# ISO 13485 certification for medical software: time and cost > ISO 13485 is the quality standard for medical devices. For software: design controls, ISO 14971, IEC 62304 and typically 6–12 months to certification. - URL: https://bon.do/en/articles/iso-13485-certification - Markdown: https://bon.do/en/articles/iso-13485-certification.md - Author: Morten Bondo Vraa - Published: 2025-07-25 - Updated: 2026-11-09 - Reading time: 7 minutes - Section: ISO 13485 ## In 30 seconds - The MDR requires a quality management system. ISO 13485 is the harmonised standard for that system, and it is a system you run, not a certificate you buy. - Design controls, risk management and traceability start with the first requirement, not just before launch. - Plan for 6–12 months to the certificate. 4–6 months only works if the processes are already running. ## Key facts - **Standard:** ISO 13485:2016 (EN ISO 13485:2016+A11:2021) - **Software lifecycle:** IEC 62304 - **Risk management:** ISO 14971:2019 - **Typical timeline:** 6–12 months - **Certificate:** 3 years, with annual surveillance audits - **United States:** FDA QMSR builds on ISO 13485 from 2 February 2026 --- ISO 13485 certification means an accredited certification body has audited your quality management system (QMS) and found that it meets ISO 13485:2016. For medical device software, that system covers design controls, risk management to ISO 14971, a software lifecycle to IEC 62304 and traceability from requirement to test. A small software company should typically allow 6–12 months to obtain certification. We build software for medical devices and work under our clients' quality systems. This guide draws on our experience in those projects: where the time goes and what surprises teams coming from conventional software development. ## What is ISO 13485? ISO 13485 is the international standard for quality management systems for medical devices. The current edition is ISO 13485:2016. According to [TÜV NORD](https://www.tuev-nord.de/en/knowledge/standards-in-focus/iso-134852016-reconfirmed-standard-will-remain-unchanged-until-april-2030/), ISO reconfirmed it without changes at its latest systematic review, so it stays unchanged until April 2030. In the EU, EN ISO 13485:2016+A11:2021 is harmonised under the MDR by [Commission Implementing Decision (EU) 2022/6](https://eur-lex.europa.eu/eli/dec_impl/2022/6), so a system that follows the standard is presumed to meet the corresponding requirements of the regulation. The standard matters outside the EU too. The FDA's [Quality Management System Regulation (QMSR)](https://www.fda.gov/medical-devices/postmarket-requirements-devices/quality-system-qs-regulationmedical-device-good-manufacturing-practices), in force since 2 February 2026, incorporates ISO 13485:2016 by reference into 21 CFR Part 820. A system built to ISO 13485 is therefore also the best starting point for the US market, even though the FDA does not require an ISO certificate and retains some additional requirements of its own. ## Is ISO 13485 certification a legal requirement for medical software? No, not the certificate itself. Article 10(9) of the [Medical Device Regulation (EU) 2017/745](https://eur-lex.europa.eu/eli/reg/2017/745/oj) requires every manufacturer to have a quality management system, whatever the class. ISO 13485 is the harmonised standard for that system, and from Class IIa a notified body assesses the system as part of the conformity assessment. In practice it expects ISO 13485. Whether a quality management system is required depends on whether the software is a medical device. It usually is if it is intended to diagnose, prevent, monitor, predict or treat disease, such as image analysis, clinical decision support or an app that monitors patients' vital signs. Under classification Rule 11 of the MDR, most medical software ends up in Class IIa or higher. | Class | Risk | Quality management system | Notified body | | --- | --- | --- | --- | | I | Low | Required, certificate optional | No, except sterile, measuring and reusable surgical devices | | IIa | Medium | Required, ISO 13485 expected | Yes | | IIb | Medium to high | Required, ISO 13485 expected | Yes | | III | High | Required, ISO 13485 expected | Yes, with the most extensive assessment | In Denmark, the Danish Medicines Agency (Lægemiddelstyrelsen) is the competent authority for medical devices. Devices still sold under an old directive certificate have a transition period until 31 December 2027 or 31 December 2028 depending on class, provided the manufacturer has an MDR quality system and an agreement with a notified body (Regulation (EU) 2023/607). In December 2025 the Commission proposed a targeted revision of the MDR and IVDR. Watch whether it changes the deadlines for your product. ## What does ISO 13485 require for software development? ISO 13485 requires development to follow a controlled, documented process in which every requirement can be traced to design, code, tests and risk assessment. For software that comes down to four things: - **The quality system:** quality policy, responsibilities, document control, change control, supplier control, training, and management of nonconformities and corrective and preventive action (CAPA) - **Design controls (clause 7.3):** planning, design inputs and outputs, reviews, verification, validation and transfer, with a design history that shows how the product came to be - **Risk management:** ISO 13485 requires a documented risk management process throughout product realisation. ISO 14971:2019 is the recognised standard for that process and the one notified bodies expect to see - **Software lifecycle:** IEC 62304 covers planning, requirements, architecture, implementation, verification, release and maintenance, scaled to the software safety class A, B or C Validation means showing that the software meets user needs under realistic conditions: a validation plan, acceptance criteria, a production-like environment and a report with a traceability matrix. Agile development fits well, as long as requirements, risks and test evidence are updated in every sprint rather than documented only at the end. ## How does ISO 13485 certification work, step