ISO 13485 consulting for US medical device, digital health, and software-as-a-medical-device companies.

ISO 13485 is an international consensus standard for medical device QMS, used as the basis for CE marking in the EU, MDSAP certification, and most non-US regulatory regimes. The FDA's Quality Management System Regulation (QMSR) — 21 CFR Part 820 — is US law, enforced during FDA inspections. As of February 2, 2026, the QMSR incorporates ISO 13485:2016 by reference, so the two are now substantially aligned rather than merely similar, though the QMSR adds FDA-specific requirements (device labeling, UDI, and certain records and complaint provisions). For a US manufacturer, the QMSR is the legal requirement; ISO 13485 certification is voluntary but increasingly expected by customers, and effectively required for international markets. We design a QMS to satisfy both from the same documentation set.

Early — but scoped to where you are. FDA design controls (820.30) apply from the moment you begin design and development of a device intended for commercial distribution. Waiting until pre-submission means recreating the design history file retrospectively, which auditors and reviewers can detect. The right pattern is a lean QMS at company formation that satisfies design controls, then expands to full ISO 13485 scope as you approach commercialization. We've designed many such phased rollouts for venture-backed medical device startups.

It fits — and is increasingly required. FDA classifies most SaMD as medical devices subject to the QMSR (21 CFR Part 820). ISO 13485 with IEC 62304 (software lifecycle) integrated is the right QMS framework for SaMD companies. The implementation looks different from a sterile device manufacturer — design history file emphasis is on software requirements, architecture, testing, and verification rather than process validation and sterilization — but the management-system structure is the same.

Depends on geography. If your commercial plan includes Canada, Brazil, Australia, or Japan in the medium term, MDSAP is the strategic choice — one audit covers all five jurisdictions (including the US, where MDSAP audits substitute for routine FDA inspections for participating manufacturers). If you're US-only with no near-term international plans, standalone ISO 13485 certification is faster and cheaper. We'll help you decide based on your commercial roadmap.

For a pre-revenue medical device company with no existing QMS, six to twelve months is typical from kickoff to Stage 2. The variables that drive duration: device complexity (SaMD moves faster than sterile manufacturing), starting baseline (some teams already have engineering and design discipline that maps to design controls), scope (single product family vs full corporate QMS), and audit body availability. We give you a calibrated timeline after the gap analysis — committing to a date before that would be irresponsible.

FDA inspections are unannounced regulatory inspections enforcing US law (the QMSR at 21 CFR Part 820 and related regulations). Inspectors arrive on-site and issue Form 483 observations or warning letters. With the QMSR effective February 2, 2026, the FDA moved from its long-standing QSIT approach to an updated inspection program aligned with the ISO 13485-based regulation. ISO 13485 audits, by contrast, are scheduled certification audits by an accredited registrar, focused on the standard's requirements. They differ in legal authority, methodology, and consequence. We prepare clients for both: mock FDA inspections including 483 response drills, ISO 13485 audit prep with the actual registrar's audit plan, MDSAP audit prep when in scope. During actual FDA inspections, our role is limited (the inspector talks to your people, not us); we are present as observers and post-inspection response advisors.

ISO 13485 engagements tend to be larger than ISO 9001 or 14001 engagements because device complexity, design control depth, and risk management discipline all add real scope. Gap analysis for a small medical device startup runs in the low to mid five figures. Full implementation through Stage 2 certification for a single product family ranges considerably higher depending on device complexity. Notified body or registrar fees add $15,000 to $50,000 for initial certification depending on scope and audit days. MDSAP audit fees are higher. We don't publish rate cards; reach out and we'll walk through honest scope.

Yes. Form 483 responses and warning letter remediation are a substantial portion of our ISO 13485 work, especially for first-generation manufacturers who underestimated the QMS infrastructure required for sustained compliance. We bring in fresh assessment, identify root cause beyond the specific observations, design and implement systemic corrections, and prepare the response submission. Timeliness matters here — early engagement reduces escalation risk significantly.