ISO 9001 & ISO 13485

ISO Consulting for Medical Devices & Biotech

I provide specialist consultation for ISO 9001 (Quality Management Systems) and ISO 13485 (Medical Devices QMS) implementation and auditing. Whether you're a medical device company seeking initial certification or an established biotech looking to improve your existing quality system, I offer practical, tailored solutions.

ISO 13485 is the essential standard for organisations involved in the design, production, installation, and servicing of medical devices. It demonstrates your commitment to quality and is often a prerequisite for market access, particularly in the EU (CE marking) and US (FDA).

What I Offer

• ISO 9001 QMS implementation
• ISO 13485 QMS implementation for medical devices
• Gap assessments and remediation planning
• Pre-certification audits
• Internal audits
• Process optimisation
• Documentation development
• ISO training for staff
• MDSAP (Medical Device Single Audit Program) support

ISO 9001 vs ISO 13485

ISO 9001 is a generic quality management standard applicable to any organisation. It's the world's most widely used quality standard and demonstrates your commitment to quality and customer satisfaction.

ISO 13485 is specifically designed for medical device companies. It incorporates additional requirements specific to medical devices, including traceability, risk management, regulatory compliance, and validation activities. If you supply medical devices, ISO 13485 is typically required.

Why ISO Certification Matters

• Market access - Many customers require ISO certification as a supplier prerequisite
• Regulatory compliance - Essential for CE marking and FDA clearance
• Competitive advantage - Stand out from uncertified competitors
• Risk reduction - Systematic approach to quality reduces errors and recalls
• Continuous improvement - Framework for ongoing efficiency gains
• Customer confidence - Demonstrates commitment to quality

Who I Work With

I work with medical device companies of all sizes, from start-ups seeking initial certification to established companies looking to improve or maintain their quality systems. I also support biotechnology firms, IVD (In Vitro Diagnostic) companies, and contract manufacturers.

What a consultant can and cannot do

This is worth being explicit about, because it is a common misunderstanding. Certification to ISO 9001 or ISO 13485 is granted by an accredited certification body, following their own audit. An independent consultant cannot certify you, and a certification body cannot both consult and certify. Those roles are kept apart by the scheme itself.

What I do is the work either side of that audit: establishing what your system already meets, building or repairing the parts that do not, running internal audits against the standard, and closing findings so the certification audit is a confirmation rather than a discovery.

The usual route

A gap assessment against the standard, producing a prioritised list rather than an undifferentiated one. Then documentation and process work on the gaps that matter. Then internal audit and management review, both of which the standard requires and both of which the certification body will look for evidence of. Certification audit normally runs in two stages, a documentation review followed by an assessment of the system in operation.

If you also work to GDP

ISO and GDP quality systems overlap heavily: document control, change control, CAPA, training, internal audit, management review. Companies doing both often run two systems because they were built at different times by different people. One system satisfying both is usually less work to operate and easier to evidence. That overlap is where QMS consulting and GDP consulting meet this work.

Common questions

Can a consultant certify us to ISO 9001 or ISO 13485?

No, and nobody should tell you otherwise. Certification is granted by an accredited certification body following their audit. A consultant prepares the quality system, runs internal audits and closes gaps so that audit goes well. Keeping the two roles separate is a requirement of the certification scheme, not a preference.

What is the difference between ISO 9001 and ISO 13485?

ISO 9001 is a general quality management standard for any organisation. ISO 13485 is written for organisations in the medical device life cycle and adds requirements on risk management, traceability, design controls, validation and regulatory record keeping. ISO 13485 is not simply ISO 9001 with extras: its emphasis is on maintaining effectiveness and meeting regulatory requirements rather than on customer satisfaction.

How long does it take to get certified?

It depends on what exists already and how much of the system has to be built rather than tidied. The controllable part is the gap assessment, the remediation and the internal audit; the certification body sets its own audit dates, usually in two stages.

Do we need ISO 13485 to CE mark a device?

ISO 13485 certification is not itself the legal requirement. EU and UK regulations require a quality management system appropriate to the conformity assessment route, and certification to ISO 13485 is the usual way manufacturers demonstrate it. Check the requirement that applies to your device class and route rather than assuming.

We already run a GDP quality system. Does that help?

Considerably. A GDP quality system and an ISO quality system share most of their structure: document control, change control, CAPA, training, internal audit and management review. Where both are needed it is usually better to design one system that satisfies both than to run two.

This page is general guidance, not regulatory advice. Requirements vary by device class and conformity assessment route. For advice on your specific situation, get in touch.