A process certification, not a product certification

ISO 13485 certifies a manufacturer’s quality management system — the documented processes governing design controls, supplier evaluation, production and process controls, corrective and preventive action, and management review — not any single device model. This is a genuinely different kind of claim than a CE mark on a specific product. A facility can hold a valid ISO 13485 certificate while a specific device model still lacks its own CE marking, because the certificate speaks to the manufacturer’s system-level capability to consistently produce compliant devices, while CE marking speaks to whether a particular device has actually gone through that system and met the applicable requirements.

Why this is often the first gate, not the last

For many notified bodies conducting CE marking assessments, and for a number of export markets outside the EU, holding ISO 13485 certification is effectively a prerequisite before a device-specific review even begins — the logic being that a manufacturer without a certified quality system doesn’t yet have the documented process controls needed to reliably produce a compliant device in the first place. This is part of why ISO 13485 certification tends to appear early in a manufacturer’s compliance timeline, ahead of individual product certifications, rather than as something pursued afterward.

What the certificate’s scope statement actually tells you

An ISO 13485 certificate isn’t a blanket claim — it comes with a defined scope, typically specifying the facility (or facilities) covered and the general category of devices the certified system applies to. This matters for two practical reasons:

  • A certificate scoped to one facility doesn’t automatically extend to a different manufacturing site, even under the same company name — a manufacturer with multiple factories may hold separate certifications, or may need to add a new site to an existing scope before that site’s output is covered.
  • A certificate scoped to one device category doesn’t automatically extend to a different one — a manufacturer certified for sterilization consumables isn’t necessarily certified for a capital equipment category like autoclaves under the same certificate, if their systems and risk profiles differ enough to warrant separate scope review.

Reading the actual scope statement, not just confirming a certificate exists, is what turns “this manufacturer is ISO 13485 certified” into a specific, verifiable claim rather than a general assurance.

What this means for sourcing decisions

  • Ask for the certificate itself, and check the scope and expiry date, not just a claim of certification in marketing material — certificates are typically valid for a fixed period and require periodic surveillance audits to remain active.
  • Confirm the facility actually producing the specific product being purchased is within the certificate’s scope — particularly relevant for manufacturers who contract-manufacture some product lines at different sites.
  • Treat ISO 13485 and CE marking as answering different questions — one about the manufacturer’s process, one about a specific device’s own conformity assessment — and expect both, not one as a substitute for the other, for a device being imported into a market that requires them.