ISO 13485 Recertification Audit: The Complete 2026 Guide

An ISO 13485 recertification audit is the year-three audit that decides whether your medical device quality management system gets a new three-year certificate or quietly lapses. It is shorter than your initial audit, but it is not a bigger surveillance visit: the certification body has to judge the whole cycle, and a medical device certificate carries rules an ISO 9001 renewal does not. This guide sets out what governs the audit in 2026, how long it takes, what the auditor will look at, and how to stop a late booking turning into an expired certificate.

If you are earlier in the cycle, start with the ISO 13485 certification guide for the full path, or the ISO 13485 surveillance audit guide for years one and two.

Which rules govern an ISO 13485 recertification audit in 2026

Three documents set the rules, and only one of them is ISO 13485 itself.

• ISO 13485:2016 is still the current edition. It is the audit criterion: what your system must do.
• ISO/IEC 17021-1:2015, clause 9.6.3, tells the certification body how to plan and run a recertification audit, what happens to major findings, and what happens if the certificate expires first.
• Global ACI-TECH-3-007 (M), the mandatory document for ISO 13485 certification, adds the medical device rules. It was issued on 10 July 2026 and has applied since 28 August 2026. It is the former IAF MD 9, reformatted when the International Accreditation Forum handed its role to Global ACI, “without any substantive change to the text”. Its clauses still carry the labels MD 9.x. You can read it free on the Global ACI document site.

Audit time comes from a fourth document, Global ACI-TECH-3-004 (formerly IAF MD 5). TECH-3-007 keeps it, but swaps its general quality table for a medical device table of its own. More on that below.

One thing that surprises people: TECH-3-007 has no recertification clause of its own. Its section 9.6 adds a surveillance requirement and a short-notice audit rule, then stops. So the ISO 13485 recertification audit runs on 17021-1, with the medical device rules on findings, sampling, competence and audit time applied on top.

ISO 13485 recertification audit timing: the end of the three-year cycle

Under 17021-1 clause 9.1.3.2, the programme is a two-stage initial audit, surveillance in the first and second years after the certification decision, and a recertification audit in the third year, before the certificate expires. The first cycle starts on the certification decision date. Every later cycle starts on the recertification decision.

The clause that matters most for planning is 9.6.3.1.1: the recertification audit must be planned and run “in due time” for the renewal to happen before the expiry date. “Done before expiry” is not the target. The audit, any corrective actions and the certification decision all have to be finished before expiry.

Point in the cycle	What happens	Clause
Months 30–33	Body plans the recertification audit and reviews the surveillance reports from the cycle	17021-1 9.6.3.1.2
Months 32–34	On-site recertification audit (plus a stage 1 if there have been significant changes)	9.6.3.1.3, 9.6.3.2.1
Before expiry	Majors corrected, corrective actions accepted, certification decision made	9.6.3.2.2
Finished early	New expiry date may keep the old anniversary	9.6.3.2.3
Not finished by expiry	No recommendation, and the certificate is not extended	9.6.3.2.4
Up to 6 months after expiry	Body may restore the certificate if the outstanding work is completed; after that, at least a stage 2	9.6.3.2.5

The month ranges are a typical plan, not a rule. What the standard fixes is the order: audit, then corrections, then decision, then expiry. Book the audit so a major finding still leaves you 60 to 90 days to fix it.

The six-month restoration route in 9.6.3.2.5 is not a grace period. Between expiry and restoration you have no valid certificate. The restored certificate’s effective date is on or after the new decision, and its expiry date stays tied to the old cycle. For a device maker whose customers, distributors or regulators ask for a current certificate, that gap can cost far more than the audit.

How many days an ISO 13485 recertification audit takes

TECH-3-004 clause 6 sets recertification time at about two-thirds of the time a fresh initial audit (stage 1 plus stage 2) would take if it were run now, using your current data. It says plainly that this is “not 2/3 of the original time”. If you have doubled your headcount or added sterile devices since you certified, the starting figure moves with you. The note adds that a recertification audit is unlikely to be less than one audit day. The body’s review of system performance shapes the time but is not counted in it.

