Direct comparison
ISO 13485 vs ISO 9001 for a Distributor
ISO 13485 names storage/distribution in its own scope; ISO 9001 is generic. What a medical device distributor's certification actually covers, and doesn't.
Ask about ISO 13485 vs ISO 9001 for a Distributor
Answers are drawn from this comparison and the rest of the CASRAI corpus, with a link to every source.
Answers are AI-generated from CASRAI’s own published pages and can be wrong, so check the linked sources before relying on one; your question is logged without personal data — never sold, never used to train a third-party model — to show us what CASRAI is missing, so please do not type personal or confidential details. How we use this
How do ISO 13485, ISO 9001 compare side by side?
The table below compares ISO 13485, ISO 9001 across 10 procurement-relevant dimensions, from what it actually regulates through what to actually check on the certificate.
Side-by-side comparison
| Dimension | ISO 13485 | ISO 9001 |
|---|---|---|
| What it actually regulates | A medical-device-specific QMS: design, production, storage and distribution, installation, servicing, and associated services across the device life-cycle | A generic QMS applicable to any industry or product type — no device-specific requirements |
| Does its scope name distribution/storage? | Yes — Clause 1 (Scope) explicitly lists storage and distribution among the life-cycle stages the standard covers | No — the standard doesn't define device life-cycle stages at all |
| Certifiable to a distribution-only scope? | Yes — IAF MD 9 recognizes a 'distribution/transportation-only' certification scope, with up to 50% fewer audit days than a full design-and-manufacturing scope | N/A — ISO 9001 certification scope is written generically (e.g., 'wholesale distribution'), with no device-specific scope category |
| Design-control clause (7.3) | Present in the standard, but only load-bearing if the organization actually designs devices — a pure distributor's certification typically excludes it | No design-control clause exists to include or exclude |
| Referenced by a US device regulation? | Yes — incorporated by reference into FDA's Quality Management System Regulation (QMSR), effective Feb 2, 2026, which replaced most of legacy 21 CFR Part 820 | No — ISO 9001 is not referenced by any FDA device-quality regulation |
| Is it required for an ordinary distributor? | Usually not by regulation. QMSR/820.1 centers on manufacturers; an 'initial distributor' of a foreign device performing relabeling, repackaging, or similar functions can be captured, but a distributor that only stores and ships sealed original packaging generally isn't | Never — ISO 9001 has no regulatory trigger anywhere in the device supply chain |
| Device-specific traceability / complaints | Where those clauses are in scope: lot/serial traceability, a device-specific complaint file, and CAPA tied to device risk | A generic nonconformity and corrective-action process (Clause 8.7/10.2), with no device-specific complaint-file or traceability requirement |
| Certification-body accreditation to check | ISO/IEC 17021-1 plus IAF MD 9 (medical devices) specifically — not every ISO 9001-accredited certifier is also accredited for ISO 13485 | ISO/IEC 17021-1 general management-systems accreditation is sufficient |
| What the badge does NOT mean | That the devices being sold are 'certified' — ISO 13485 certifies the organization's QMS, not the product; device clearance runs through FDA's own pathways separately | That the distributor meets any device-specific requirement — no clause addresses storage conditions, UDI, or lot traceability |
| What to actually check on the certificate | The scope statement — it should name storage/distribution (or design/manufacturing only if the distributor genuinely does that), not a generic activity description | The scope statement — confirm it describes the distributor's real activity, since ISO 9001's genericness makes an inflated scope easy to write and easy to overlook |
Common questions
Common questions about ISO 13485 vs ISO 9001
Does a medical device distributor have to be ISO 13485 certified?
+
Not usually, by regulation. FDA's Quality Management System Regulation (which incorporates ISO 13485:2016) is built around manufacturers. A distributor that only stores and ships sealed original packaging generally isn't itself captured, though an 'initial distributor' of a foreign-made device performing functions like relabeling or repackaging can be. For a pure distributor, certification is typically a voluntary differentiator, not a legal requirement.
If a distributor is ISO 13485 certified, does that mean the devices they sell are certified?
+
No. ISO 13485 certifies an organization's quality management system, not a product. A device's regulatory status comes from FDA's own clearance/approval pathways (510(k), PMA, De Novo); a distributor's ISO 13485 certificate says something about how that distributor's QMS runs, not about the device itself.
What should I actually check on a distributor's ISO 13485 certificate?
+
The scope statement, not just the standard's name. A distributor's certificate should describe activities like storage and distribution of medical devices. If it lists design or manufacturing activities the distributor doesn't actually perform — or gives no specific scope at all — that's worth a direct question before relying on it.
Is ISO 9001 a weaker certification than ISO 13485 for a distributor?
+
Not weaker — narrower in a specific way. ISO 9001 demonstrates a documented, audited quality process in general; it just doesn't require the device-specific controls (lot traceability, device-linked complaint files, storage-condition monitoring) that ISO 13485 does where those clauses are in scope. A distributor holding ISO 9001 instead of ISO 13485 isn't necessarily less reliable, but its certification is answering a narrower question.
Going deeper
