The most frequently asked questions about the quality management system

This FAQ provides answers to the most common questions that companies such as medical device manufacturers have about quality management systems (QM systems) and ISO 13485.

Further information

Also see the overview article on QM systems and ISO 13485, which links to other articles on the various activities involved in quality management.

Are you missing the answer to a question? Then feel free to benefit from our micro-consulting service.

Question 1: Who needs a QM system?

The EU medical device regulations (MDR and IVDR) as well as the FDA set requirements for QM systems. These requirements are relevant for:

  • medical device manufacturers
  • distributors and importers who have manufacturer obligations under Article 16 of the MDR/IVDR
  • organizations that reprocess or sterilize medical devices as new

Question 2: Does the QM system have to comply with ISO 13485?

The short answer is yes, because EN ISO 13485 is the only standard that is harmonized for the MDR and IVDR. The FDA also makes mandatory reference to the requirements of ISO 13485 in 21 CFR part 820. The more precise answer is, that in EU the QM system has to be conform with MDR/IVDR requirements. ISO 13485 helps proving, that these requirements are met.

Question 3: Is ISO 9001 allowed as an alternative?

Other standards are permitted, but they are not suitable on their own for proving that the statutory requirements for the QM system are met.

Question 4: Does the QMS have to be ISO 13485 certified?

Manufacturers must involve a notified body in the conformity assessment unless the devices fall into class I. The usual conformity assessment procedure follows Annex IX of the MDR or IVDR. For this purpose, the manufacturers require an appendix certificate. Strictly speaking, no ISO 13485 certificate is required. But because ISO 13485 almost completely covers the requirements of Article 10 and Annex IX of the MDR and IVDR, it makes no sense to dispense with the ISO 13485 certificate.

Thus, the short statement that an ISO 13485 certificate is mandatory for all manufacturers (except those of class I devices) is sufficiently correct.

Question 5: What are the requirements of ISO 13485?

ISO 13485 obligates manufacturers to, among other things:

The requirement documents can be divided, for example, into standard operation procedures (SOPs) and work instructions, templates, forms, and checklists. ISO 13485 requires approximately 25 SOPs to be documented, which you will find listed here.


This page describes how you can establish a lean QM system in the shortest possible time with our help (scroll to the "7 steps").

Question 6: How to get the certification?

Step 1: Select certifier (notified body)

The German accreditation body DAkkS publishes on its website the notified bodies or certifiers accredited for ISO 13485 certification. Note that the notified bodies may only perform ISO 13485 certification for a certain type of medical device (e.g., in vitro diagnostic devices, non-active medical devices, extra-corporeal circuits).

Step 2: Establish quality management system

As described above, this includes creating the QM manual, describing standard operating procedures, and establishing the QM representative.

Step 3: Live quality management system

In order to apply for an audit, you must not only have defined a QM system, but you must already be working according to the rules of this (new) QM system. For example, technical documentation for a medical device should already have been developed following the respective SOPs such as the development SOP (as far as possible). Typically, you should also have performed an internal audit as well as a management review.

Step 4: Invite notified bodies for audit

You then invite the selected notified body to an audit. If you pass this audit, the notified body will (in all likelihood) issue you with an ISO 13485 certificate and, if applicable, an Annex XI certificate. Among other things, this authorizes you to market medical devices.

Further information

On this page, we have described how the path from your first contact to an ISO 13485-certified system can proceed.

Question 7: How long does it take to get the certificate?

We typically guide companies to ISO 13485 certification in six to nine months (more on the process). Currently, the overload of notified bodies may delay this timeframe. What matters most is the commitment of the organization.

Question 8: How much does it cost, what are the expenses?

The amount of time and effort required depends mainly on the size of the organization and the areas to be certified. Small and medium-sized companies spend between 30 and 90 days to set up their QM system.


With the help of the Johner Institute (Medical Device University & templates and/or consulting), companies succeed in significantly reducing this duration.

Maintaining the QM system on a permanent basis also means an expenditure, but this should be more than compensated for by lower consequential failure costs (recalls, rework, unnecessary iterations in development).

External certification costs are incurred in any case for the certification of their quality management system. For the preparation, the on-site audit, and the follow-up of the audit, the certification body will charge you costs that depend on the size of the company. These range from 20 to 60,000 EUR. This includes the inspection of the technical documentation.


If you would use our support, there will be additional costs for this external consulting, which will vary depending on the size of the company, the current status of your quality management system, and the extent of your own work. We will be happy to provide you with a tailor-made offer!

Experience shows that our support also pays off financially because the costs for rework and interaction with the notified bodies are minimized.

Question 9: Where can I get support?

Johner Institute's QM experts support medical device manufacturers and their service providers in setting up and continuously improving QM systems.

a) Education and training

The Johner Institute offers seminars for beginners and advanced users, e.g., on the basics of ISO 13485 or internal auditor.

b) Tool to master all regulatory hurdles 

The Medical Device University enables manufacturers to create QM systems themselves with support. It combines:

  • An onboarding that provides an overview of the roadmap
  • Video trainings
  • Complete set of sample templates that only need to be adapted to your own situation
  • Weekly expert sessions where questions are answered

c) Consulting and assumption of roles

Johner Institute consultants also provide direct support. They... 

Interested? Then contact us right away.


Prof. Dr. Christian Johner

Find out what Johner Institute can do for you

A quick overview: Our


Learn More Pfeil_weiß

Always up to date: Our


Learn More Pfeil_grau

Privacy settings

We use cookies on our website. Some of them are essential, while others help us improve this website and your experience.