ISO 13485 Surveillance Audit: The Complete 2026 Guide

An ISO 13485 surveillance audit is the visit your certification body makes in each of the two years between your initial certification and your recertification, to confirm the quality management system still works and the certificate should stand. It runs for roughly a third of your initial audit days, it samples the system rather than covering all of it, and it carries one mandatory check that an ISO 9001 audit does not have: what you did about adverse events, advisory notices and recalls.

This guide explains the rules behind the audit, how many days to plan for, what the auditor must look at, and how it differs from the EU notified body and MDSAP audits that manufacturers often run alongside it. It assumes you already hold a certificate. If you are still working toward one, start with how ISO 13485 certification works and the stage 1 audit.

Which rules govern an ISO 13485 surveillance audit in 2026

The standard you are audited against does not set the audit schedule. ISO 13485:2016 tells you how to run the system. Three other documents tell the certification body how to audit it:

• ISO/IEC 17021-1:2015 sets the general rules for every management system certification, including the three-year cycle and the surveillance content.
• Global ACI-TECH-3-007 adds the requirements specific to medical devices.
• Global ACI-TECH-3-004 sets the audit-time rules, with an ISO 13485 table supplied by TECH-3-007.

The second document is the one most guides have not caught up with. For years the medical device rules were published as IAF MD 9, last issued as Issue 5 on 20 November 2023. When the International Accreditation Forum’s role moved to Global ACI, the text was reissued as Global ACI-TECH-3-007, with an issue date of 10 July 2026 and an implementation date of 28 August 2026. Its scope clause says the text was reformatted without substantive change, so an audit plan or contract that still cites MD 9 is out of date on the number, not on the requirement. Clause numbering such as “MD 9.6.2.2” carries over.

The standard itself is stable. The ISO 13485:2016 page on iso.org shows the third edition as reviewed and confirmed in 2025, at stage 90.93, with no amendment listed in its life cycle. So an ISO 13485 surveillance audit in 2026 has no edition transition attached to it. That is a real difference from ISO 9001, where the 2026 edition’s transition audit can be bundled into a surveillance audit and the 2015 certificates lapse on 30 September 2029.

ISO 13485 surveillance audit timing: the three-year cycle

Clause 9.1.3.2 of ISO/IEC 17021-1 sets out the program: a two-stage initial audit, a surveillance audit in each of years one and two, and a recertification audit in year three. The first cycle starts at the certification decision, not at the end of the stage 2 audit. Two timing rules follow from clause 9.1.3.3:

• Surveillance happens at least once a calendar year, except in a recertification year.
• The first surveillance audit falls no more than 12 months after the certification decision date.

The trap is the date you count from. It is not the stage 2 closing meeting. Read the decision date on your certificate or the decision letter and work back from there.

Event	Worked example	Rule
Certification decision	10 March 2026	Cycle starts here (9.1.3.2)
First surveillance audit	No later than 10 March 2027	Within 12 months of the decision (9.1.3.3)
Second surveillance audit	During calendar year 2028	At least once a calendar year (9.1.3.3)
Recertification audit	Planned to finish before expiry in 2029	Timely renewal before expiry (9.6.3.1.1)

Booking is your job as much as the auditor’s. Not allowing a surveillance audit at the required frequency is a listed ground for suspension under clause 9.6.5.2. Suspended certification is temporarily invalid under clause 9.6.5.3, and a note to clause 9.6.5.4 says suspension would in most cases not exceed six months. If the issue is not resolved, the certification is withdrawn or its scope reduced.

How many days an ISO 13485 surveillance audit takes

This is where medical devices differ most from ISO 9001. TECH-3-007 clause MD 9.1.4 applies TECH-3-004 but replaces its quality table with Table D.1 in its own Annex D. Table D.1 gives more days at every size band. Clause 5 of TECH-3-004 then sets annual surveillance at about one third of the initial audit time (stage 1 plus stage 2), with a note that less than one audit day is unlikely. Clause 2.2.3 rounds decimals to the nearest half day.

Annex D is headed “initial audit only”, which leads some readers to think it has nothing to do with surveillance. It does, because it is the number the one-third rule works from. The table below applies that arithmetic. These are our calculated starting points, not figures printed in the documents, and your body must adjust them.

Effective personnel	ISO 13485 initial days (Table D.1)	ISO 13485 surveillance, about 1/3	ISO 9001 surveillance, for comparison
1-5	3	1	1
6-10	4	1.5	1
11-15	4.5	1.5	1
16-25	5	1.5	1
26-45	6	2	1.5
46-65	7	2.5	1.5
66-85	8	2.5	2
86-125	10	3.5	2.5
126-175	11	3.5	2.5
176-275	12	4	3

Annex D lists what moves the initial figure, and so the third taken from it:

• Upward: more than one main technical area, complex devices, critical suppliers or own-label products where the manufacturer cannot show enough evidence, installation on customer premises, poor regulatory compliance, and multiple shifts or production lines.
• Downward, by no more than 20% in total: no manufacturing in scope (such as wholesale, retail, transport or equipment maintenance), or a reduced product range or reduced design or production processes since the last audit.
• Distribution or transportation services only: up to 50% less in total.

