Last updated: October 2026
ISO 13485:2016 is the international standard for quality management systems in the medical device sector. It sets requirements, audited by an independent certification body, for how an organization controls documents, purchasing, production, traceability, nonconforming product and corrective action.
Device OEMs ask their machining suppliers for it for a practical reason. Their own quality system has to control suppliers (ISO 13485:2016 clause 7.4), and in the U.S. that system now falls under 21 CFR Part 820 (QMSR), which incorporates ISO 13485:2016 by reference. A supplier that already works under ISO 13485 speaks the same language as the OEM’s supplier quality team: the same records, the same change rules, the same way of handling a bad lot. For a machined part, the standard matters less as a certificate on the wall than as what it changes on the shop floor.
What ISO 13485 requires from a machining supplier
A CNC shop makes parts the same way with or without the standard: the machines, tools and programs do not change. What changes is how each step is controlled and recorded.
| Requirement | ISO 13485:2016 clause | What it means on a machining floor |
|---|---|---|
| Review of requirements | 7.2.2 | Drawing, revision, material, finish, quantities and documents checked before an order is accepted |
| Document control | 4.2.4 | Only the released drawing revision reaches the machine; obsolete revisions are withdrawn |
| Purchasing | 7.4 | Bar, plate and outside services bought from evaluated suppliers, with material certificates |
| Outsourced processes | 4.1.5 | Passivation, heat treatment or plating performed by another organization stays under the shop’s control and records |
| Production control | 7.5.1 | A traveler with routing, programs, fixtures, tools and inspection steps for each part number |
| Process validation | 7.5.6 | Processes whose result cannot be fully verified afterwards (cleaning, passivation per ASTM A967) are validated, often through IQ/OQ/PQ |
| Identification and traceability | 7.5.8, 7.5.9 | The material heat or lot number follows the part from bar cut-off to shipment |
| Product verification | 8.2.6 | First article inspection (FAI), in-process checks and final inspection, with records |
| Nonconforming product | 8.3 | Suspect parts segregated, documented on an NCR and dispositioned |
| Corrective action | 8.5.2 | Root cause, action and an effectiveness check, often written up as an 8D |
| Records | 4.2.5 | Inspection, material and process records kept for the period the customer requires |
Two of these do most of the work for repeat orders. Process validation means the shop has proven that the approved process produces conforming parts, so lot 20 is made the same way as the first article. Traceability means that if a material or process problem appears, the affected lots can be found from the records rather than guessed.
How ISO 13485 shows up on your order
For the buyer, the standard becomes a set of documents tied to each part number and lot. We supply them on request:
- Certificate of Conformance (CoC) with every lot, stating conformance to the drawing revision and purchase order.
- Material certificates (MTR) traced to the heat or lot used. Our article on material certificates and MTRs explains what to check on them.
- FAI report on the first article and after a revision or process change.
- Inspection records on critical dimensions, often CMM reports.
- Finishing certificates when the drawing calls for passivation, electropolishing or marking.
- NCR and 8D reports when something goes wrong and the quality agreement asks for them.
At MedCNCParts, these documents are supplied on request, and this is how our ISO 13485 certified machining works, under quality systems certified to ISO 13485 and ISO 9001; the steps from incoming material to shipment are described in our quality control system. Readers sourcing for a contract manufacturer will find the split of responsibilities under ISO 13485 contract manufacturing of components.
What the standard does not do is set tolerances. It does not make a machine more accurate. It makes the measurement, calibration and records around each tolerance controlled, so the same result can be shown on every lot.
ISO 13485 vs ISO 9001
The two standards share much of their vocabulary, and many machining suppliers hold both. They are not equivalent.
| Topic | ISO 9001:2015 | ISO 13485:2016 |
|---|---|---|
| Focus | Customer satisfaction and continual improvement, any industry | Meeting regulatory requirements and keeping the QMS effective, medical devices |
| Risk management | Risk-based thinking, general | Risk management required across product realization |
| Documentation | Extent decided by the organization | Specific documented procedures, files and records required |
| Process validation | General requirement | Explicit validation of processes whose output cannot be fully verified |
| Traceability | Where the customer or law requires it | Required, with extra requirements for implantable devices |
| Sterile devices | Not addressed | Specific requirements for sterile products and sterilization validation |
For a machining supplier, the practical difference is the paper trail. An ISO 9001 shop may make excellent parts, but it is not required to keep lot-level traceability, validated special processes and controlled change records. An ISO 13485 shop is, and a supplier quality engineer can audit it against those requirements. We hold both certificates.