For ISO 13485, MD 9.1.4 replaces the general quality table with Annex D, Table D.1. Its figures are higher than the ISO 9001 table at every size, because device audits cover regulatory requirements as well:

Effective personnel	Initial audit days (Table D.1)	Recertification estimate (about 2/3)
1–5	3	2
6–10	4	2.5
16–25	5	3.5
26–45	6	4
66–85	8	5.5
126–175	11	7.5
276–425	13	8.5

The right-hand column is our arithmetic, rounded to the nearest half day as TECH-3-004 clause 2.2.3 directs. It is a starting point, not a quote. Annex D lists what pushes the number up: more than one main technical area, complex devices, critical suppliers whose conformity you cannot evidence, installation at customer sites, poor regulatory compliance, multiple shifts and production lines. Reductions are capped at 20% in total, for example where you do not manufacture, or where the product range or processes have shrunk since the last audit. A scope of distribution or transport services only can be cut by up to 50%.

Three more rules move the figure. Time to audit national or regional regulatory requirements, and dossier reviews, is extra and must be justified so it does not eat into the QMS audit. If the same body certifies you to ISO 9001 as well, Annex D adds at least 25% to the minimum it calculates, whether the audits are integrated or combined. And under MD 9.1.5, sites that design, develop or manufacture devices cannot be sampled on a multi-site certificate, so each one is audited.

A worked example of sizing an ISO 13485 recertification audit: a 40-person maker of non-sterile devices certified at 6 initial days. By year three it has 70 people. The recertification estimate is two-thirds of the 8 days a new initial audit would need at that size, which rounds to 5.5 days, not the 4 days the old headcount would suggest. Expect the quote to reflect that. For what those days cost, see the ISO 13485 certification cost breakdown.

What an ISO 13485 recertification audit must cover

Clause 9.6.3.2.1 requires an on-site audit that addresses three things:

1. the effectiveness of the management system as a whole across the scope of certification;
2. demonstrated commitment to keep it effective and improve it;
3. whether the system is achieving your objectives and intended results.

That makes the ISO 13485 recertification audit a judgement on the cycle, not a snapshot. Before the visit the body reviews the surveillance reports from years one and two (9.6.3.1.2), and the auditor will test whether the problems in those reports stayed fixed. Have the evidence for every finding from the cycle in one place, with the effectiveness check, not just the closure date.

Expect the auditor to look closely at the records that show a device QMS working over time:

• Management review. Every review held across the cycle, with its inputs and outputs, including feedback, complaints, regulatory reporting and changes. Our ISO 13485 management review guide lists the inputs clause 5.6.2 requires.
• Internal audits. Proof the programme covered every process over the cycle, by people who did not audit their own work.
• CAPA. Trend data and effectiveness checks, not just closed records. See ISO 13485 CAPA.
• Adverse events, advisory notices and recalls. MD 9.6.2.2 makes these a mandatory surveillance item. At recertification the auditor sees the whole three-year record at once, and gaps show.
• Changes. New products, new sites, new suppliers of critical processes, and how each one went through your change control.

When a stage 1 comes back

Clause 9.6.3.1.3 says a recertification audit may need a stage 1 when there have been significant changes to the system or to the legal context. TECH-3-007 gives a useful list of what can count as significant in a device business, in MD 9.6.4.2: new ownership, extending into design or manufacturing, a new facility or a moved manufacturing site, a change of sterilisation method or bringing sterilisation in-house, changes to the management representative’s authority, and adding a new device category to the scope. None of these triggers anything on its own, but tell your body about them early. A stage 1 found late can push the whole timeline past expiry. Our ISO 13485 stage 1 audit guide covers what that visit checks.

Findings: what counts as major at an ISO 13485 recertification audit

MD 9.4.5 gives six examples of major nonconformities for ISO 13485:

• a whole required process missing, such as no complaint handling or no training system;
• failure to implement applicable QMS requirements;
• no proper corrective or preventive action when post-market data shows a pattern of product defects;
• products on the market that cause undue risk to patients or users when used as labelled;
• products that clearly do not meet your specifications or regulatory requirements;
• repeated nonconformities from previous audits.

The last one is the recertification trap. A minor finding raised in year one and raised again in year two can come back as a major at the ISO 13485 recertification audit, because the auditor now has the whole history in front of them. Repeats are the cheapest majors to prevent, because you can see them coming in your own audit reports.

For any major, 17021-1 clause 9.6.3.2.2 requires the time limits for correction and corrective action to be set and met before the certificate expires. That deadline is fixed by the expiry date, which is why a late audit is so dangerous. The common “90 days to close a major” figure is not in 17021-1; it is each body’s own procedure, so read your contract.

ISO 13485 recertification audit vs MDSAP and EU MDR renewals

Many device makers hold more than one certificate, and each renews on its own terms.