Four further points tend to surprise people when the quote arrives:

• Regulatory time is extra. MD 9.1.4 says time to audit national or regional regulatory requirements and dossier reviews is additional and must be justified, so that it does not eat into the audit of the system.
• Audit time is not only time in your building. It includes planning, document review and report writing, as well as on-site or remote auditing.
• Combining with ISO 9001 adds at least 25%. Annex D sets that minimum on top of the Annex D days, whether the audit is integrated or combined.
• Some sites cannot be sampled. MD 9.1.5 rules out multi-site sampling for sites involved in design, development and manufacturing, so a group with several such sites should not budget as if a sample will do.

The body must also review the planned time at every audit, using updated client data. For how these days feed into fees, see our ISO 13485 certification cost breakdown.

What an ISO 13485 surveillance audit must cover

Clause 9.6.2.2 of ISO/IEC 17021-1 describes surveillance audits as on-site audits that need not be full system audits, and lists eight areas to review each time. MD 9.6.2.2 adds a ninth for medical devices. Here is how each one lands on ISO 13485:2016 and what to have ready:

Mandatory review area	ISO 13485 clause	Evidence to have ready
Internal audits and management review	8.2.4, 5.6	Audit schedule and reports since the last visit; review minutes with outputs and actions
Actions on nonconformities from the previous audit	8.5.2	Closed corrective actions with proof they worked
Complaint handling	8.2.2	Complaint log, investigations, decisions on whether to report
Effectiveness against your objectives	5.4.1, 8.4	Quality objectives and the trended data behind them
Progress on planned improvement	8.5.1	Improvement actions and their status
Continuing operational control	7.4, 7.5	Supplier monitoring, validation status, production and release records
Review of changes	4.1.4, 7.3.9	Change records for processes, sites, suppliers and designs
Use of marks and references to certification	Certification body rules	Website, brochures and labels showing correct use
Adverse event notifications, advisory notices and recalls (MD 9.6.2.2)	8.2.3, 8.3.3	Vigilance reports filed, field actions taken, and how they fed CAPA

That last row is what makes an ISO 13485 surveillance audit feel different. Expect the auditor to follow a live post-market trail from a complaint to a reporting decision, then to a corrective action, and sometimes to an advisory notice. If those records sit in a regulatory affairs folder the quality team cannot open, you will find out in the room. Our guides to ISO 13485 complaint handling and ISO 13485 CAPA cover what those records should show.

One wording point is worth knowing. The eight areas come from a generic standard, so they talk about continual improvement. ISO 13485 clause 8.5.1 is framed around keeping the system suitable, adequate and effective, because the standard is written for regulatory consistency. Answer that row with changes you made to maintain effectiveness, and do not invent an improvement program for the audit.

Findings: what counts as major at an ISO 13485 surveillance audit

MD 9.4.5 gives examples of major nonconformities, for which the body must accept and verify the effectiveness of both correction and corrective action. In summary:

• A required process is missing entirely, such as no complaint handling or training system.
• Applicable requirements are not implemented.
• No appropriate corrective and preventive action, when post-market data shows a pattern of product defects.
• Marketed products create undue risk to patients or users when used as labeled.
• Products clearly fail your specifications or the regulatory requirements.
• Repeated nonconformities from previous audits.

The last example is the one that catches established companies. A minor finding that comes back at the next ISO 13485 surveillance audit can be raised as a major, so a corrective action that only fixed the instance is a risk you are carrying forward. Check every finding from the last report before the auditor does.

On closure time, be careful with what you read. ISO/IEC 17021-1 has a before-expiry deadline for major findings in its recertification clause, but no fixed number of days for surveillance. A figure such as 90 days comes from your certification body’s own procedure. Read that procedure and your contract, then plan around them.

Short-notice and unannounced audits under TECH-3-007

A planned surveillance program can be interrupted. MD 9.6.4.2 says short-notice or unannounced audits may be required when:

• External factors apply, such as devices in scope pointing to a possible significant system deficiency, or significant safety and performance information reaching the body.
• Significant changes occur that could affect the body’s decision on regulatory compliance.
• Public law or a regulatory authority requires it.

The clause gives examples of changes that could be significant, while saying none should automatically trigger an audit: new ownership, a new or relocated manufacturing site, a change to a special process such as moving sterilization in-house, a change to the management representative’s authority, and a new device category in scope. Changes in standards and regulations, and post-market surveillance or vigilance matters, are also named. The body can also act on justifiable concerns about corrective actions or compliance.

The practical step is to add “does the certification body need to know?” to your change control form. Telling the body early gives it the chance to handle the change at the next ISO 13485 surveillance audit, instead of finding it there.

ISO 13485 surveillance audit vs notified body and MDSAP audits

Medical device manufacturers can face three different surveillance regimes, plus an FDA inspection that is not a surveillance audit under any certification scheme. They are easy to mix up in a planning meeting.

