ISO 9001 vs ISO 13485: which certificate goes on this RFQ

This page is a buying comparison. It is for operations and quality leads at mid-market manufacturers, contract manufacturers, component suppliers, packagers, sterilizers, and device distributors who are about to send a registrar RFQ and cannot agree whether ISO 9001 or ISO 13485 belongs on it.

Those standards are not interchangeable quality logos. ISO 9001 is a general quality management system. ISO 13485 is a medical-device quality management system written for regulatory purposes. Customers say "ISO" and mean either. Salespeople will offer to quote both. The useful question is a procurement question: which certificate does this cycle have to produce, and can you staff the system behind it.

A Stage 1 versus Stage 2 page already walks the two initial visits. This page does not repeat that chapter. It decides which system those visits are allowed to sample. Whether that system is real enough to book Stage 1 is first ISO certification. After you pick the standard, you still write one outbound pack, choose a registrar, read the quote, and verify accreditation for the legal entity and the edition you will claim. Why two replies for the same story diverge is what drives certification cost. Where the dates sit is how long ISO certification takes. This page does not invent prices, day-rate totals, or accreditation identifiers. Confirm the live schedule in the quarter you would book.

The directory on this site filters ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, and ISO/IEC 42001. It does not filter ISO 13485. A profile tagged for general quality is not evidence of a medical-device schedule.

The decision here is narrower: 9001 on this RFQ, 13485 on this RFQ, or neither until the system exists. Then one pack.

1. What each standard is for, in plain terms

Skip the clause lecture. Buyers do not award a certificate because they memorized a table of contents.

ISO 9001 is how a customer checks that you can repeat the work and correct it when it fails. A certification body samples that quality system: how an order becomes a product or a service, how nonconforming work is caught, and who owns the process. ISO 9001 uses the shared high-level structure also used by ISO 14001, ISO 45001, ISO/IEC 27001, and ISO/IEC 42001. The certificate is not a promise that every unit is perfect. It is not a product mark.

ISO published ISO 9001:2026 on 16 September 2026. Many certificates in the market, and many quotes in this quarter, are still against ISO 9001:2015. A body can certify the new edition only after its accreditation covers it. Put the edition you will claim on the pack, and ask which edition the body can issue now. A 2015 certificate did not expire because a new edition exists. The transition window belongs to the accreditation arrangement and to the certification body. It is not a date this page can assign.

On a plant the interviews sit in receiving, production, inspection, and with the people who run them. In a job shop they sit in how a print becomes a part and what happens when the part is wrong. In a warehouse they sit in how an order is received, stored, picked, and shipped. The owner is the person who already runs that work and can speak without a script.

ISO 13485 asks whether you run a quality management system for medical devices that can meet customer requirements and the regulatory requirements you claim, and whether you can keep that system effective. The edition in force, and the one ISO confirmed again in 2025, is ISO 13485:2016. Confirm that edition on the quote rather than assuming a newer number has replaced it. The standard kept an earlier clause structure on purpose, so it could stay aligned with device regulations. It does not use the high-level structure of ISO 9001:2015. Annex B inside ISO 13485:2016 maps that standard to ISO 9001:2015. It is not a map to ISO 9001:2026. Use it inside your own system if you run both and the quality edition on the certificate is still 2015. If the quote is for ISO 9001:2026, do not assume that annex still lines up clause by clause. Check it. Do not ask a certification body to write the crosswalk for you.

The standard is written for organizations in the device life cycle, and for suppliers and other external parties who provide product, including services, to those organizations. That is a wider door than "we are the brand on the box." A contract manufacturer, a component maker, a packager, a sterilizer, and a distributor can all be in scope. They are not the same scope.

