Complete guide · Medical devices
ISO 13485 in Romania
The standard for quality management in medical devices: how to obtain certification, how it connects to MDR/IVDR requirements, and why it is the condition for access to the European market.
What is ISO 13485?
ISO 13485 is the international standard for a quality management system specific to medical devices. It addresses organisations involved in the design, manufacture, installation and servicing of medical devices, as well as their suppliers.
The current version is ISO 13485:2016. Although it starts from the ISO 9001 structure, it is far stricter: it emphasises risk management, traceability, process control and regulatory compliance — because these are products that affect patient health.
In the European Union, ISO 13485 is closely tied to the MDR (2017/745) and IVDR (2017/746) Regulations. A certified ISO 13485 system is the practical basis for demonstrating conformity with those regulations and for CE marking.
Why device manufacturers need ISO 13485
For the medical device sector, ISO 13485 is not optional — it is the gateway to the market.
Access to the EU market
The foundation for MDR/IVDR conformity and for CE marking of devices
Risk management
Integration with ISO 14971 — clinical risk managed across the whole product life cycle
Full traceability
From raw material to patient — essential for recalls and vigilance
A requirement from partners
Manufacturers require ISO 13485 certification from suppliers and subcontractors
Regulatory compliance
A structure that answers the requirements of authorities and notified bodies
Reduced legal exposure
Documentation and controls that protect you in the event of an incident or dispute
How ISO 13485 is implemented — the process stages
Gap analysis and regulatory context
We assess your position against ISO 13485:2016 and clarify the device class and the applicable MDR/IVDR requirements. Duration: 2–3 weeks.
Risk management
We build the risk management process to ISO 14971, integrated into the quality system.
Documenting the processes
We draw up the quality management file: design, production, control, traceability, and the medical device file.
Implementation and training
The system goes live. We train your people on the critical controls and the regulatory requirements.
Internal audit
A rigorous internal audit, focused on critical processes and regulatory compliance. Duration: 2 weeks.
Certification audit
The certification body (often also a notified body) audits the system and issues the ISO 13485 certificate.
What ISO 13485 certification costs
ISO 13485 costs more than ISO 9001 because of the regulatory rigour and the documentation required. Device class and design complexity are the determining factors. Indicative figures over 3 years:
Distribution / servicing
No in-house design
EUR 9,000–13,000
Standard complexity · 3 years
Manufacturing
Class I–IIa devices
EUR 13,000–20,000
Medium complexity · 3 years
Manufacturing + design
Class IIb–III
EUR 20,000–32,000
High complexity · 3 years
✅ Costs cover consultancy and the certification body fee. For higher-class devices, the involvement of a notified body for MDR/IVDR is invoiced separately. We size the scope together, according to your device class.
How long ISO 13485 implementation takes
Documentary rigour and risk management make ISO 13485 longer than ISO 9001. The average is 6–10 months.
Fast start
5–6 months
Distributor or service provider without design, processes already partly controlled.
Standard
6–9 months
Manufacturer of lower-class devices, with no existing system.
Complex
9–14 months
Manufacturing with in-house design, higher-class devices.
Frequently asked questions about ISO 13485
What is the difference between ISO 13485 and ISO 9001?
ISO 13485 starts from ISO 9001 but is far stricter and adapted to the medical sector: emphasis on risk management, traceability, regulatory compliance and documentation. It does not pursue "customer satisfaction" in the commercial sense, but the safety and effectiveness of the device. They are not interchangeable.
Is ISO 13485 enough for CE marking?
It is the foundation, but not always sufficient on its own. For CE marking under MDR/IVDR, depending on the device class, a notified body and additional technical documentation may be required. ISO 13485 is nevertheless the backbone of the whole conformity demonstration.
What class is my device?
Classification (I, IIa, IIb, III under MDR) depends on the risk of the device, the duration of contact and the part of the body affected. The class determines how rigorous the requirements are and how far a notified body is involved. It is the first thing we clarify in the gap analysis.
How does it relate to ISO 14971?
ISO 14971 is the standard for risk management of medical devices. ISO 13485 requires a risk management process, and ISO 14971 supplies the methodology. In practice they are implemented together — they are inseparable in a serious system.
Who issues the ISO 13485 certificate?
An accredited certification body, often also a notified body for MDR/IVDR. Golden Audit Consulting® handles implementation and preparation; certification is carried out by the accredited body, independently.
Other ISO standards for your company
Verifiable credentials
IRCA Lead Auditor for integrated systems
CQI | IRCA certified courses, taken with RINA: ISO 9001, ISO 14001 and ISO 45001.
ISO 9001
ISO 14001
ISO 45001See the certificates →Do you manufacture or distribute medical devices?
We guide you through ISO 13485 certification and the MDR/IVDR requirements, tailored to your device class. The first conversation is free.