Common ISO 13485 mistakes in machining
Most findings in supplier audits come from the same few gaps:
- Uncontrolled drawing revisions. A superseded revision stays at the machine or in the CAM file, and parts are made to it.
- Unvalidated cleaning or passivation. The process runs, but nobody has shown it gives a consistent result. Knowing the difference between electropolishing vs passivation helps decide what the drawing should call out, and what has to be validated.
- Traceability lost after bar cut-off. Material arrives with a certificate, but once the bar is cut, the heat number no longer follows the blanks.
- Weak NCR and CAPA closure. Corrective actions are closed without checking that they worked, and the same defect returns two lots later.
- Uncontrolled subcontractors. Finishing or heat treatment is given to another company without supplier evaluation or certificates per lot.
- Changes without notification. A new tool path, fixture, material source or subcontractor is introduced without telling the customer, whose own validation assumed the old process.
Buyers make mistakes too: accepting “compliant” as if it meant “certified”, never reading the certificate scope, or treating the certificate as a guarantee of every part. Our guide on how to choose a medical CNC machining supplier lists the checks to run before a first order.
What ISO 13485 certification costs a supplier
Certification has a cost, and it is paid every year, not once. For a machining supplier the cost drivers are:
- Building and maintaining the QMS: procedures, forms, document control and record systems.
- Training operators, inspectors and planners on the procedures that apply to them.
- Certification body audits: the initial certification audit, annual surveillance audits and a recertification audit every three years.
- Validation work for special processes and for new or changed processes.
- Inspection time, calibration and record keeping on every lot.
For a buyer, this overhead shows up in the quote. A certified supplier prices in documentation and inspection that an uncontrolled shop skips; in return, the supply is documented and auditable. Our article on cost factors in medical CNC machining shows where inspection and documentation sit among the other price drivers.
ISO 13485 and 21 CFR Part 820 (QMSR)
Since February 2, 2026, 21 CFR Part 820, the Quality Management System Regulation (QMSR), incorporates ISO 13485:2016 by reference for finished device manufacturers selling in the U.S. The OEM’s quality system is now built on ISO 13485 vocabulary, and its supplier audits use it.
The regulation applies to the device manufacturer. A component supplier is reached through that manufacturer’s purchasing controls: supplier evaluation, quality agreements, incoming inspection and monitoring. EU OEMs work the same way under (EU) 2017/745 (MDR). In both cases, a supplier that already works under ISO 13485 fits into those controls with little translation.
ISO 13485 does not make a part approved or cleared. The device is cleared or approved through the OEM’s own submission (510(k), PMA or CE marking), and the OEM owns design validation, ISO 10993 biological evaluation and sterilization validation.
Request a quote for your ISO 13485 machined components
Upload your 3D model and 2D drawing, and tell us the material, quantities (samples, pilot build, annual repeat volume) and the documentation you need (FAI, CoC, material certificates, CMM report), all supplied on request. NDA available on request. Lead time and documentation are confirmed with the quote.
Upload drawing & request quote
FAQ
Is ISO 13485 equivalent to ISO 9001?
No. ISO 13485 follows a similar structure but adds medical device requirements on risk, validation, traceability and regulatory documentation, and does not emphasize continual improvement in the same way.
What are common ISO 13485 mistakes?
Uncontrolled drawing revisions, unvalidated special processes such as cleaning or passivation, material traceability lost after bar cut-off, and CAPAs closed without an effectiveness check.
How much does ISO 13485 cost?
For a supplier, the cost comes from building the QMS, validation work, training and recurring certification body audits. For a buyer, it shows up in the quote as a documented, auditable supply.
Does a machining supplier need ISO 13485?
Not legally in most cases. OEMs usually require it, or equivalent controls, to satisfy their own purchasing controls under ISO 13485 clause 7.4 and 21 CFR Part 820 (QMSR).
MedCNCParts manufactures components to customer specifications; it does not design or market medical devices.