Scheme	Renewal event	Key renewal rules
ISO 13485 certification	Recertification audit in year three	17021-1 9.6.3; about 2/3 of a fresh initial audit; done before expiry
MDSAP	Complete re-audit in year three	All sites on the certificate audited; stage 1 only for significant changes; technical documentation in the objectives
EU MDR (Annex IX QMS certificate)	Re-assessment on the manufacturer’s application	Certificate valid for up to five years; extended for further periods of up to five years each (Art. 56(2))
FDA under the QMSR	No renewal; inspections	An ISO 13485 certificate is not a substitute for inspection

MDSAP. The FDA-hosted MDSAP audit approach document (we read revision .009, dated 6 August 2024; check for a later revision) calls year three a “complete Re-audit”. It runs under 17021-1 clause 9.6.3 using all applicable MDSAP audit tasks. Like an ISO 13485 recertification audit it judges the whole system, but its objectives explicitly include product and process technologies such as injection molding and sterilization, and adequate technical documentation. The auditor reviews all MDSAP reports from the cycle and follows up every earlier finding “of any kind”. It may be shorter than the initial audit through focused sampling, but it must cover every site recorded on the certificate. For sterile devices, the comprehensive sterility assessment generally falls at the initial and recertification audits.

EU MDR. Notified body certificates follow Article 56(2) of Regulation (EU) 2017/745: valid for the period stated, up to five years, extendable on application after a re-assessment. That is a separate legal certificate on a separate clock. Do not assume your ISO 13485 expiry date and your MDR expiry date line up. See notified body fees under the MDR for the cost side.

FDA. The QMSR, effective 2 February 2026, incorporates ISO 13485:2016 by reference, but FDA said in the final rule that it will not accept an ISO 13485 certificate in place of an inspection. Keep QMSR inspection readiness as its own workstream.

If one body audits you for several schemes, ask in writing how it will combine the year-three visits and whose clock sets the date.

A 90-day ISO 13485 recertification audit preparation plan

When	Action
Day −90 (or earlier)	Confirm audit dates in writing; send updated headcount, sites, device categories and outsourced processes so the body sizes the audit on current data
Day −80	List every finding from the cycle; check each one is closed and effective; look for anything raised twice
Day −70	Tell the body about significant changes so any stage 1 is planned, not discovered
Day −60	Run an internal audit across all processes, using the year-one and year-two reports as the checklist
Day −45	Pull the three-year record on complaints, adverse events, advisory notices, recalls and post-market data trends
Day −30	Hold a management review that looks back over the full cycle and records improvement decisions
Day −14	Check medical device files, supplier controls and process validations for changed products
Audit	Have owners ready for every process; leave room in the calendar for corrective actions after the visit

Our ISO 13485 internal audit guide covers the day −60 step in detail.

If you need to rebuild records before the ISO 13485 recertification audit, the ISO 13485 Toolkit includes 125 editable templates covering procedures, the quality manual, CAPA, management review, internal audit and the records a recertification auditor asks for. It costs $99, as a one-time purchase.

ISO 13485 recertification audit FAQ

How long is an ISO 13485 certificate valid?

Three years under accredited certification. The cycle starts on the certification decision date, and surveillance audits in years one and two keep it valid. The ISO 13485 recertification audit in year three, finished before expiry, renews it for another three years.

What happens if our certificate expires before the recertification audit is finished?

The certificate is not extended (17021-1 9.6.3.2.4). Your body can restore it within six months of expiry if the outstanding recertification work is completed; after that, at least a stage 2 audit is needed. Either way, you are uncertified in the gap.

Can the recertification audit be done remotely?

Clause 9.6.3.2.1 requires an on-site audit. Remote techniques under Global ACI-TECH-3-003 (formerly IAF MD 4) can support parts of it, such as document review. For sterile devices, the MDSAP document says remote activity alone cannot ensure control of sterilization. Agree any remote element with your body in advance.

Is the recertification audit shorter than the initial audit?

Yes, normally about two-thirds of what a fresh initial audit would take today, with a floor of about one audit day. If your organisation has grown, it can be longer than you expect.

Does passing an ISO 13485 recertification audit renew our MDR or MDSAP certificate?

No. An MDR certificate is renewed by notified body re-assessment, and MDSAP has its own year-three re-audit. A single body may combine visits, but each certificate has its own rules and dates.

The short version

An ISO 13485 recertification audit takes place in year three, runs to ISO/IEC 17021-1 clause 9.6.3 with the medical device rules of Global ACI-TECH-3-007, and lasts about two-thirds of a fresh initial audit sized on today’s headcount. The auditor judges the whole cycle, repeat findings can become majors, and every major must be fixed before expiry. Book early, send current data, and clear the cycle’s findings before the auditor arrives.