Regime	Who audits	Frequency	What it supports
ISO 13485 certification	Accredited certification body	At least once a calendar year, except the recertification year; three-year cycle	A voluntary ISO 13485 certificate
EU MDR, Annex IX	Notified body	At least every 12 months (3.3); unannounced at least once every five years (3.4); certificates valid up to five years (Art. 56)	CE marking under a legal conformity route
MDSAP	Recognized auditing organization	Partial surveillance in years one and two, complete re-audit in year three	One audit used by participating regulators
FDA inspection under the QMSR	FDA investigators	Set by FDA	US regulatory oversight; no certificate results

EU MDR. Annex IX of Regulation (EU) 2017/745 has the notified body check both the approved system and the post-market surveillance plan, on your premises and at suppliers where appropriate. Its unannounced audits may be combined with a periodic surveillance visit or run in addition, and include testing a sample of devices or of the manufacturing process. See notified body fees under the MDR for what this costs.

MDSAP. The MDSAP audit approach document (we read revision .009, dated 6 August 2024; check for a later revision) builds on the same 17021-1 clause. Each surveillance audit need not cover everything, but all requirements must be audited across the three-year cycle, and if the first visit takes in design and development, the second should take in production and service controls, or the reverse. For sterile devices, surveillance may be limited to the validated parameters, monitoring and release when nothing significant has changed, and remote activity alone cannot ensure control of sterilization.

FDA. The QMSR, effective 2 February 2026, incorporates ISO 13485:2016, which is why people assume the certificate helps at inspection. It does not. In the final rule’s preamble, FDA says an ISO 13485 certificate will not be accepted as a substitute for any oversight process, including an inspection. MDSAP reports are different, because FDA may accept them in place of routine inspections. A passed ISO 13485 surveillance audit says nothing to an FDA investigator, so keep QMSR inspection readiness as its own workstream.

If one body audits you for more than one scheme, ask how it will combine the visits. MD 9.3.1 lets a body that has already audited a scheme which includes or goes beyond ISO 13485, such as the European device regulations, avoid repeating those elements if it can show all the requirements were met. That clause sits in the initial certification section, so ask your body to confirm how it applies at surveillance. Also don’t confuse the audit with post-market surveillance, which is your own monitoring of devices on the market. The two overlap mainly at complaint handling and the ninth review area.

A 60-day ISO 13485 surveillance audit preparation plan

This is a practical sequence we suggest, not a requirement in any of the documents. Shorten it if your system is already in steady use.

• 60 days out: Confirm the date against the 12-month and calendar-year rules. Update your certification body on headcount, sites, devices and scope changes, since it needs current data to set the time.
• 45 days out: Re-read the last audit report and pull the evidence that each finding was closed and stayed closed.
• 30 days out: Finish any due internal audits and hold a management review with real data on complaints, regulatory reporting and audit results.
• 15 days out: Walk one complaint from intake to closure, and one design or process change from request to release. Fix anything the trail exposes.
• 5 days out: Check marks and certification claims on your website and labels. Brief process owners and name a guide who knows where records live.
• After the audit: Enter each finding into your CAPA process and check the deadline in your body’s procedure on day one.

Our ISO 13485 Toolkit gives you 125 editable templates in Microsoft Office format, including a CAPA register and a complaint register of the kind this audit samples. It costs $99 and saves drafting from a blank page, though the records still have to come from your own system running.

ISO 13485 surveillance audit FAQ

How often is an ISO 13485 surveillance audit required?

At least once a calendar year, except in a recertification year, and the first must fall within 12 months of the certification decision date. Your body can plan more often where there is a reason to.

Can an ISO 13485 surveillance audit be done remotely?

Not as a simple swap. ISO/IEC 17021-1 describes surveillance audits as on-site audits, while TECH-3-007 counts audit time spent using on-site, remote or combined methods. Clause 9.6.2.1.2 also expects on-site auditing as part of surveillance. Expect some remote work at most, and ask your body what it permits and what evidence it needs under Global ACI-TECH-3-003, the ICT document.

Does a notified body audit replace the ISO 13485 surveillance audit?

Not automatically. They serve different certificates under different rules, although one organization may hold both roles and combine the visits. Get the arrangement in writing, and confirm that both certificates’ requirements are met and reported.

What happens if we fail a surveillance audit?

There is no pass or fail grade as such. Findings are raised, and major ones need accepted correction and corrective action, verified for effectiveness. If you don’t resolve them within your body’s limits, or you fail certification requirements, the body can suspend the certificate, and it may then be withdrawn or reduced in scope.

The short version

An ISO 13485 surveillance audit happens once a calendar year in years one and two of the cycle, within 12 months of the certification decision the first time, for about a third of your Table D.1 days. Regulatory time comes on top. The auditor samples eight standard areas plus your adverse event, advisory notice and recall actions, and a repeated finding can turn into a major. Rule citations should now read Global ACI-TECH-3-007 instead of IAF MD 9, the standard’s edition has not changed, and neither an EU notified body visit nor an FDA inspection stands in for this audit by default.