ISO 13485 vs EU MDR: What Transfers, What Does Not

"We already have ISO 13485 — how much more is EU MDR?" It is the most common question a medical device manufacturer asks, and the answer is more interesting than either the hopeful or the fearful version.

The hopeful version is that a 13485 certificate gets you most of the way there. The fearful version is that MDR is a separate mountain. Neither is right. ISO 13485 does real work for you — and it does none of the work on the parts that take longest.

What your ISO 13485 system already gives you

More than people expect, and it is worth being specific, because this is the part you do not have to rebuild.

ISO 13485 is harmonised to the regulation. Article 10(9) of EU MDR requires a quality management system and describes what it must cover; it does not name a standard, but a conforming 13485 system carries a presumption of conformity with those QMS requirements. In practice that means:

Document and record control — the machinery the technical file and the post-market obligations both run on.
Design and development control — design history, verification and validation, design transfer. MDR leans heavily on this.
Supplier control — selection, evaluation, monitoring. MDR's expectations here are an extension rather than a replacement.
CAPA — the engine vigilance and post-market surveillance plug into.
Management review and internal audit — the governance a Notified Body will look for.
Risk management, where ISO 13485 points at ISO 14971, which MDR also relies on.

If all of that genuinely works — not exists, works — you have the foundation. The honest framing is that ISO 13485 is the foundation and MDR is the building. A company starting MDR without it is pouring concrete and framing walls at the same time.

What it does not give you at all

This is the gap, and it is where MDR programmes consume their budget.

Classification and conformity assessment route. Annex VIII, applied to your intended purpose. Not a QMS activity, and getting it wrong invalidates everything downstream.
Technical documentation to Annexes II and III. Your design history file is an input, not the dossier.
Clinical evaluation under Article 61 and Annex XIV — the single most common underestimate.
Post-market surveillance under Articles 83–86: PMS plan, PMS report or PSUR by class, and post-market clinical follow-up.
Vigilance reporting to defined timescales.
UDI assignment and carriers.
EUDAMED registration of actors, devices and certificates.
A Person Responsible for Regulatory Compliance under Article 15, with defined qualifications.
An EU Authorised Representative, if you are outside the Union — carrying real legal liability, not an address.

None of these appear in ISO 13485. A clean certificate tells a reviewer your quality system is sound. It says nothing about whether your device is classified correctly, your clinical evidence holds, or your PMS plan exists.

Three misunderstandings that cost money

"Our certification body can do our MDR assessment." Only if it is also a designated Notified Body for your device codes. Certification bodies and Notified Bodies are different designations with different legal standing. Some organisations hold both; many do not. An ISO 13485 certificate from a body that is not a designated Notified Body gives you no MDR standing — and finding that out late costs you your place in a queue.

"We will claim equivalence like we did under the MDD." Equivalence is substantially harder under MDR, particularly where the equivalent device belongs to a competitor and you cannot access their data. Teams that assumed the MDD route would carry over have discovered they need a clinical investigation — which is a year, not a gap-fill.

"Post-market starts when we are certified." It does not. For legacy devices under the transitional provisions, MDR's post-market surveillance, vigilance and registration obligations already apply. It is entirely possible to be diligently preparing for a 2027 conformity assessment while being non-compliant today.

Which comes first?

If you hold neither, the sequencing question is real, and the answer is usually both — but starting with ISO 13485.

Not because the standard matters more, but because the gap work for MDR runs on the quality system. Clinical evaluation needs document control. PMS needs CAPA. Technical documentation needs design control. Attempting MDR on a weak QMS means every workstream stalls on the same missing machinery, and you build it under deadline pressure instead of deliberately.

The exception is when your transition date is close enough that sequencing is a luxury. In that case the two run in parallel and the cost is higher — which is an argument for starting earlier rather than for skipping the foundation.

Where to actually start

Three things, in this order, and the first one takes an afternoon.

1. Confirm your classification under Annex VIII. Not what it was under the MDD — what it is now, against your current intended purpose. Many devices moved up a class, and class determines your conformity assessment route, your evidence burden and your timeline. Everything else is built on this answer, so it is worth being certain rather than confident.

2. Check your Notified Body position. Are they designated for your device codes? Have you applied? What is their current queue? Capacity is finite and timelines are driven as much by queue position as by your readiness.

3. Gap the technical documentation against Annex II, not against your existing files. Start from the structure the regulation asks for and see what is missing, rather than starting from what you have and mapping it across. The second approach produces files that are internally inconsistent — an intended purpose in the clinical evaluation that does not quite match the labelling — and inconsistency is exactly what reviewers find.

The short answer

ISO 13485 gets you the quality system, which is perhaps a third of the work and nearly all of the infrastructure. MDR adds classification, a technical file, clinical evidence, continuous post-market obligations and a set of registrations and roles that have no 13485 equivalent.

Holding 13485 makes MDR considerably cheaper. It does not make you compliant, and nobody at a Notified Body will mistake one for the other.

Questions this raises

If we have ISO 13485, how much of EU MDR is already done?

The quality management system part, which is substantial infrastructure but not the bulk of the work. Document control, design control, supplier control, CAPA, management review, internal audit and risk management all transfer and are what MDR's additional obligations run on. What does not transfer: classification, technical documentation to Annexes II and III, clinical evaluation, post-market surveillance and PSURs, vigilance, UDI, EUDAMED registration, the Person Responsible for Regulatory Compliance and the EU Authorised Representative.

Can our ISO 13485 certification body do our MDR conformity assessment?

Only if it is also a designated Notified Body for your device codes. Certification bodies and Notified Bodies are different designations with different legal standing. Some organisations hold both roles, many do not, and a 13485 certificate from a body that is not a designated Notified Body gives you no MDR standing. Check this early — discovering it late costs you a place in a queue.

Should we get ISO 13485 before starting EU MDR work?

Usually yes, if the timeline allows. MDR's gap work runs on the quality system — clinical evaluation needs document control, post-market surveillance needs CAPA, technical documentation needs design control. Attempting MDR on a weak QMS means every workstream stalls on the same missing machinery. The exception is a transition date close enough that the two have to run in parallel, which costs more.

Why is clinical evaluation the most common underestimate?

Because equivalence routes that worked under the MDD frequently do not under MDR, particularly where the equivalent device is a competitor's and the underlying data is not accessible to you. Teams that assumed the old route would carry over have found they need a clinical investigation instead — which is a year of work, not a gap to fill.

Do MDR post-market obligations apply before we are certified?

Yes, for legacy devices under the transitional provisions. The extension covers the certificate, not the obligations around it: post-market surveillance, vigilance and registration requirements already apply. It is possible to be preparing diligently for a 2027 conformity assessment while being non-compliant in the present.