ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
Most articles give you an ISO 13485 certification timeline as a single range and stop there. That is not much use when a distributor has asked for your certificate by a date, or an investor wants to know when the EU or US route opens up. The honest answer is that the total runs from about six months to eighteen, but almost all of that spread comes from two phases you control and one you do not. This guide walks through each phase, gives typical durations, and shows where the calendar can and cannot be compressed.
One thing worth settling first: you are building to ISO 13485:2016, edition 3, which ISO reviewed and confirmed in 2025. No new edition is in progress, so nothing you write this year will need to be rewritten for a transition. And since 2 February 2026, the FDA’s Quality Management System Regulation has incorporated ISO 13485:2016 by reference into 21 CFR Part 820, so the same quality management system now serves both the certificate and US regulatory inspection.
Here is the whole ISO 13485 certification timeline in one table. Durations are typical ranges from practitioner experience, not fixed rules; the audit-day figures further down are the only numbers set by a normative document.
| Phase | Typical duration | Who controls it |
|---|---|---|
| 1. Gap analysis and scoping | 2–4 weeks | You |
| 2. Building the QMS (documents, training, risk file) | 3–9 months | You |
| 3. Operating the QMS and generating records | 3 months minimum | You, but the floor is set by auditors |
| 4. Internal audit and management review | 2–4 weeks (inside phase 3) | You |
| 5. Certification body selection and booking | 1–3 months lead time | Certification body |
| 6. Stage 1 audit and remediation | 1 day audit, then 4–12 weeks | Shared |
| 7. Stage 2 audit and nonconformity closure | 2–9 audit days, then 2–8 weeks | Shared |
| 8. Certification decision and certificate issue | 2–6 weeks | Certification body |
| Total, first-time manufacturer | 6–18 months |
The fastest realistic path, a small company starting from a complete template set and running a tight project, lands at the six-month end. A company writing every procedure from a blank page, with a design and development process to formalize and a risk management file to build, sits closer to the twelve-to-eighteen-month end. Phases 2 and 3 are where the difference lives.
Before anything gets written, someone has to map what you already have against the clauses of the standard and decide the certification scope: which sites, which products, which processes. Scope decisions made here determine your audit days later, so do not rush them. If you outsource sterilization, software development or contract manufacturing, those suppliers enter the picture now, because clause 7.4 purchasing controls and supplier evaluation will need evidence. Two to four weeks is normal for a single-site manufacturer, and it is the cheapest place in the whole ISO 13485 certification timeline to fix a scoping mistake. Use the ISO 13485 mandatory documents list as the checklist for what must exist at the end.
This is the largest and most variable block of any ISO 13485 certification timeline. A conforming system needs a quality manual, the documented procedures the standard names, a medical device file for each device family, design and development controls with planning, inputs, outputs, review, verification and validation records, purchasing and supplier controls, production and process validation, CAPA, complaint handling, and a risk management file that works with ISO 14971. Each of these has to be written, approved under document control, and trained out to the people who will use it.
Three months is achievable for a small company with a single product family that starts from a proven template set and has one person driving the project. Six to nine months is typical when procedures are drafted from scratch, when several departments need to sign off, or when the company is simultaneously trying to finish the device itself. Beyond nine months usually signals a resourcing problem rather than a complexity problem.
Certification bodies will not audit a system that has just been switched on. Before Stage 2 they expect to see the system running with real records: completed supplier evaluations, closed CAPAs, controlled design changes, training records, and at least one full internal audit and one management review. In practice most bodies want to see roughly three months of operation, and many will tell you so in their quotation. This is the phase companies most often forget to plan for, and it cannot be overlapped with document writing because the records have to be produced by the documented processes.
Use this window to run your internal audit against every clause in scope, hold the management review with the inputs the standard requires, and close what you find. Our ISO 13485 internal audit checklist covers the clause-by-clause questions. Arriving at Stage 1 with those two records already on file is the single biggest predictor of a clean Stage 2.
Run this in parallel with phase 2 or you will lose a quarter waiting. Accredited medical device certification bodies have limited auditor capacity, and initial certification slots are commonly booked one to three months ahead. Get two or three quotes early, check the accreditation covers ISO 13485 for your device category, and confirm whether you will also need MDSAP or a notified body for the EU, since those are separate programmes with their own scheduling. This step is invisible on most ISO 13485 certification timeline charts and it is where a quarter quietly disappears. If you are weighing bodies on price, read our ISO 13485 certification cost breakdown first: the day count is fixed by rule, so the differences are in day rates and admin fees.
Stage 1 is a documentation and readiness review, usually one day on site or remote. The auditor confirms the scope, checks that the mandatory documents exist and are controlled, verifies that internal audit and management review have been performed, and looks for anything that would make Stage 2 pointless. You receive a list of areas of concern. Closing them typically takes four to twelve weeks, and the certification body will set the Stage 2 date so that you have time to do it. A short gap is a sign of a well-prepared system; a very long gap can force parts of Stage 1 to be repeated.
