# ISO 9001 vs ISO 13485

Source: https://goitf.com/en/resources/iso-9001-vs-iso-13485

Both concern quality management, but medical device work adds requirements that an ISO 9001 certificate cannot answer on its own.

ISO 9001 is a quality management standard for organisations across sectors. ISO 13485 is a separate standard for medical device quality systems and regulatory requirements. A company can use shared processes for both, but holding one does not establish conformity with the other. Start with your activities and the requirement you must answer.

## Two quality systems with different purposes

ISO 9001 addresses quality management across products and services. ISO 13485 addresses medical devices and related services, with regulatory requirements built into the system. ISO publishes them as separate standards: ISO 9001:2026 and ISO 13485:2016. The date on one does not change the requirements of the other.

That distinction matters when somebody asks for a quality certificate without naming the standard. Ask which activities it must cover and who will accept it. A general quality requirement and a device-specific requirement are different purchasing instructions, even when both reach the same quality manager.

Do not choose by which document is newer. ISO 13485 is a stand-alone standard, not a sector appendix you attach to ISO 9001. ISO's explanation of their relationship says it includes device-specific requirements and omits some ISO 9001 elements. Treat each as a separate set of requirements when you assess conformity.

## Compare the requirement, then the evidence

Use this table to decide what your gap review must cover. The shared word is quality; the difference is what your system must demonstrate. A device company should check its actual role before borrowing procedures from either standard, because a distributor and a designer do different work.

Read each row against your process map. Where one procedure serves both purposes, keep it. Where a device-specific decision is missing, add the decision and its record rather than a second manual with the same headings.

| Decision | ISO 9001 / ISO 13485 |
| --- | --- |
| Purpose | ISO 9001: quality management across sectors. ISO 13485: medical device quality management for regulatory purposes. |
| Activities | ISO 9001: products and services generally. ISO 13485: activities in the medical device life cycle, including storage and distribution. |
| Requirement to read | ISO 9001: the buyer's quality requirement and your system scope. ISO 13485: the device quality requirement, your role and the applicable regulatory requirements. |
| Process records | Both: controlled procedures and records can support the system. ISO 13485: check device files, product traceability and preservation against your activities. |
| Complaints | ISO 9001: review how complaints feed corrective action. ISO 13485: also check the complaint assessment and regulatory reporting procedure. |
| Software | ISO 9001: review the tools supporting your processes. ISO 13485: check validation of software used in the quality management system. |
| Evidence of the other standard | Neither certificate establishes conformity with the other standard. Review the missing requirements and the scope separately. |

## Find the person asking for the certificate

For a customer request, the purchasing clause tells you which standard and scope to address. For medical devices, identify the regulatory requirement as well. ISO 13485 is used across the device supply chain, including organisations whose contracts require conformity. The request may concern your role rather than your entire business.

Ask procurement for the exact clause, not a summary passed through a sales email. Record the requested standard, the products or services covered, the sites and the evidence the buyer wants. If the wording only says ISO, return it for clarification before commissioning a gap review.

For a Saudi device business, start with the establishment role and the requirements described on ITF Health's ISO 13485 page. Keep that requirement map beside the customer's clause. It lets you separate a customer condition from a regulatory condition without assuming that satisfying either automatically satisfies both.

## Keep the processes that already work

Document control, supplier records, internal audits, corrective actions and management review are useful starting points when you already run a quality system. Reuse the process after checking it against the second standard. Reusing a form is sensible; treating a familiar heading as proof of conformity is not.

Take one purchase through the business. Open the supplier approval, purchase order, receipt record and any complaint associated with it. Ask which requirements each record answers. Put those references beside the record in a requirement map, so the evidence is shared without hiding differences in what each standard asks.

Then sample the work rather than only reading the procedure. A controlled document can describe traceability while the delivery record omits the lot number. The gap is in the record people produce. Rewriting the manual will not supply that missing information, and an empty form will not prove the process ran.

## From ISO 9001 to device quality management

Start with the device-specific gaps. ITF Health's ISO 13485 scope includes medical device files, risk management across product realisation, traceability, product preservation, complaint handling, regulatory reporting and quality-system software validation. Check each against your role and the applicable requirements, then identify the record that demonstrates it works.

For a distributor, follow an item from receipt to storage and delivery. Check the device file references and the traceability record, then work backwards from a hypothetical complaint. Write down what the system can show and where it stops. Keep the exercise clearly labelled as an exercise.

For a manufacturer, extend the review to the processes you actually perform. Do not borrow a distributor's scope to avoid examining design or production. The gap report should identify the activity, the applicable requirement, the current evidence and the person who must change the process.

- A requirement map tied to your device activities
- A gap register with evidence references and responsible roles
- A traceability register tested against a sample movement
- A complaint procedure with a recorded reporting decision

## ISO 13485 does not absorb ISO 9001

A device quality system gives you material to reuse if a customer also requests ISO 9001. It does not establish that every ISO 9001 requirement is met. Compare your existing system with ISO 9001:2026 and check the activities the new request covers before deciding what needs to change.

For example, a company might distribute devices and also provide a separate business service. Start by drawing the requested scope around the actual work. Decide which procedures are shared, which records belong to the device activities and which processes need their own review. Do not extend a certificate's meaning beyond its stated scope.

Use a row for each requirement in the gap register. Mark evidence as present only when someone has opened it and checked it against the requirement. A cross-reference to the medical device manual is a place to look, not a completed assessment. Leave unresolved rows open for the person who owns the process.

## A distributor adding a device quality system

Consider a distributor with an existing ISO 9001 system that is asked to address ISO 13485. We would begin with its activities and the written request, then trace a device from goods-in to the customer. This is an illustrative scoping example, not a claim about a completed engagement.

The review would test the existing supplier approval and document control processes first. We would then check the device file, storage records and lot or serial trace, and walk through how a complaint reaches a reporting decision. Any missing record becomes a gap with a responsible role, not a claim that the whole system must be replaced.

The proposed handover is a requirement map, a gap register and revised procedures with their working records. ITF Health handles medical device quality management; ITF Consult handles ISO 9001. The work is on the management system and its evidence. Your people run the processes and keep the records that the assessment will examine.

## Questions before choosing a standard

### Is ISO 13485 a newer ISO 9001?

No. It is a separate medical device quality management standard. Compare the requirements against your activities rather than treating the standard numbers or publication years as a ranking.

### Can a distributor use ISO 13485?

Yes. ISO describes its application across the medical device life cycle, including storage and distribution. Start with the activities you perform and the applicable requirements.

### Can we keep our ISO 9001 procedures?

Keep the procedures that satisfy the requirements you need to address. Record the comparison first, then change the process and evidence where device-specific requirements add work.

### Does ISO 13485 prove ISO 9001 conformity?

No. ISO describes ISO 13485 as stand-alone, with some ISO 9001 elements omitted. A separate ISO 9001 gap review is needed if that is the requirement you must answer.

### Do we need two manuals?

Start with one controlled set of procedures and a map showing which requirements each answers. Keep separate records where the activities or requirements differ. Document count is not the measure of readiness.

### Which ITF division should we contact?

ITF Health handles ISO 13485 quality systems. ITF Consult handles ISO 9001. Bring the written requirement and your current process map so the review starts with the right scope.

Contact: [ops@goitf.com](mailto:ops@goitf.com) · [+966 55 682 4636](tel:+966556824636) · [WhatsApp](https://wa.me/966556824636)