ISO 13485:2016

ISAO, or a certification body accredited for ISO 13485, audits the system in two stages: first the scope, the quality manual and procedures, and the regulatory requirements the organisation has identified; then, on site, whether design, production, supplier control, complaint handling and other processes work in practice. The scope must say which activities are covered, for example whether design and development is included, and for which devices. Certification is not a regulatory approval: device regulations in many markets have their own conformity assessment routes, carried out by bodies designated for that purpose. Certificates are normally valid for three years, with surveillance audits at least once a year and a recertification audit before expiry. ISAO carries out this certification itself, and also accredits certification bodies to do it. Every certificate ISAO issues, and every certificate issued under ISAO accreditation, is recorded on the public register.

• Identifying and meeting the regulatory requirements for the devices and markets concerned
• Risk management applied throughout product realisation
• Documented control of design and development, including verification, validation and transfer to production
• Control of suppliers and outsourced processes
• Traceability, with additional controls for sterile and implantable devices
• Complaint handling, reporting to regulators, and corrective and preventive action
• Validated processes, and records kept for at least the lifetime of the device

• Enter the certificate number or verification code at Verify a certificate, or scan the QR code on the certificate. The record shows the certificate's status today, for example valid, suspended, withdrawn or expired.
• Compare the organisation name, scope and sites on the record with the copy you were given. Check the activities (for example design, manufacture, distribution or servicing) and the device types named in the scope.
• Check who issued the certificate, as named on the record. Where a certification body accredited by ISAO issued it, the record shows the status of that accreditation and its accreditation number, and says so if the accreditation did not cover ISO 13485:2016 when the certificate was issued.
• If the certificate is not on the register, ISAO cannot confirm it: it may have been issued under another accreditation, or a detail may be wrong. Ask the issuing body, and report a concern if something does not look right.