 13485 internal audit checklist. Close out findings through CAPA before the CB arrives, because repeated nonconformities count as major.
How Scispot Supports ISO 13485 Audit Readiness
Scispot is an AI-native laboratory platform with expert delivery. It keeps the evidence behind your QMS connected to the work that produced it, without replacing your QMS.
- Trust Vault maps requirements to controls and links them to records, audit trails, approvals, and validation evidence, so Quality sees gaps before auditors do.
- Audit-ready lab operations capture sample lineage, method versions, QC checks, deviations, and e-signatures as work happens.
- QMS ++ adds document control, training, change control, and e-signatures where you need native apps. Your existing eQMS can remain the home for CAPA and controlled documents.
- Validation Care delivers IQ/OQ/PQ documentation that supports your Clause 4.1.6 validation. Your procedures and intended-use testing complete it.
Certification still depends on your QMS and the CB's independent assessment.
