Quality Gurus
- Certification
- Health & Safety
Medical device manufacturers aiming at the European market face two requirements that are constantly conflated: ISO 13485 certification and CE marking under the Medical Device Regulation (MDR). They are related (one enables the other), but they are not the same thing, and treating them as a single step is how projects stall. ISO 13485 certifies your quality management system; CE marking under MDR is regulatory market access for a specific device. You generally need the first to achieve the second, but the second demands substantially more.
Here is how they fit together and a realistic roadmap through both.
ISO 13485: the quality management system
ISO 13485 is the internationally recognised QMS standard for medical devices. It shares DNA with ISO 9001 but is far more prescriptive on the things that matter in a regulated, safety-critical sector: rigorous design and development controls, risk management integrated throughout (linking to ISO 14971), stringent document and record control, traceability, and clean-manufacturing and process-validation requirements. Unlike ISO 9001's emphasis on continual improvement and customer satisfaction, ISO 13485 is built around maintaining regulatory compliance and consistent device safety.
A certified ISO 13485 system is the foundation, because both the MDR and notified bodies expect a conforming QMS underneath any conformity assessment. It is the entry ticket, not the whole journey.
CE marking under MDR: regulatory market access
CE marking under Regulation (EU) 2017/745 (MDR) is what legally lets you place a device on the EU market. It is device-specific and considerably more demanding than the directive it replaced. The core elements:
- Classification. Devices are Class I, IIa, IIb or III by risk. Class determines the conformity-assessment route and, critically, whether a notified body must be involved (everything above the lowest-risk Class I requires one).
- The technical documentation (technical file). The evidence dossier the MDR specifies in its Annexes: device description and intended purpose, design and manufacturing information, the general safety and performance requirements with evidence of conformity, risk management file, verification and validation, and clinical evaluation (the element that trips manufacturers most).
- Clinical evaluation. MDR raised the clinical-evidence bar substantially. Demonstrating safety and performance through clinical data (own studies or a defensible equivalence route) is where MDR projects most often underestimate time and cost.
- Post-market surveillance and vigilance. MDR is heavy on the post-market phase: a PMS system, periodic safety update reports for higher-risk devices, and vigilance reporting. This is not a launch-day box-tick; it is an ongoing obligation your QMS must operate.
- UDI and EUDAMED. Unique Device Identification and registration in the European database.
The roadmap
- Classify the device first. Everything (the route, notified-body involvement, clinical requirements, timeline) flows from classification. Get it wrong and the whole plan is wrong.
- Build (or certify) the ISO 13485 QMS. The system that will hold design controls, risk management and post-market processes. For a manufacturer starting fresh, building this properly is months of work and the foundation for all of it.
- Assemble the technical documentation in parallel. Design and risk files build alongside the QMS, not after it: they are products of the QMS's design-control process.
- Plan the clinical evaluation early. It is the longest pole for most devices; starting it late is the commonest cause of missed market-entry dates.
- Engage a notified body (Class IIa and above). Their capacity is genuinely constrained under MDR: queue times are real and belong on your timeline from the start, not as an afterthought. Note also that the MDR transitional provisions were extended by Regulation (EU) 2023/607, with staggered deadlines through 2027 and 2028 depending on device class and the conditions attached. Those extensions are conditional, not automatic, so confirm your own device's position against the current text rather than assuming the headline date applies to you.
- Stand up post-market surveillance before launch. It must be operational at market entry, not retrofitted.
Related conformity marks
The same technical-file discipline underlies other conformity marks QG supports: UL marking for other markets, CE marking under other directives for non-medical products. For cosmetics manufacturers, the parallel standard is ISO 22716 Good Manufacturing Practice rather than ISO 13485, with its own technical-file and safety-assessment path.
Practical steps
Classify your device against the MDR rules as step one: it determines everything downstream. Assess your quality system against ISO 13485 honestly; design controls and risk management are where general-manufacturing QMSs fall short. And scope the clinical evaluation early, because it sets the real timeline. QG supports medical device and product-conformity manufacturers with ISO 13485 implementation and technical-file preparation for CE and international market access.