A certification body samples that medical-device system. Buyers should expect the visit to care about things a general quality audit often treats lightly or not at all:

• Your role. Legal manufacturer, contract manufacturer, component or critical supplier, sterilizer, packager, distributor, or another service. The role is the first line of the scope, not a footnote.
• Design in or out. Design and development controls are in the standard. An exclusion survives only when you do not do that work and the regulations that apply to your role allow the exclusion. Other requirements can also be treated as not applicable, for the same two reasons. "We are build-to-print" is a claim you have to defend with the contract and the files, not with a slogan.
• Product risk during realization. ISO 13485 expects risk to be handled where the device is designed, bought, made, and released. Teams often practice that with ISO 14971. Certification to ISO 14971 is a different product. Do not write it onto the RFQ unless you are actually buying it.
• Validation, traceability, and the special processes you actually run. Where the output cannot be fully checked by inspecting the finished piece, the process has to be validated. Identification and traceability have to match the device. Cleanliness, installation, servicing, and sterile product matter when they are in the work. They are noise when they are not.
• Complaints and feedback after the device leaves. The system has to take feedback from production and from the field, handle complaints, and support advisory notices or reports to regulators when your obligations say so. A customer-satisfaction score from a general quality system is not that process.
• Documented procedures and a management representative. ISO 13485 still names documented procedures for processes that ISO 9001:2015 lets you document however you like. It still expects a management representative. A quality manager who "covers it" without the authority the system describes is a finding, not a staffing plan.
• Effectiveness, not a continual-improvement slogan. The medical-device system has to stay effective against customer and regulatory requirements. That is not the same programme as an ISO 9001 improvement metric and a dashboard of customer scores. You can run both. Do not pretend one sentence covers both.

The certificate records the management system for the scope you agreed. It does not clear a device for sale. It does not put a conformity mark on the product. It does not mean a regulator has inspected you.

You can hold both certificates eventually. This page is about which one this RFQ is for.

2. When 9001 is the forced gate this cycle

Start with ISO 9001 when the pressure in front of you is general quality, and a medical-device mark will not lose a bid, a supplier approval, or a renewal this quarter.

That is still the usual manufacturer case. Portals, industrial primes, and export paperwork treat ISO 9001 as table stakes, and the plant already half-runs the work an auditor will sample. It is also the rational gate for a job shop, a warehouse, or a service firm whose customers score on-time delivery and complaint handling, when nobody has named a medical device.

Put ISO 9001 on this RFQ when most of these are true:

• The customer, portal, bid, or supplier approval in front of you names ISO 9001, or names "an ISO certificate" and means general quality.
• The product or service is not a medical device, and you do not promote, label, or contract it as a part or service that supports one. A catalog fastener sold as a catalog fastener is not a device component because a hospital is somewhere in the economy.
• You can name the legal entity, the sites that do the certified work, and a quality or operations owner who will be in the room.
• Documented processes roughly match Tuesday. Internal audit and management review can touch this system before you invite a body. That test is first-certificate readiness.
• Device pressure is a forecast: a sales call, a prototype, a private-equity note that "medical might be interesting," or a customer who might enter devices next year. A forecast is not a date that kills a contract this cycle.
• You are not offering a general quality certificate as a stand-in for a quality agreement, a technical file, or a supplier approval that names ISO 13485. If the exhibit names ISO 13485, 9001 will not clear it.

A later ISO 13485 add is a normal plan when a device customer is real and the system does not exist yet. One line on the pack is enough. Leave 13485 off this RFQ while you have no device role you will defend. If the live fork is quality versus environment, occupational health and safety, information security, AI governance, or an aviation, space, and defense quality system, use the comparison that matches that fork: ISO 9001 vs ISO 14001, ISO 9001 vs ISO 45001, ISO 9001 vs ISO 27001, ISO 9001 vs ISO 42001, or ISO 9001 vs AS9100. Do not add ISO 13485 to look specialized.

If the portal requires ISO 9001 and the quality system does not exist, build the system, then send the pack. An RFQ sent so the quote creates a deadline is how Stage 1 writes findings you already knew. Who writes the system versus who certifies it is consultant vs certification body.

