Quality
There is no list price for ISO 13485 certification, and anyone who quotes one without asking about your company is guessing. The cost is made up of three parts: what the certification body charges, what your own team puts in, and any consultancy support you use. This guide explains each part, what moves it up or down, how long the process takes and how UK device companies keep the total under control.
Written by the team that prepares device companies for certification-body audits. No hidden fees, no invented numbers.
ISO 13485 certification is not a product you buy. It is the outcome of building a quality management system (QMS) that meets the standard, then having an accredited certification body audit it and confirm that it does. The fee you pay the certification body is only the visible part of the cost, and usually not the largest.
The biggest variable is where you are starting from. A company with a mature ISO 9001 system and a quality manager in post has a short route. A start-up with a prototype and no documented processes has a longer one, and most of its cost is the effort of building the system rather than the audit itself.
The second variable is complexity. Sterile devices, implantables, software, multiple sites and contract manufacturing all add clauses, records and audit days. The third is speed: a certification date fixed by an investor or a tender deadline tends to cost more than one you can plan towards.
The sections below break the cost into its parts so you can see which apply to you. If you want a figure for your own company, a short scoping call is the honest way to get one.
The accredited certification body charges for the Stage 1 and Stage 2 audits, then annual surveillance audits and a recertification audit every three years. Fees are based on audit days, which are set by the number of employees, sites and the risk class of your devices, plus travel and a certificate fee.
The hours your own people spend writing procedures, generating records, training staff, running internal audits and management reviews, and hosting the auditors. For most companies this is the largest cost, and the one most often left out of the budget.
Optional, and priced by scope: a gap analysis, help building or remediating the QMS, outsourced internal audits, or a mock audit before the real one. Good support reduces the other two components by getting you to Stage 2 once, not twice.
A useful rule: the less mature your QMS, the more of the total sits in internal effort and consultancy; the more complex your devices and organisation, the more sits with the certification body.
We do not publish price bands, because two companies of the same size can have very different systems. What we can tell you is what drives the cost at each stage of growth.
A small team, one device, one site. Certification-body audit days are at the minimum, but the QMS usually has to be built from scratch, so consultancy and internal effort dominate. Building it right first time is the biggest saving available.
More employees, more design files and more records mean more audit days and a longer document review. Internal effort is spread across more people, and the risk is inconsistency between product lines that an auditor will find.
Sterile, implantable or software-driven devices, several sites or contract manufacturers. Every site adds audit days, and higher-risk devices bring more clauses into scope. Supplier audits and process validation add to the internal effort.
Ask us for an estimate for your own profile. We will tell you which component is likely to dominate and where the savings are, before any commitment.
From a standing start to certificate, most companies take six to twelve months. The stages below run in sequence, and the length of each depends on how much already exists.
Gap analysis: two to four weeks to map your current system against every clause of ISO 13485
QMS build or remediation: the longest stage, from a few weeks to several months depending on what is missing
Implementation and records: processes run for long enough to generate the records auditors will sample
Internal audit and management review: mandatory before certification, and the proof that the system works
Stage 1 audit: the certification body reviews your documentation and confirms readiness for Stage 2
Stage 2 audit and certificate: the full on-site or remote audit, closure of any findings, then certification
The gap between Stage 1 and Stage 2 is usually a few weeks. What stretches the overall timeline is almost always the QMS build stage and the records that have to accumulate before an auditor can sample them.
Sterile devices bring sterilisation validation, bioburden and packaging requirements into scope. Software as a medical device adds IEC 62304 lifecycle evidence. Implantables and Class III devices raise the audit days and the depth of design and risk review.
Multiple sites, contract manufacturers and critical suppliers each need controlling, and often auditing, before the certification body is satisfied. Adding markets, such as the FDA's Quality Management System Regulation alongside UK and EU requirements, adds mapping work even though one QMS can serve all of them.
The most expensive item of all is a failed Stage 2. A major nonconformity means a follow-up audit, more days and a delayed certificate, and it is almost always avoidable with a gap analysis and a proper internal audit first.
A fixed-scope, clause-by-clause gap analysis with a findings report, prioritised roadmap and effort estimate, so you can budget certification with real numbers rather than guesses.
Start with a gap analysis rather than a blank-sheet QMS build; you will almost always have more in place than you think. Keep the system proportionate to your devices, not a copy of a large manufacturer's manual. Get quotes from more than one certification body, because audit-day calculations and daily rates vary.
Use consultancy where it removes risk, not to write documents your team could own. Outsourcing internal audits, for example, solves the independence problem and costs a fraction of a repeat Stage 2. Build in records time from the start so the certification date is not pushed back waiting for evidence.
For most medical device manufacturers ISO 13485 is not optional in practice. UK MDR, EU MDR and IVDR conformity assessment routes expect it, Notified and Approved Bodies audit against it, and tenders from the NHS and large distributors ask for the certificate up front. Not holding it means lost tenders and closed doors, not a saving.
Delays cost as well. Every month a device waits for certification is a month of revenue deferred and competitors gaining ground. Investors and acquirers read a certified QMS as evidence the company is run properly, and price accordingly.
It depends on the size of your organisation, the complexity and risk class of your devices, and how mature your existing quality system is. The total is made up of certification-body fees, your own team's time and any consultancy support. Small, single-site companies with simple devices sit at the low end; multi-site manufacturers of sterile or software-driven devices at the high end. We give a tailored estimate after one scoping call.
Most companies take six to twelve months from a standing start. A mature ISO 9001 system can be faster; a start-up building its QMS from scratch can take longer, mainly because records need time to accumulate before an auditor can sample them.
The regulations do not use the word mandatory, but in practice UK MDR, EU MDR and IVDR conformity assessment expects a QMS that meets ISO 13485, Approved and Notified Bodies audit against it, and most customers and tenders require the certificate. For Class I self-declared devices it is not strictly required, but it is still the recognised way to demonstrate your QMS.
No. Certificates come from accredited certification bodies. Taylored is a consultancy: we run gap analyses, build and remediate quality systems, carry out internal and mock audits, and prepare you for the certification body's audit. We can recommend certification bodies and help you compare their quotes.
Yes, if the system is built proportionately. A small company with one device does not need a large manufacturer's quality manual. Building a lean QMS around your actual processes from day one is cheaper than retrofitting one later, and it is the route most successful device start-ups take.
We are the team between you and the certification body: gap analysis, QMS build and remediation, outsourced internal audits and mock audits. Our lead auditors know what certification bodies look for, which is how we keep clients to one Stage 2 rather than two.
