ISO 9001 vs ISO 13485: Which Standard Applies and When
ISO 9001 vs ISO 13485 explained for engineers and quality managers: scope, documentation, risk, suppliers, and what each certificate proves in a supply chain.
ISO 9001 vs ISO 13485: Which Standard Applies and When
ISO 9001 is the general quality management standard for any organization. ISO 13485 is the medical device version: it keeps much of the same process thinking but shifts the goal from customer satisfaction to regulatory compliance and device safety. If you make or supply medical devices, ISO 13485 is the one regulators and customers look for. If you serve other industries, or supply a process such as a coating to a device maker, ISO 9001 is usually the baseline, and the device maker’s supplier controls fill the gap.
This guide compares the two on the points that matter when you are writing a specification, qualifying a supplier, or planning a certification path.
professionalpowdercoating.ca
professionalpowdercoating.ca
Specify Quality With Confidence
Professional Powder Coating provides ISO 9001:2015-certified coating, documented quality assurance, and in-house testing for demanding industrial components.
ISO 9001:2015 applies to any industry and emphasizes customer satisfaction and improvement. ISO 13485:2016 applies to the medical device lifecycle and emphasizes regulatory compliance and safety.
ISO 13485 demands more documentation, tighter supplier controls, and stronger post-market feedback. ISO 9001 leaves more room for the organization to decide how much to document.
A company can hold both certificates. Meeting ISO 13485 does not by itself mean meeting ISO 9001, and the reverse is also true.
Suppliers to device makers are pulled into the ISO 13485 system through purchasing controls, even when they are not certified themselves.
ISO 9001 is being revised: ISO announced the 2026 edition, so check your certification body’s transition timeline.
ISO 9001:2015 is a generic framework. It tells an organization how to run a quality management system (QMS): set objectives, control processes, handle nonconformities, review performance, improve. It does not care whether you make bolts, software or soup.
That last point is the real divide. ISO 9001 asks whether you consistently meet customer and applicable requirements. ISO 13485 asks whether you consistently produce devices that are safe and perform as intended, and can prove it to a regulator.
Organizations in the medical device lifecycle and their suppliers
Core aim
Customer satisfaction and improvement
Regulatory compliance and safe, effective devices
Structure
Annex SL high-level structure
Its own structure, kept from earlier versions
Documentation
Flexible, organization decides
Prescriptive, with many required documents
Management roles
Flexible assignment
A management representative must be identified
Risk
Risk-based thinking across the QMS
Risk management tied to the product and processes
Suppliers
Control suitable to the effect on conformity
Risk-based evaluation, selection, monitoring, and re-evaluation
After delivery
Customer feedback
Complaint handling and regulatory reporting
The structural and emphasis points in this table come from BSI’s comparison of the two standards, which notes that ISO 9001:2015 follows the Annex SL structure while ISO 13485:2016 keeps the structure it developed in earlier versions.
Where the requirements really differ
Purpose: satisfaction versus compliance
ISO 9001 puts customer satisfaction and continual improvement at the center. ISO 13485:2016 does not emphasize those as objectives in the same way, and puts regulatory compliance and safe, effective device performance first. A device maker may be perfectly happy with a process that is stable and compliant, even if there is no appetite for ongoing optimization that changes validated steps.
That explains a behavior engineers sometimes find frustrating: in a regulated device environment, a “better” coating line setting is not adopted until it has gone through change control and revalidation.
Documentation and records
This is the difference you feel first. ISO 9001:2015 typically requires fewer documents than the roughly 27 specific documents often associated with ISO 13485:2016. The RAPS guide explains why: ISO 13485 documentation runs higher than a typical ISO 9001 QMS because of device risk and the need for traceability after a device is marketed.
In practice, ISO 9001 lets you decide which procedures you need. ISO 13485 tells you which ones must exist, and it expects records that can be pulled years later when a complaint or audit arrives. If your team is building a records system for either standard, it helps to think through how work orders, inspections, and maintenance history are logged, for example with maintenance records and ISO compliance practices that keep evidence tied to each machine and job.
