Do I need ISO 13485 as a startup?

In short: If your device is Class IIa or higher you need a certified quality management system, and ISO 13485 is the practical standard for it — also now referenced by FDA's QMSR, so it serves both markets. Class I self-certifiers still need a QMS, just without the certification audit.

Why ISO 13485 specifically

MDR doesn't name ISO 13485 by title as mandatory, but in practice it's the standard every Notified Body expects, and certification against it is treated as strong evidence your quality management system meets MDR's requirements. Since FDA's Quality Management System Regulation replaced the older QSR (effective 2 February 2026) by incorporating ISO 13485 by reference, a single 13485-aligned QMS now does real work in both the EU and US markets — a startup building one system, not two, is following the regulatory grain rather than working against it (though QMSR layers some FDA-specific requirements on top of ISO 13485, so the US side still needs a delta, not a straight copy).

What "needing" it actually means by class

Class IIa and above: a certified QMS is functionally required, since your Notified Body will assess it alongside your technical file before certification. Class I self-certification: you still need a documented quality management system covering design and development (what FDA calls design controls), risk management, and post-market processes — MDR doesn't waive this — but you don't go through a third-party certification audit for it. One carve-out: Class I devices that are sterile, have a measuring function, or are reusable surgical instruments (Is/Im/Ir) do involve a Notified Body for those specific aspects (MDR Article 52(7)), so they aren't pure self-declaration. The gap between "have a QMS" and "have a certified QMS" is smaller in practice than founders often assume, since most of the same processes need to exist either way.

The startup-specific trap

Building a QMS as a compliance checkbox, disconnected from how the team actually works, produces documentation that looks right and fails audits anyway — because auditors sample actual practice against the documented process, not just the documents in isolation. Starting the QMS build early and lightweight, and letting it grow with the company, beats writing a comprehensive system upfront that nobody follows.

Where next: Building an MDR Technical File and CER · What is QMSR, and how does it affect me?

Talk to us about right-sizing your QMS. Book an expert conversation →