by step? With most certification bodies, the process runs from gap analysis and QMS implementation through audits to certification and ongoing surveillance: | Step | What happens | Typical duration | | --- | --- | --- | | 1. Gap analysis | Compare current practice with the standard and prioritise the gaps | 2–4 weeks | | 2. Build the QMS | Procedures, templates, design controls, risk management and training | 3–6 months | | 3. Run it and collect evidence | Use the system on real work so records exist | 2–4 months | | 4. Internal audit and management review | Find nonconformities yourself and close them | 1–2 months | | 5. Stage 1 audit | The certification body reviews documentation and readiness | 1–2 days | | 6. Stage 2 audit | Auditors see the system in use through interviews and sampling | 2–5 days | | 7. Certificate and surveillance | The certificate lasts 3 years, with a surveillance audit every year and recertification in year 3 | Ongoing | Choose a certification body accredited for ISO 13485, ideally one that is also a notified body under the MDR so the audits can be coordinated. Examples include BSI, TÜV SÜD, DNV, DEKRA and SGS. Book early, because the wait for an audit can be several months. An MDR certificate from a notified body is a separate thing: it is valid for at most 5 years and requires surveillance at least once a year. ## How long does ISO 13485 certification take? Typically 6–12 months from gap analysis to certificate for a small company. The seven certification steps, from gap analysis to the stage 2 audit, can partly overlap, but waiting for audit days and closing nonconformities often adds one to three months. - **4–6 months:** the processes are already in use, and the main gap is documentation - **6–12 months:** the typical path, with a moderate documentation gap - **12–18 months:** from scratch, with no existing quality system Certification is only one part of the timeline to market. Our roadmap [from idea to CE marking](https://bon.do/en/articles/idea-to-market-life-science) shows how the quality system fits with classification, development and the notified body review. ## How much does ISO 13485 certification cost? Certification has become much cheaper than many expect. For a small software company with its own team and templates, the largest external cost is the certification body's audit, around DKK 55,000–115,000. Consultancy is what moves the budget most. The figures in the cost table are converted from [OpenRegulatory's cost model](https://openregulatory.com/iso-13485-certification-cost) (August 2026), which is anchored to published fee schedules. They are planning figures, not quotes. | Item | Indicative level | | --- | --- | | Certification body, initial certification | around DKK 55,000–115,000 | | Templates and eQMS tooling | from DKK 0 (free templates exist) | | Consultant, targeted review | around DKK 60,000–150,000 | | Consultant, full implementation | around DKK 185,000–450,000 | | **Total external cost** | **around DKK 55,000–565,000** | | Internal resources (our estimate) | 200–500 hours | | Annual surveillance audits (typically 1–3 audit days) | around DKK 15,000–55,000 | The largest cost is rarely the certificate. It is the internal time it takes to write the procedures and then live by them. ## How does a software partner work under your QMS? The manufacturer owns the quality system, and an external software partner is a supplier you control under ISO 13485 clause 7.4 on purchasing. The partner works to your procedures, or to its own procedures that you have assessed and approved, and provides the records needed for your design history. Ask a prospective partner: - How do requirements trace to design, code, tests and risks? - Which parts of IEC 62304 do you cover, and how do you determine the software safety class? - What documentation comes with each release? - How are changes handled after validation? - How is SOUP, meaning third-party libraries, documented along with its vulnerabilities? - Can you support post-market surveillance once the product is live? At bon.do, Kirsten Bondo Vraa has more than ten years in pharmaceutical quality assurance, and Morten Bondo Vraa has built software for more than 22 years. We built the backend for [a CE-marked medical device](https://bon.do/en/work/seismofit), where every recording is tied to the device, the subject and the operator, and the result must be traceable back to the raw signal. We write the documentation for your QMS as we go, and you own the code and all IP. Read more about our [software development for medical devices and life science](https://bon.do/en/services). ## Next step If you are facing a gap analysis or a software project under ISO 13485, we are happy to have a no-obligation conversation about how development fits into your quality system. [Get in touch](https://bon.do/en/contact-us), or read about [GDPR and health data](https://bon.do/en/articles/gdpr-medical-data) and [validating AI in life science](https://bon.do/en/articles/ai-life-science-validation). --- ## Questions we get asked ### Is ISO 13485 certification a legal requirement for medical software? Not the certificate itself. The MDR requires every medical device manufacturer to have a quality management system, and ISO 13485 is the harmonised standard for it. From Class IIa a notified body assesses the system, and in practice it expects ISO 13485. ### How long does ISO 13485 certification take? Typically 6–12 months from gap analysis to certificate for a small company. With mature processes it can take 4–6 months, and from scratch you should plan for 12–18 months. ### How much does ISO 13485 certification cost? With your own team and templates, external costs can stay around DKK 55,000–115,000, mostly the certification body's audit. With full consultant implementation it typically lands at DKK 240,000–565,000. Annual surveillance audits cost around DKK 15,000–55,000. Get quotes before you budget. ### Can a software partner work under our QMS? Yes. The cleanest model is that the manufacturer owns the QMS and controls the partner as a supplier, while the partner works to your procedures with documented design controls and traceability.