Management responsibilities
ISO 13485:2016 requires a specifically identified management representative. ISO 9001:2015 gives top management flexibility in assigning quality roles. For a small supplier this is mostly an organizational chart question, but it matters at audit time.
Risk
ISO 9001:2015 introduced risk-based thinking: you consider risks and opportunities that affect the QMS. ISO 13485:2016 places greater emphasis on risk management, and applies it to product realization, not just to the management system. The question moves from “could this hurt our results?” to “could this hurt a patient?”
This matters for anyone who sells into the device chain. The same publication states that the standard applies across the supply chain: raw material and component suppliers, subassembly makers, and service providers such as sterilizers or distributors. A coating provider whose work ends up on a device enclosure, a cart, a frame or a piece of equipment may therefore be asked to follow customer-specific requirements even without its own ISO 13485 certificate.
After the product ships
ISO 13485:2016 places more focus on post-market activities, including complaint handling and regulatory reporting. ISO 9001 covers customer feedback, but it does not require feeding field complaints into a regulatory reporting process.
Which standard applies to a coating supplier
Start with what the part is and who uses it.
The part is not part of a medical device or its production. ISO 9001 is the right quality baseline. This covers most industrial work: telecom enclosures, power equipment, structural steel, machine guarding, marine and aerospace hardware (aerospace also uses its own sector standard on top of ISO 9001).
The part is a component or accessory of a finished medical device. The device maker’s ISO 13485 system will flow requirements down to you: approved supplier status, quality agreements, change notification, material and process records, sometimes audits.
The part is production or facility equipment, such as pharmaceutical or healthcare equipment frames and housings. Requirements vary. Some customers run ISO 13485, others only ask for ISO 9001 plus coating test data. Ask the customer which parts of the QMS they consider applicable.
A practical rule: do not ask a supplier “are you ISO 13485 certified?” as a reflex. Ask what the device maker’s risk assessment says about the process, and which controls follow from that. A coating process with defined pretreatment, cure verification, adhesion testing, and lot traceability can satisfy a well-written requirement even when the supplier’s certificate is ISO 9001.
Meeting one does not mean meeting the other. An older ISO 13485 edition made this explicit: organizations conforming to the 2003 version could not claim ISO 9001 conformity unless their QMS met every ISO 9001 requirement. The same logic holds today, because ISO 9001 includes customer satisfaction and improvement requirements that ISO 13485 does not carry.
Use the cross-reference. Annex B of ISO 13485:2016 maps the two standards clause by clause, so it is the quickest way to see where requirements differ or are extra when you add a second standard. Run the gap analysis against your actual procedures, not against a template.
A certificate shows that an accredited or recognized certification body audited the QMS against the standard and found it conforming at the time of the audit. It does not show that every part is good, that a given batch passed, or that a product is legal to sell.
For ISO 13485 specifically, regulatory compliance sits in the QMS design: the standard requires you to identify the regulatory requirements that apply in each market. Certification to the standard is not the same as device clearance or approval.
In the United States, the FDA’s Quality Management System Regulation took effect on February 2, 2026 and incorporates ISO 13485:2016 by reference into 21 CFR Part 820. For US device makers, this makes ISO 13485 language the common vocabulary, and it will increasingly shape the supplier questionnaires that reach your quality team. Check the FDA’s own pages for the exact scope and requirements that apply to your customer.
ISO 9001 is changing: what to do now
ISO has announced a new edition. NSF reports that ISO 9001:2026 was scheduled for publication on September 16, 2026, and describes it as an evolution of the 2015 edition rather than a rewrite, with customer focus, process management, leadership, and continual improvement staying in place. Certified organizations will then work through a transition period set by their certification body.
What to do:
Ask your certification body for its transition schedule and audit plan.
Review supplier certificates for expiry and edition, and update your approved supplier list when suppliers move to the new edition.
Do not rewrite specifications to say “ISO 9001:2026” until your customers and suppliers confirm which edition they are auditing against.