Stage 2 is the full on-site audit of implementation and effectiveness. The auditor samples records across every process in scope, interviews staff, and follows a device through design, purchasing, production, release and post-market processes. Nonconformities are graded major or minor. Minors normally need a corrective action plan accepted within a few weeks; majors need the correction verified, sometimes by a follow-up visit at day rate, before certification can be recommended. Two to eight weeks is the usual span between the closing meeting and the file being ready for decision.
The auditor recommends; a separate decision-maker inside the certification body reviews the file and issues the certificate. This independent review is required by ISO/IEC 17021-1 and is not something you can accelerate. Two to six weeks is typical. If you want the wider picture of what the certificate does and does not give you, our guide to ISO 13485 certification covers the process end to end. The certificate carries a three-year expiry from the decision date, with surveillance audits in years one and two and a recertification audit before the end of year three.
The one part of the schedule you cannot negotiate is how long the auditors spend with you. Bodies auditing ISO 13485 work to ISO/IEC 17021-1 plus IAF MD 9:2023 Issue 5, whose Annex D Table D.1 sets the initial audit time for Stage 1 and Stage 2 combined by effective headcount. IAF ceased operations on 1 January 2026 and its mandatory documents now sit with Global ACI, but the table itself has not changed.
| Effective number of personnel | Initial audit days (Stage 1 + Stage 2) | Typical split |
|---|---|---|
| 1–5 | 3 | 1 day Stage 1, 2 days Stage 2 |
| 6–10 | 4 | 1 + 3 |
| 11–15 | 4.5 | 1 + 3.5 |
| 16–25 | 5 | 1 + 4 |
| 26–45 | 6 | 1–1.5 + 4.5–5 |
| 46–65 | 7 | 1.5 + 5.5 |
| 66–85 | 8 | 1.5 + 6.5 |
| 86–125 | 10 | 2 + 8 |
Two consequences for the calendar. First, Stage 2 for a mid-sized manufacturer is a full working week with two auditors on site, so pick a week when your process owners are actually present. Second, adding ISO 9001 to the same audit adds a minimum of 25% to those days; combining certificates is often the right decision, but it lengthens the audit rather than shortening it. Surveillance audits run at roughly one third of the initial time each year, which is why the ongoing ISO 13485 certification timeline after the certificate is a predictable one-to-three-day annual visit.
What works:
What does not work:
| Scenario | Starting point | Realistic total | Where the time goes |
|---|---|---|---|
| Startup, single Class II device, 8 people | No QMS; template set; one full-time quality lead | 6–8 months | 3 months build, 3 months operation with CB booked in parallel, 4-day audit, 6-week decision |
| Contract manufacturer, 40 people | ISO 9001 certified; adding ISO 13485 | 5–9 months | Design controls, device files and risk management are new; combined audit adds 25% to days |
| Established manufacturer, 100 people, multiple product lines | Informal procedures, no design control history | 12–18 months | Procedure writing across departments, retrospective device files, 10-day audit needing two auditors |
The second row is worth a note. An existing ISO 9001 system gets you document control, internal audit, management review, CAPA and competence for free, but ISO 13485 adds regulatory-specific requirements that 9001 does not have: the medical device file, design and development validation, process validation for sterile and software-driven devices, advisory notices, and complaint handling tied to regulatory reporting. Companies that assume the gap is small are the ones surprised at Stage 1. Our comparison of ISO 13485 vs ISO 9001 lists the deltas clause by clause.
An ISO 13485 certification timeline of six to nine months is realistic for a company under 25 people that starts from a template set, books the certification body early, and runs a three-month operating window before Stage 1. The audit itself is three to five days in total for that headcount, so the calendar is driven by preparation, not by the auditors.
There is no clause that names a number of months, but certification bodies need to see records produced by the documented processes, including a completed internal audit and management review. Around three months of operation is the practical floor most bodies work to, and some will state it in their quotation.
Typically four to twelve weeks. The certification body sets the interval so that you can address the areas of concern from Stage 1. If the gap stretches beyond roughly six months, expect the body to revisit parts of Stage 1 before proceeding.
Not directly. The FDA does not certify anyone and does not require an ISO 13485 certificate. But because the QMSR, effective 2 February 2026, incorporates ISO 13485:2016 into 21 CFR Part 820, the same documentation you build for certification is what an FDA inspector will assess. Building once for both is the efficient route.
Three years from the certification decision, with surveillance audits at roughly one third of the initial audit time in each of the first two years and a recertification audit before expiry. Missing a surveillance window can suspend the certificate, so the timeline does not end at issue.
An ISO 13485 certification timeline is not one number; it is a build phase you control, an operating window with a practical three-month floor, a booking lead time you can hide behind the build, and an audit whose length is set by a table. Plan the four separately, start from documents that already map to the standard, and the six-month end of the range is a project plan rather than a marketing claim.
References: ISO 13485:2016, Medical devices — Quality management systems — Requirements for regulatory purposes (edition 3, confirmed 2025). IAF MD 9:2023 Issue 5, Application of ISO/IEC 17021-1 in the Field of Medical Device Quality Management Systems, Annex D. US FDA Quality Management System Regulation, effective 2 February 2026.
September 20, 2026
September 20, 2026
September 19, 2026
September 19, 2026
September 19, 2026