Leave 13485 off this cycle only when it is not the gate and you cannot staff both. Read the quality agreement before you do that. Many device customers will not treat an ISO 9001 certificate as close enough.

3. When 13485 is the forced gate this cycle

Start with ISO 13485 when a device customer, a quality agreement, or a supplier approval will not let you through without a medical-device quality certificate this cycle, and you can show that system for the role you play.

That is the usual case for a contract manufacturer building to a device customer's print, a firm that puts its own name on a device, a sterilizer or packager inside a device process, and a distributor whose agreement names ISO 13485. It is also the case for a component supplier who markets or contracts the part as supporting a medical device, including parts intended for implants or for a finished device that only needs packaging and labeling. It is not the case for a machine shop whose brochure mentions "medical" and whose purchase orders do not.

The certificate does not authorize the device. Quoting ISO 13485 does not finish a design dossier, and it does not answer an FDA inspector.

Put ISO 13485 on this RFQ when most of these are true:

• The agreement, portal, or supplier approval names ISO 13485, a medical-device quality management system, or a requirement ISO 9001 will not satisfy. Use their words.
• You can say your role in one sentence, and the sentence matches the contracts: legal manufacturer, contract manufacturer, component or critical supplier, sterilizer, packager, distributor, or a named service.
• The system for that role exists. Procedures people use. Records for the device work. Complaint handling and production-and-post-production feedback that have actually run if devices have already shipped. Internal audit and management review that touched this system. An owner who can walk the process without a consultant in the room.
• Design is an explicit decision. In, with records you can show. Or out, with the justification and the regulatory permission you are relying on. "The website says engineering" is not a design scope. "The customer owns the print and we do not change it" is a start, and Stage 1 will still ask who approves a deviation.
• You know which sites touch the device, including a warehouse, a sterilizer, or a contractor you will claim. More than one address is multi-site certification scope.
• You are not asking the certificate to stand in for a conformity mark, a market authorization, or a regulatory audit programme.

If the agreement requires ISO 13485 and the medical-device system does not exist, build the system, then send the pack. A general quality manual with "medical device" typed into the scope will not survive Stage 1. Readiness still has the first-certificate shape. The content is the device system. What that first visit is for sits in Stage 1 versus Stage 2.

Three regulatory products get confused with this certificate. Keep them off the pack unless you are buying them on purpose.

A conformity mark (CE, UKCA, or another market mark) is a regulatory claim about the device. A certification body's ISO 13485 certificate does not affix it. Some organizations also act as notified bodies or similar. That is a different legal entity, a different contract, and often a different competence. Ask which activity the proposal is. Do not award a management-system quote and tell the board you bought market access.

United States device manufacturing rules. The FDA Quality Management System Regulation, effective 2 February 2026, incorporates ISO 13485:2016 by reference into the device current good manufacturing practice framework, and it keeps additional FDA requirements. An accredited ISO 13485 certificate can be useful evidence that a medical-device quality system exists. It is not an FDA inspection, not registration and listing, and not a 510(k), De Novo, or other market authorization. Do not write "QMSR certified" on the RFQ. If the customer wants confidence that you can host an FDA inspection, that is a question for the system you operate and for regulatory counsel. It is not a stamp a registrar can add to a quote.

MDSAP is a separate audit programme used by several device regulators, including the US FDA, Health Canada, Australia's TGA, Brazil's ANVISA, and Japan's MHLW and PMDA. It uses ISO 13485 plus country-specific requirements. Confirm the current participant list. A plain ISO 13485 proposal is not an MDSAP proposal unless the body is recognized for that programme and the quote says so. If you need MDSAP, say so as its own row. Do not hope it is included.

Leave ISO 9001 off this cycle only when general quality is not the gate and you cannot staff both. Read the other portals before you do that. An industrial customer can still require ISO 9001 for the non-device work in the same legal entity. A medical-device certificate does not automatically clear that field.

4. What buyers get wrong

Five patterns show up in mid-market rooms. Each one produces unlike quotes, or a Stage 1 whose job is to discover fiction.