For ISO 13485, the 2016 edition remains the one referenced in current device regulation; ISO reviews standards every five years to decide if revision is needed, so watch the official page.
What the coating process looks like under each standard
The difference is easier to see on the shop floor.
Under an ISO 9001 QMS, a coating provider defines process controls for pretreatment, application, and cure, keeps inspection records, calibrates its instruments, handles nonconforming parts, and reviews customer feedback. The customer’s specification drives the details.
Under an ISO 13485 customer’s supplier controls, the same process usually gains these elements:
A quality agreement that sets responsibilities for change notification.
Validated or verified special processes, with defined limits for cure temperature and film thickness.
Lot-level traceability of powder, substrate, and process parameters.
Defined cleanliness, handling, and packaging requirements for parts that go on to assembly.
A path for complaints and corrective actions to flow back from the device maker.
If you are specifying a coating for medical or pharmaceutical equipment, write these into the drawing notes or the purchase agreement rather than relying on the supplier’s certificate. Our quality testing protocols page shows the kinds of tests that give those records substance.
Our perspective
We are a high-capacity industrial coater for large, heavy, and complex metal parts, and our quality system is certified to ISO 9001:2015. We do not claim an ISO 13485 certificate, and we would rather say so plainly than let a customer assume.
Here is how we see the question. For most of the parts we finish, the standard that matters is not the one on the wall but the one built into the process: surface preparation that is repeatable, adhesion that is tested, and records that follow the job. A certificate tells you a system exists. The test data and the documentation on your specific order tell you the system worked.
When a customer in healthcare or pharmaceutical equipment sends us a specification, we start with a feasibility review: part size, substrate, coating system, cure requirements, test plan, packaging. The conversation about what the customer’s quality system expects from us, including change notification, record retention, and traceability, belongs in that review, before the first part is blasted. Our in-house laboratory testing and documented quality assurance exist for that conversation.
Our advice to engineers: decide what evidence you need per lot, ask for it in the purchase order, and treat the certificate as the start of supplier qualification, not the end.
— PPC Technical Team
Working with us on regulated or documented work
If your parts are large, heavy, or complex and need a controlled, documented finish, we can review feasibility, define the process path, test in-house, and ship with protective packaging so parts arrive ready for assembly. See our industrial powder coating and finishing services, or read how we handle quality, testing, and standards before you send a drawing.
How to choose: a short checklist
Identify whether your product is a medical device, a component of one, or equipment around one.
Read your customer’s supplier requirements and quality agreement, not just the certificate line.
Use ISO 9001 as the minimum baseline for any supplier handling critical finishing.
If you are the device maker, apply a risk-based approach to supplier selection and re-evaluation, as ISO 13485 clause 7.4 requires.
If you are adding a second standard, run the Annex B cross-reference as your gap analysis.
Put required records and test evidence into the purchase order.
Confirm editions: ISO 9001:2015 or the 2026 edition, and ISO 13485:2016.
FAQ
Is ISO 13485 harder to get than ISO 9001?
It is usually more work, mainly because it requires more documented procedures and records, specific management roles, and regulatory and post-market processes. A mature ISO 9001 system gives a head start, but gaps remain. Use Annex B of ISO 13485 to size the gap.
Does ISO 13485 include ISO 9001?
No. ISO 13485 is based on ISO 9001 but is a standalone standard, and it drops some ISO 9001 requirements such as the emphasis on customer satisfaction and continual improvement. Conforming to ISO 13485 does not let you claim conformity to ISO 9001 unless your system also meets all of ISO 9001.
Do suppliers to medical device makers need ISO 13485?
Not always. The device maker’s ISO 13485 system applies to its suppliers through risk-based purchasing controls, so the requirement depends on how much the supplied part or process affects safety and performance. Some customers ask for certification, others accept ISO 9001 plus a quality agreement and process records.
Is ISO 9001 changing in 2026?
Yes. ISO announced that the new edition, ISO 9001:2026, was due to be published on September 16, 2026, with a transition period for certified organizations. Ask your certification body for its schedule before your next surveillance or recertification audit.
