The useful comparison between ISO 13485 and ISO 9001 is not which logo looks stronger on a supplier’s website. ISO 9001 sets general quality-management requirements across industries; ISO 13485 addresses a quality management system for organizations involved with medical devices and related regulatory requirements. A medical parts buyer still has to check the certificate’s edition, scope, site, validity and the actual controls applied to the purchased component.
This distinction matters in a CNC shop, molding supplier or assembly project. A certificate may describe a management system, but it does not approve a device, validate a part design, or replace a drawing-specific inspection plan. The comparison below focuses on supplier selection and manufacturing handoffs, not on a clause-by-clause legal interpretation of either copyrighted standard.
First, Verify Which Editions You Are Comparing
As of October 2026, ISO lists ISO 9001:2026 as the current edition, replacing ISO 9001:2015. ISO 13485:2016 remains the published medical-device QMS edition. A supplier can still display a certificate naming an earlier edition during a certification transition; the buyer should ask the issuer or certification body what that certificate currently covers rather than assuming the website header reflects the latest standard.
Record the exact standard and edition on the certificate, certification body, certificate number, expiry or surveillance status, covered organization and address, and scope statement. A sales page saying “ISO certified” omits the facts that make the claim useful. If the quoted operation is performed at another site or by a subcontractor, ask how that activity is controlled and whether it falls within the relevant scope.
Do not infer that a site is certified to ISO 13485 because it makes medical-looking parts, or that an ISO 9001 certificate has automatically migrated to the 2026 edition. Certification status is a fact to verify for the named legal entity and site at the time of procurement.
Compare the Questions a Buyer Can Actually Ask
| Buyer question | ISO 9001 lens | ISO 13485 lens | What to inspect on a component order |
|---|---|---|---|
| What is the system for? | General quality management across sectors | Medical-device quality management and applicable regulatory context | Certificate scope and the supplier’s role |
| How are requirements transferred? | Controlled customer and product requirements | Requirements in the medical-device lifecycle and related documentation | Released drawing, approved material and revision |
| How are external providers handled? | Control of externally provided processes and products | Supplier controls suited to medical-device requirements | Finishing, cleaning or test subcontractor route |
| What happens when a process changes? | Planned control of changes | Change assessment in a device-specific quality context | Notification, approval and effective lot |
| What proves a part was accepted? | Monitoring and release evidence | Records aligned with medical-device QMS needs | Inspection, traceability and release record |
This table does not claim that one standard lacks a control merely because the other gives it a different emphasis. Both require disciplined processes. The practical question is whether the supplier’s implemented system fits the buyer’s device, component and regulatory responsibilities.
The existing medical device manufacturing standards article provides the broader standards landscape. Here the decision is narrower: what should an OEM ask when it compares two suppliers with different QMS certificates?
A Certificate Is Not a Process Validation Report
Imagine two vendors quoting a polycarbonate housing with a sealing land. One has an ISO 9001 certificate and a detailed part-specific inspection plan. The other has an ISO 13485 certificate but provides only a generic dimensional report. The certificate alone does not tell the buyer whether the land geometry, material source, tool condition or assembly interface will be controlled.
The OEM should define critical features, acceptance methods and any required manufacturing evidence. For injection molding, those questions may include approved resin identity, tool revision, cavity-related differences and how a process change is assessed. For machining, they may include datum selection, surface condition, material traceability and measurement method. The relevance of each item comes from the component, not a standard’s name.
En un flujo de trabajo de mecanizado CNC RFQ, send controlled drawings and identify what must be inspected or documented. Ask the supplier to explain how that information reaches the machine and final release. A useful response names actual operations and records, not only an audit score or a certification badge.
Separate the Finished-Device Owner From the Component Supplier
El FDA says its Quality Management System Regulation became effective on February 2, 2026 and incorporates ISO 13485:2016 by reference into the U.S. device CGMP framework. FDA describes the QMSR’s applicability to finished-device manufacturers intending commercial distribution. Component-supply arrangements require a careful assessment of the parties’ roles and contractual obligations; one should not tell a machine shop that its certificate alone clears a finished device for market.
The buyer should map what the OEM owns, what the supplier performs and what is delegated to a third party. For instance, the OEM may specify material and performance requirements while a fabricator controls the machining route and a finishing partner controls a surface treatment. Quality-system language must translate into notification, inspection, acceptance and record-retention responsibilities across that route.
Where a supplier claims medical-device experience, request project-relevant evidence it is permitted to share. An anonymized process flow, sample inspection plan or explanation of change handling can be more informative than unverifiable statements about unnamed customers. Do not ask a supplier to disclose another customer’s confidential records.
Decide Based on the Purchased Component
Start with the part’s intended function, consequences of failure, manufacturing process, quantity and required documentation. Then set the supplier-evaluation criteria. For a cosmetic enclosure panel, an ISO 9001-based supplier might be suitable if the required component controls and agreement are demonstrated. For a device-critical component with complex traceability and regulated handoffs, the buyer may require a medical-device-focused QMS or additional contractual controls. Neither example is an automatic approval rule.
Compare the supplier’s proposed route with the drawing. Can it identify a material change before use? Does it hold suspect lots? Can it provide an agreed inspection record and respond to an OEM change request? Those answers reveal the implemented system. Certification can increase confidence, but a buyer should still test how the system reaches the part.
Avoid a false shortcut: ISO 13485 certification is not a substitute for product testing, and ISO 9001 certification is not proof that a supplier cannot serve a medical-device program. The right decision depends on the actual role, applicable requirements and evidence the OEM can review.
Put the Comparison Into the RFQ
Request the certificate copy and scope only after defining the quote package: 2D and 3D drawings, exact material specification, finish, quantity, critical features, inspection expectations and any change-notice or record requirements. Ask the supplier to identify which tasks it performs itself and which it sources externally. Clarify what will be delivered with each batch.
If the certificate edition shown on a quote is older than the current edition, ask the supplier and certification body about transition status; do not rewrite the company’s certification claim yourself. If a specific standard is contractually required, put the exact edition and scope in the purchasing documents after qualified review.
The result is a more defensible sourcing decision. The question is not “Which certificate wins?” It is “Which controlled route can make this component to our released requirements, and what evidence will we receive?”
Does ISO 13485 certification mean an individual device is approved?
No. It concerns a quality management system. Device approval, clearance, conformity assessment and component acceptance are separate matters governed by the relevant product and market requirements.
Can a supplier use an ISO 9001:2015 certificate after the 2026 publication?
Do not assume either validity or invalidity from the edition alone. Check the certificate and the certification body’s transition arrangements for that specific organization and site. The publication of a new edition does not automatically update an existing certificate.