Treating ISO 13485 as ISO 9001 plus a medical paragraph. Same sites, same day count, same auditor bench, same exclusion list. The structures differ. The documentation is more prescriptive. The technical areas on a medical-device accreditation schedule are not IAF codes copied from a machining scope. A 9001 lead who has never audited a device file is not a 13485 team. If you want both certificates eventually, name which one is this cycle. "Both, we're integrated" is a sentence, not a programme. Integration is real when shared processes already run (document control, internal audit, management review, corrective action) and the device work exists: complaints someone opens, traceability someone can follow, and a design file or a justified exclusion.

Sending ISO 9001 to a customer who named ISO 13485. The field on the supplier portal is not a suggestion. A certificate you already hold for general quality does not put device controls into scope, and it does not appoint a management representative for a system you have not built. If the revenue is blocked on the device agreement, the general quality certificate is the wrong product this cycle.

Getting design wrong in either direction. Putting design in the scope because the brochure says "engineering," when every job is build-to-print, asks the auditor to sample a design process you do not run. Excluding design while your people still change the print, own the device master record, or release a specification the customer files, asks the auditor to ignore work you do. Stage 1 is where that sentence dies. Write the decision on the pack, with the contract fact that supports it.

Inventing a device scope, or hiding one. Quoting ISO 13485 because a logo might win industrial bids, when you do not make or handle devices, buys a system you will fail to show. Hiding a device contract inside an ISO 9001 scope because travel to a competent auditor is annoying is under-scoping. The same honesty applies to parts and services. A component sold as a general industrial part can stay on ISO 9001. A component you promote for an implant, or a nearly finished device that only needs packaging and labeling, is a technical-area question for ISO 13485. Say which one you sell.

Assuming any registrar on a general directory can quote it. ISO/IEC 17021-1 is the general competence standard for bodies that audit and certify management systems. For ISO 13485, accreditation bodies also apply the IAF mandatory document for medical-device quality management systems, IAF MD 9. That document does not replace ISO/IEC 17021-1. All of 17021-1 still applies. Confirm the issue the body is assessed against, and confirm ISO 13485 is on the live schedule for the technical areas you will claim. This site's directory does not tag that schedule. Verify it the same way you would verify any other scheme: how to verify accreditation, on IAF CertSearch and the accreditation-body directory, in the quarter you would book.

"Quote whichever is easier" means the bodies are not quoting the same object. Adding ISO 14001, ISO 45001, or ISO/IEC 27001 because someone mentioned a stack belongs on the IMS buying guide or the matching comparison, and only when that system exists. A first medical-device certificate is not the moment to look thorough.

5. How the RFQ, the scope, the sites, and the people differ

A quote is a designed audit programme. It starts from your facts. ISO 9001 facts and ISO 13485 facts are not the same list with a different title.

Scope. For ISO 9001, name the legal entity, the products or services, the processes, and the exclusions you will defend. For ISO 13485, name the device role, the device types or services at a level an auditor can match to a technical area, the activities (design, manufacture, sterilization, packaging, installation, servicing, storage, distribution), and what is out. "The whole company" sweeps a sales office or an industrial cell into a device system it should not share, or drops the warehouse that holds finished devices because it was not on the quality tour.

Sites. ISO 9001 follows the work: plants, job shops, warehouses, and the offices where the certified service is run, including the second shift. ISO 13485 follows where the device is designed, made, sterilized, packed, stored, or released. A design office can be in or out depending on the design decision. A contract sterilizer can be central to the device system and missing from a factory list that says "the plant." A second shift that runs the validated process still counts. This cycle names one standard's sites. If you are honestly quoting both, the pack carries a site-by-standard matrix. The later add stays off the pack, with one line that says so.

