ISO 9001 vs ISO 13485. What's the Difference, and Which One Does Your Business Need?
If you work with quality systems in South Africa, you have probably heard of both ISO 9001 and ISO 13485.
They sound similar, and they do share some common principles. But they are designed for different purposes, and choosing the right standard for your business matters.
So, what is the difference? Here is a plain-English guide.
ISO 9001 is for almost any business
ISO 9001 is a general quality management standard that can be applied to organisations of almost any size or sector. It is used by manufacturers, service providers, construction companies, schools, professional services firms and many other types of organisations.
At its heart, ISO 9001 is about having a consistent, controlled way of working so that you can meet customer and applicable requirements and continually improve your organisation's performance.
In simple terms:
Understand what your customers and organisation need → control your processes → deliver consistently → monitor what is happening → improve where necessary.
ISO 13485 is specifically for medical devices
ISO 13485 is a quality management standard designed for organisations in the medical device industry.
It applies to organisations involved in activities such as the design, production, installation and servicing of medical devices, as well as other organisations in the medical device supply chain.
Medical device organisations need to show that their processes support the safety, performance and regulatory compliance of their products and activities. That means regulatory requirements, risk management, traceability and process controls play a much more prominent role.
The key differences
| ISO 9001 | ISO 13485 | |
|---|---|---|
| Main focus | General quality management and customer requirements | Medical device quality, safety and regulatory requirements |
| Who is it for? | Organisations across almost any industry | Organisations involved in the medical device life cycle |
| Risk | Risk-based thinking is part of the QMS | More specific medical device risk management requirements |
| Documentation | Documented information is required where applicable | More extensive medical device documentation and records |
| Regulatory focus | General applicable regulatory requirements | Strong emphasis on applicable medical device regulations |
| Traceability | Depends on the organisation and its processes | Specific traceability requirements may apply |
| Continual improvement | Continual improvement is an explicit principle | Focuses on maintaining the effectiveness and regulatory suitability of the QMS |
| Structure | ISO 9001:2015 uses the common ISO management system structure | ISO 13485:2016 uses a different structure and is a stand-alone standard |
ISO describes ISO 13485 as a stand-alone standard with additional requirements for organisations involved in the life cycle of medical devices. Some ISO 9001 elements that are not relevant as regulatory requirements are not included.
1. Regulatory requirements are central
One of the biggest differences is the role of regulation.
ISO 13485 is designed around the regulatory environment of medical devices. In South Africa, this means your QMS needs to address the applicable requirements set by SAHPRA and the relevant medical device regulations.
SAHPRA is now phasing in ISO 13485 certification as a requirement for medical device establishment licences. Since June 2025, manufacturers and distributors (importers) applying for a new licence or renewing an existing one are expected to hold a valid ISO 13485:2016 certificate from a SAHPRA-recognised certification body. SAHPRA aims to have verified this for all licence holders by April 2028 (see SAHPRA's notice).
In practical terms, if your business manufactures or imports medical devices in South Africa, ISO 13485 is no longer just good practice. It is becoming a condition for keeping your licence. The details can depend on your type of establishment, so it is worth checking your specific situation early.
2. Risk management is more specific
ISO 9001 requires organisations to consider risks and opportunities when planning and operating their QMS.
ISO 13485 goes further, with requirements designed around the risks associated with medical devices and their life cycle. For many medical device organisations, ISO 14971 is also an important standard because it provides the framework for medical device risk management.
The goal is not to list risks on paper. It is to make sure risks are considered throughout the relevant stages of the product life cycle and that appropriate controls are in place.
3. There is more medical device documentation
Both standards require organisations to document and control the information needed to run an effective QMS. ISO 13485 adds requirements that relate specifically to medical devices.
Depending on your organisation's activities, this can include documented processes and records for product traceability, complaints, servicing, production controls, design and development, and regulatory reporting.
The documentation you need depends on what your organisation actually does. A medical device manufacturer, for example, will have different requirements from an organisation with a more limited role in the supply chain.
4. Continual improvement works differently
This is one of the differences that is easily overlooked.
ISO 9001 places a strong emphasis on continual improvement of the quality management system and the organisation's performance.
ISO 13485 is more focused on maintaining the effectiveness and suitability of the QMS, while making sure applicable regulatory and customer requirements are consistently met.
That doesn't mean a medical device organisation should never improve. It means improvement needs to happen within the context of keeping the QMS compliant and effective.
5. The standards have different structures
If you already have an ISO 9001 system and are moving into medical devices, you may be able to reuse some of your existing processes and documentation.
However, ISO 13485:2016 does not follow the same clause structure as ISO 9001:2015. Your existing ISO 9001 documentation will need to be assessed against the requirements that apply to your medical device activities.
So, which one does your business need?
The answer depends on what your organisation does.
If your business has no involvement with medical devices, ISO 9001 may be the right quality management standard to consider.
If your organisation manufactures or imports medical devices in South Africa, ISO 13485 is the standard to work towards. SAHPRA is phasing in ISO 13485 certification as a requirement for establishment licences, so starting early gives you time to get ready.
If you already have ISO 9001 and are moving into medical devices, you don't have to throw everything away and start again. Your existing QMS can be a useful foundation, but you will need to identify and address the additional medical device and regulatory requirements that apply to you.
Where should you start?
The best place to start is with a gap assessment. A gap assessment helps you understand
- where your current QMS stands
- which requirements you already meet
- where the gaps are
- which processes need to be developed or strengthened
- what documentation and records are required
- which areas to prioritise
That way you can focus your time and resources where they are actually needed, instead of rewriting processes that already work.
At Panthera QMS Solutions, we believe quality systems should work for your business, not become a mountain of paperwork sitting on a shelf.
If you would like help working out which standard is right for your organisation, understanding your current gaps, or planning your path towards ISO 9001 or ISO 13485, get in touch through our Contact page. We'd be happy to help you make sense of the requirements and find a practical way forward.
Jana Swanepoel
Panthera QMS Solutions
Comments
Post a Comment