ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
ISO 13485 for startups is mostly a sequencing problem: which parts of the quality system you need on day one, which can wait and which regulators will insist on before you sell. Get the order right and the system stays small, cheap and genuinely useful.
This roadmap covers why startups need a quality system, what a lean version contains, a 90-day plan and the mistakes that slow early teams. It assumes you are building a device, not only buying one.
Free gap assessment
How much of ISO 13485 could you evidence today?
Score clauses 4 to 8, free, with the FDA QMSR and EU MDR duties kept separate so you can see what is the standard and what is the regulator.
Run the free ISO 13485 gap assessment → or View premium report sample
ISO 13485:2016 is a voluntary international standard, but regulators build on it. The EU MDR requires manufacturers to establish and maintain a quality management system, and certification to the standard is the usual way to show conformity.
In the US, the FDA Quality Management System Regulation took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference. Check the scope and any exemptions for your device class.
Certification itself is not a CE mark. Read the standard on the ISO 13485:2016 page on iso.org and the regulations that apply to you.
Investors, hospital buyers and distribution partners often ask whether you have a quality system, because it signals that the company can make the same device repeatedly and handle problems.
A lean, working system helps more than a thick binder. Evidence of design reviews, supplier approvals and a complaint log is convincing in diligence.
For the cost side of the decision, see ISO 13485 certification cost and is ISO 13485 worth it.
A lean system does not skip requirements. It meets each one with the smallest process that produces reliable records. One page can replace ten when the company has twelve people.
Write procedures around what you actually do, then improve them. Copying a large company’s system creates tasks nobody performs and findings you cannot defend.
Aim for clear ownership. In a small team, one person often holds several roles, and the system must show that responsibilities do not conflict with clauses such as auditor independence. Keep this in mind for every ISO 13485 for startups.
Start with the foundation: quality policy and objectives, document and record control, a quality manual and a design and development procedure. These support everything else.
Add risk management, supplier controls and training next. Our guides to the quality manual and design controls give the clause detail.
Complaint handling, CAPA and internal audits follow once you have a device in use or in clinical evaluation.
Production-only requirements such as process validation, traceability systems and servicing procedures can wait until manufacturing design is mature. But define them in time for design transfer.
Do not leave them too late. Process validation often needs equipment and data you must plan months ahead.
Postpone elaborate software tools. A controlled shared drive with clear naming can work initially, provided any QMS software is validated when used. This is where a ISO 13485 for startups is won or lost.
In the first month, define scope, regulatory role and target markets. Decide whether you design, manufacture, import or distribute, because that sets applicable clauses.
Run a quick gap analysis, then draft the quality policy, objectives and a process map. Assign owners.
Pick your document control method now. Renaming files and rebuilding folders later wastes weeks.
In month two, write the core procedures: document and record control, design and development, purchasing, training and nonconforming product. Keep each short and practical.
Start design and development files for your lead device, including a plan, inputs, outputs and a risk file. Records created now become your audit evidence.
Set up supplier evaluations for anyone providing critical materials, using criteria proportional to risk. Auditors judge your ISO 13485 for startups on exactly this point.
| Priority | Process | When |
|---|---|---|
| Day one | Quality policy, document control, manual | First 30 days |
| Before design work | Design and development, risk management | Days 31 to 60 |
| Before first supplier PO | Purchasing and supplier evaluation | Days 31 to 60 |
| Before audit | Internal audit, management review, training | Days 61 to 90 |
| Before production | Process validation, traceability | Design transfer |
| After launch | Complaints, CAPA, post-market data | Ongoing |
In month three, train staff, run a first internal audit on the core processes and hold a first management review.
Fix the gaps you find and record the corrective actions. A system that has found and fixed its own problems is more credible than one that claims none.
By day 90 you should have working procedures, early records and a plan for the remaining processes.
Under EU MDR, a notified body assesses your quality system as part of conformity assessment for most devices. Your system must be in place before that assessment, so plan the QMS months before the technical documentation is final.
In the US, devices in development under design controls need design records early, because they are hard to recreate later.
See EU MDR transition deadlines and QMSR vs ISO 13485 for the regulatory context. Treat it as a standing rule for your ISO 13485 for startups.
Certification is a separate decision from building the system. Many startups build first, collect three to six months of records and then book the audit.
Pick a certification body accredited for medical devices, and for MDSAP if you target Canada, the US, Brazil, Australia or Japan. Health Canada requires MDSAP certificates for devices in higher classes, so check your class.
Our certification timeline shows the usual sequence.
The usual errors are buying an oversized system, writing procedures nobody follows, starting design controls late and treating quality as one person’s job. Another is delaying supplier approval until production.
A fifth mistake is waiting for certification before collecting records. Without early data, a first audit finds empty folders.
Good ISO 13485 for startups work keeps documentation small and evidence real.
One person can hold the quality lead and regulatory roles at the start, but give design review authority to engineering and keep product release independent where you can.
Document who approves what. A one-page responsibility matrix prevents confusion and answers auditor questions quickly.
Plan to hire or contract a dedicated quality or regulatory person before design transfer, when workload and risk rise.
Plan time and money in four buckets: templates and consulting, QMS software or document control, testing and validation, and certification audits. Time is usually the biggest cost.
Templates cut drafting time significantly. The ISO 13485 Toolkit provides editable procedures, forms and a manual to adapt for a small company.
Start simple on tools, then move to an electronic QMS when volume demands it and you can validate it.
Risk management runs through the lifecycle. Early risk files feed design inputs, supplier criteria and post-market monitoring. Do not leave them to the end.
Read the guide on how ISO 14971 relates to ISO 13485 to see how the two documents fit together.
A living risk file is one of the strongest signs of a healthy startup quality system.
Certification is the start of the audit cycle, with surveillance visits and full re-certification in the following cycle. Keep your internal audits and reviews running on schedule.
Update the system as the company grows, adding procedures for new sites, products and markets. The next step in many cases is MDR or MDSAP.
Review the quality manual annually so it describes the company you are, not the company you were at launch.
Culture matters more than paperwork. If engineers see the quality system as a gate rather than a tool, they will route around it and records will be reconstructed after the fact.
Make it easy to comply. Provide short templates, a clear folder structure and a person who answers questions the same day.
Celebrate found problems. A team that raises issues early produces better CAPA records and fewer audit surprises.
Certification auditors know startups are small. They expect a system proportionate to the business, with all required clauses addressed or justified, and real records showing it works.
They do not expect a fully automated system or a large team. They do expect independence for audits, a working complaint process if devices are in use, and evidence of management involvement.
Showing a clear plan for what is still being built is better than hiding gaps.
Resist adding a procedure for every incident. Before creating one, ask whether an existing process can cover it with a small change.
Review the document list twice a year and retire anything unused. Fewer, better documents are easier to train, audit and update.
That discipline keeps ISO 13485 for startups practical when the company moves from five people to fifty.
Yes. Certification covers the quality system, so a company in development can certify if it has working processes and records, though scope must reflect its activities.
There is no minimum. A small team can run a compliant system if roles and independence rules are respected.
It depends on the jurisdiction and study type. Check applicable regulations, because design control records are usually expected regardless.
Many startups do for a gap analysis and templates, then run the system themselves. Knowledge transfer matters more than outsourcing it entirely.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026