People. ISO 9001 interviews a quality or operations owner, process owners, and someone who does the work. ISO 13485 interviews a management representative and the people who can show design or the exclusion, purchasing of device materials, validation, traceability, complaints, and release. "We'll bring regulatory in at Stage 2" means the pack is early. "The ISO 9001 manager will cover devices" means the device system has no owner. If one person owns both, say so only when that person can walk both.

What you already hold. If an ISO 9001 certificate exists, name the issuing body, the scope, and the expiry. Say whether you want the same body to add ISO 13485 or a different body to certify it. An existing certificate can change how a body plans the file. It does not convert one standard into the other.

Who implemented. Internal, a named consultant, or nobody yet. ISO/IEC 17021-1 restricts a certification body from certifying a management system it consulted on. If the same firm wrote the device procedures, they should not be the certifier. Disclose the implementer on the pack. That split is consultant vs certification body.

One page, the same pack to every body. The full checklist is how to build a registrar RFQ / scope pack. For this decision, these rows have to be explicit:

Fact	If ISO 9001 is this cycle	If ISO 13485 is this cycle
Standard and edition	The 9001 edition you will claim. Ask which of 2015 or 2026 the body is accredited to certify now	ISO 13485:2016, unless the body tells you a different edition is the one they certify
What is in scope	Products, services, processes, exclusions you will defend	Device role, activities, device types or services, design in or out
Document the owner can show	Processes that match the work, plus internal audit and management review of this system	Device procedures people use, complaint and feedback records, traceability, and internal audit and management review of this system
Sites	Where that work happens, with headcount bands and shifts	Where the device is designed, made, sterilized, packed, stored, or released
Owner	Named quality or operations owner	Named management representative who can walk the device system
The other standard	Later add, or not this cycle	Later add, or not this cycle
Regulatory product	Not this quote	Say if you also need MDSAP or notified-body work. Otherwise write "management-system certification only"
Who implemented	Internal, named consultant, or none	The same disclosure. The implementer is not the certifier

Headcount is a band per site, not the about-page total. A night shift still counts when the validated process runs at night. A thinner story for one logo ends the comparison. What comes back (programme structure, days, travel, exclusions, medical-device competence) is what CB quotes include.

Ask these in writing, of every body, against the same pack:

• The issuing legal entity, the accreditation body, and whether ISO 13485 is on the live schedule for your technical areas. Device families differ. Non-active devices, active devices, implants, IVDs, sterilization, software in a device, and parts or services such as components, packaging, or distribution are not one checkbox.
• Whether their reading of your pack includes design or excludes it, and what evidence they will expect at Stage 1 for that sentence.
• Days by stage for the initial audit, then surveillance and recertification. A quote that prices Stage 2 and leaves the rest blank is not comparable. The calendar around those days is how long ISO certification takes.
• What an existing ISO 9001 certificate changes. Ask whether Stage 1 still happens, what it will sample, and how long they typically leave between Stage 1 and Stage 2 for a file like yours. That gap is a range the body will accept. It is not a number this page can assign. Findings that say the device system is not ready should move Stage 2. What a major or a minor then does to certificate issue is closing ISO nonconformities.
• If both standards are on this pack, the calculation. IAF MD 9 tells bodies that a combined or integrated ISO 9001 and ISO 13485 audit has to cover both standards, starting from medical-device audit time, with additional time for the second standard. Differences in scope and headcount can add more. Some activities can justify a limited reduction. Ask them to show the medical-device time, the addition, and any reduction and the reason. Do not import a percentage from a blog, and do not accept "same days as your 9001" as the answer. How to lay those rows beside another quote is what drives certification cost.
• Who will audit. Medical-device competence for your technical areas, not a general quality team with a slide. Ask what happens if the named auditor is unavailable.
• Whether any of the audit is proposed as remote, and for which stage. A document review and a validated production floor are not the same method. The split belongs on the pack. The method page is remote vs on-site ISO audits.
• Whether the proposal is management-system certification only. If a line mentions MDSAP or notified-body services, price and competence are a second procurement. Do not average it into the ISO 13485 number.

