Key Takeaways
- ISO 9001:2026 is built around customer satisfaction and continual improvement, while ISO 13485:2016 is built around keeping medical devices safe and effective and meeting regulatory requirements.
- ISO 13485 did not adopt the high-level structure used by ISO 9001, so the clauses do not line up one for one.
- Risk management, traceability, documentation and regulatory reporting are all stricter under ISO 13485.
- The buyer decides which standard a machine shop needs. A medical customer asks for ISO 13485; other customers generally ask for ISO 9001.
- A shop that serves both kinds of customers can run one integrated system and hold both certificates.
Does your plant need ISO 9001, ISO 13485 or both? The ISO 13485 vs ISO 9001 differences come down to who the system is written to protect: ISO 9001 protects the customer's satisfaction and the plant's ability to improve, while ISO 13485 protects the patient and the regulator's trust in the device.
Illustrative example: A machine shop that machines housings for an instrument maker feels that difference the first time a customer sends a supplier questionnaire.
The current edition of ISO 9001 is ISO 9001:2026, published in September 2026, and many certified organizations are still on ISO 9001:2015 during the three-year transition. ISO 13485 remains on the 2016 edition. This article compares the two as they apply to a manufacturing plant and gives a way to decide.
Core Philosophy: Continuous Improvement vs. Product Safety and Efficacy
ISO 9001 asks whether the plant consistently delivers products that meet customer and legal requirements, and whether it gets better over time. The official ISO 9001 page describes the standard as a requirements document for quality management systems that any organization can use. It is deliberately flexible, so a stamping plant and a software firm can both apply it.
ISO 13485 starts from a narrower and heavier premise. The system exists so that a medical device is safe and performs as intended, and so that the manufacturer can show regulators it does. Improvement still matters, but it is secondary to control.
That shift in purpose changes how an auditor reads the same evidence:
- Flexibility versus prescription. ISO 9001 lets the plant decide how much documentation it needs. ISO 13485 states many procedures and records that must exist, whatever the plant's size.
- Exclusions. ISO 9001 allows a plant to treat a requirement as not applicable if it does not affect conformity. ISO 13485 limits exclusions to specific cases, such as design and development when the organization does not design, and the reason must be recorded.
- Regulatory focus. ISO 13485 asks the organization to identify its role under applicable regulations and to keep records that prove compliance.
High-Level Structure: Why ISO 13485 Did Not Adopt Annex SL
ISO 9001, ISO 14001:2026 (currently in its transition period from ISO 14001:2015) and ISO 45001:2018 share a common high-level structure, which is why a plant can combine them without translating clause numbers. ISO 13485:2016 did not adopt that structure. Its authors kept an older layout because regulators and device makers already rely on it, and because the standard is written for regulatory use rather than for easy integration.
In practice, this means the clause numbers do not match. Management review sits in clause 5.6 of ISO 13485:2016 and clause 9.3 of ISO 9001:2015. Internal audit is clause 8.2.4 in one and clause 9.2 in the other. A shop running both systems needs a simple cross-reference table so staff and auditors can find the same requirement in each standard.
Key Consideration: Build the cross-reference once and keep it with the quality manual. It saves hours in every audit and stops a clause from falling between the two systems.
Clause-by-Clause Comparison: Documentation, Risk, and Process Control
The table below compares the points a plant usually feels first. Cells are short on purpose; the sections after it explain the detail.
| Area | ISO 9001 | ISO 13485:2016 |
|---|---|---|
| Purpose | Customer satisfaction and improvement | Device safety, performance and regulatory compliance |
| Structure | Common high-level structure | Own structure, no shared layout |
| Documentation | Plant decides what it needs | Defined procedures plus a medical device file |
| Risk | Risk-based thinking across the system | Risk management in product realization |
| Traceability | Required where it is a requirement | Required, with more detail for implantables |
| Feedback | Monitor customer satisfaction | Feedback and complaint handling processes |
| Regulatory reporting | Not part of the standard | Notifying authorities when criteria are met |
Documentation and the Medical Device File
ISO 9001:2015 speaks of documented information and leaves its extent to the organization. ISO 13485:2016 requires a quality manual, documented procedures for listed activities and, under clause 4.2.3, a medical device file for each device type or family. That file holds the specifications, the manufacturing and inspection instructions and the records that show the device was made to them.
For a contract machine shop making parts for a device maker, the file is usually held by the customer. The shop still has to provide the records the customer's file depends on, and it has to control changes to drawings and processes tightly.
Risk Management and ISO 14971 Alignment
ISO 9001 expects risk-based thinking: the plant identifies what could go wrong with its processes and acts in proportion. ISO 13485:2016 asks for risk management throughout product realization, which in practice points the plant at ISO 14971, the international standard for applying risk management to medical devices.
The standard itself does not force a supplier to run the full device risk file. A component supplier is normally asked to support the device maker's analysis by reporting known hazards, process variation and non-conforming material quickly. A device manufacturer carries the whole file.
Traceability and Process Control
Traceability under ISO 9001:2015 applies when the customer or a regulation asks for it. ISO 13485:2016 treats traceability as a core control. Clause 7.5.9 requires procedures for it, and the records must let the organization follow a component back to its material lot and forward to the customer.
Process control is stricter too. Processes whose output cannot be fully verified by later inspection must be validated, and the validation must be documented. Cleaning, sterilization and special processes such as welding or passivation are common examples. A machine shop that passivates stainless parts in-house should expect to show validation records.
Customer Satisfaction vs. Regulatory Reporting Mandates
ISO 9001 asks the plant to monitor customer perception, which is where on-time delivery, complaints and survey feedback come in. The result feeds management review and improvement.
ISO 13485 keeps feedback and complaint handling but adds a regulatory layer. Complaints must be investigated, and where criteria in the applicable regulations are met, the manufacturer must notify the authority. In Canada that authority is Health Canada, and the device manufacturer carries most of the reporting duty. A supplier's job is to alert the customer fast and keep records that let the customer investigate.
Important: A complaint under ISO 9001 is an input to improvement. A complaint under ISO 13485 may also be a reportable event with a deadline, so the process must show who decides and how quickly.
Compare the two mindsets side by side:
- ISO 9001 question: Did the customer get what they ordered, on time, and what did the plant learn from any miss?
- ISO 13485 question: Could this nonconformity have reached a patient, and has the right authority been told if the rules require it?
The medical device manufacturer's roadmap to ISO 13485 certification in Canada covers the regulatory side in more depth for companies that make finished devices.
Decision Matrix: Evaluating Your Customer Base and Market Entry Goals
The choice rarely comes from the standard itself. It comes from the customer list and the markets the plant wants to enter. Use the questions below as a framework.
- Does a customer ask for ISO 13485 in a purchase order or supplier agreement? If so, the answer is already made, and the plant should plan for certification.
- Does the plant make finished medical devices, or only parts and services for them? A finished-device manufacturer selling in Canada must meet the Medical Devices Regulations, which rely on an ISO 13485-based certificate for most device classes. A parts supplier faces a customer requirement, not a regulatory one.
- Does the plant serve other sectors too? If automotive, aerospace or general industrial customers make up most of the revenue, ISO 9001 or a sector standard may still lead.
- Is medical work a planned growth area? A plant that wants to enter that market in the next few years can begin building ISO 13485 habits now, such as lot control and change records.
A plant with no medical customers and no plan to pursue them gains little from ISO 13485 and should concentrate on ISO 9001. A plant with medical customers should talk to those customers before starting, because some accept ISO 9001 from lower-risk component suppliers and others do not.
The ISO 9001 service page and the ISO 13485 service page describe what each project involves, and the healthcare and medical devices industry page shows how the work fits that sector.
Dual Certification: How Machine Shops Integrate Both Quality Systems
A shop can certainly hold both certificates. Because the standards do not share a structure, the usual approach is to build one process-based system and map it to each standard. The shop writes its procedures around how work flows, from quote review to shipping, and then records which clauses of each standard each procedure meets.
Illustrative example: A family-owned machine shop makes brackets for industrial customers and, separately, a small run of housings for a diagnostic device. The shop keeps one document control procedure, one nonconformance procedure and one internal audit program. It adds a medical work instruction set with lot traceability and a change notification step that applies only to the medical jobs.
Several practices keep a dual system manageable:
- Apply the stricter rule to shared processes. If document control meets ISO 13485, it will meet ISO 9001 as well.
- Separate the medical product family. Lot records, validation files and change controls for device work stay identifiable and complete, even if general work uses lighter records.
- Audit both together. One internal audit program with checklists for each standard avoids duplicate effort.
- Choose one certification body for both. Many accredited bodies audit to both standards, and combined audits cut time on site.
Certification bodies in Canada are accredited by the Standards Council of Canada, and a certificate's validity can be checked in the IAF CertSearch database. Customers often do this before awarding work.
Frequently Asked Questions
Can a machine shop maintain both ISO 9001 and ISO 13485 certifications simultaneously?
Yes. Many shops do. The two standards can sit on one process-based system, with a cross-reference between their different clause structures. The shop usually passes the stricter ISO 13485 requirements into shared processes so one procedure serves both.
Is ISO 13485 certification mandatory for tier-2 medical component suppliers in Canada?
The regulation focuses on device manufacturers, not on every supplier in the chain. A tier-2 component supplier is usually not required by law to hold ISO 13485, but its customer may require it through supplier terms. Check the purchase agreement and the customer's supplier quality manual.
What is the single biggest operational change when moving from ISO 9001 to ISO 13485?
For many shops, it is often the discipline around records and change. Every lot, process validation and change needs a documented trail that a regulator could follow years later. Staff who are used to flexible records need training and a clear owner for each record type.
Does ISO 13485 require formal ISO 14971 risk management integration?
ISO 13485:2016 requires documented risk management in product realization but does not name a single method. ISO 14971 is the recognized standard for medical device risk management, and device manufacturers and their auditors expect it. A component supplier mainly supports the customer's file with hazard and process information.
How does the audit process differ between ISO 9001 and ISO 13485 registrars?
ISO 13485 audits look harder at regulatory compliance, validation, traceability and complaint handling. Auditors need medical device competence, and in Canada, device manufacturers are audited under a program recognized by Health Canada. ISO 9001 audits focus more on process effectiveness and customer outcomes.
Choosing between the two standards, or planning for both, is easier with someone who has seen how each plays out on a shop floor. ISO Certification Consultants work with Ontario manufacturers to compare customer requirements, existing systems and audit readiness, then build a plan that fits. To talk through your own customer list and next steps, book a consultation.