6. One CB programme this cycle, a sequential add, or a different product

Sometimes one certification body should quote ISO 9001 and ISO 13485 together. Often that request is a hope that the medical-device work is a logo on a system you already run.

One programme this cycle is honest when both systems already run under one legal entity, shared processes are real, the device owner can sit the audit, and each standard has its own scope story or an honest matrix. You may still receive two certificates. Say which processes are shared and which work is device-specific. Complaints, design or the justified exclusion, validation, traceability, and regulatory feedback are device work, not quality clauses with a medical label. Let the certification body restate the method. Do not ask them to invent integration you do not operate. The body's schedule has to cover ISO 13485 for your technical areas, not only ISO 9001. Ask how they staff that competence.

A sequential add is the better buy when only one system is real. Certify the gate this cycle. Add the other standard when its owner, its sites, and its documented information exist. A later ISO 13485 add, even on top of an ISO 9001 certificate you already hold with that body, is still an RFQ. Ask what Stage 1 they will still perform. Tell the shortlist which standard comes later. If the body you award now cannot cover ISO 13485, the honest options are wait, use a body whose schedule includes it, or plan two certification bodies on purpose. Two bodies is a legitimate design when you write it down. It is not a way to hide the device work inside a friendlier general-quality quote. If you later want one name on both certificates, that move is a transfer of the certificate that already exists, not a shortcut around the scheme you have not built.

A regulatory audit is a different product. MDSAP, a notified-body assessment, and an FDA inspection are not delivered by ticking ISO 13485 on a management-system proposal. If the customer requires one of those, stop and scope that procurement separately. You may still want ISO 13485 from an accredited certification body. Say so. Do not let one quote pretend to be all three.

Keep ISO 14001, ISO 45001, and ISO/IEC 27001 off this pack unless that system is the gate this cycle and you can staff it. The plant stack is the IMS buying guide. The quality-to-security sequence is the path guide. One body for device quality and another for the operations standards is a legitimate design when you write it on purpose. Confirm the legal entity in how to choose a registrar and how to verify accreditation.

7. Choose what goes on this RFQ, then send one pack

Make the call in one sitting. The output is a sentence at the top of the scope pack.

1. Write the actual requirement. Portal, quality agreement, supplier approval, tender. Use their words. If one field says ISO 9001 and another says ISO 13485, note which revenue is blocked this cycle. If a field says CE, FDA clearance, or MDSAP, mark it as a different product.
2. Match it to a system you can show. ISO 9001 needs processes that match the work. ISO 13485 needs a device role, procedures people use, and an owner who can walk complaints, traceability, and design or the justified exclusion. If that system does not exist, do not send. Build it, or hire an implementer who will not certify you, and disclose them on the pack.
3. Name one primary standard. Mark the other "later add" or "not this cycle," unless both systems and both owners are real enough to defend at Stage 1.
4. Name the role, the owner, the design decision, and the sites for that standard. General quality owner and the locations where the work happens, or management representative, device role, design in or out, and the locations where the device is handled.
5. Write one pack and send it to every body you might award. How to choose them is how to choose a registrar. For ISO 13485, confirm the legal entity's accreditation for this edition and your technical areas before you invite a body you cannot award. The lookup is how to verify accreditation. If you already hold the other certificate, name it on the pack so the add is comparable.

If the room is still split after step 3, you have two procurements. Run the one that unblocks revenue and park the other until its system exists.

When that sentence is true, send one registrar RFQ / scope pack. The Get quotes form on this site lists the standards on the directory desk. ISO 13485 is not one of those checkboxes. In Scope notes, name ISO 13485 if it is this cycle, say whether ISO 9001 is also this cycle or a later add, and state the device role and the design decision in one or two lines. If the form will not send without a ticked standard, do not let a ticked ISO 9001 box stand in for a medical-device request. The notes sentence is the scope. Put any certificate you already hold in Existing certificates. Submit the same page once, including to the logo you already like. The standard on the page has to be the standard you can staff.