Many suppliers reference quality systems and process control. ISO 13485:2016 defines what those terms actually require — and what separates a certificate on the wall from a quality system that protects your program.
What ISO 13485:2016 Is — and What It Is Not
ISO 13485:2016 is an international standard for quality management systems specifically designed for organizations involved in the design, production, installation, and servicing of medical devices and related services.
It is not a product standard. It does not certify that a specific component meets a specification. It certifies that the management system governing how that component is produced meets defined requirements for consistency, documentation, traceability, and controlled change.
For a converting supplier, this means ISO 13485:2106 governs:
- How processes are defined, validated, and controlled
- How materials are qualified, received, and handled
- How nonconformances are identified, documented, and resolved
- How changes to processes or materials are evaluated and approved
- How records are maintained to support traceability and audit requirements
The standard is about systematic control of the converting process — not a one-time quality inspection of the output.
ISO 13485:2016 vs. ISO 9001: Why the Distinction Matters for Regulated Applications
Many converting suppliers hold ISO 9001 certification. Some hold ISO 13485:2106. These are not equivalent, and the distinction matters when your application is regulated or subject to device-level quality requirements.
ISO 9001 | ISO 13485:2016 | |
Scope | General quality management across industries | Quality management specific to medical devices and related services |
Customer satisfaction focus | Explicit — continuous improvement driven by customer feedback | Explicit while also ensuring regulatory requirements are met. |
Regulatory requirements | Not addressed explicitly. | Explicitly required — supplier must identify and comply with applicable regulations |
Risk management | Not required Risk based thinking is required. | Required — risk-based approach to process design and control |
Design controls | Required where applicable. May be minimal. | Required where applicable |
Validation requirements | Required where applicable. | Explicit — processes that cannot be verified by inspection must be validated |
Traceability | General | Specific requirements for device components and materials |
Record retention | Explicit according to organization determination. | Specific retention periods tied to device lifetime and customer requirements |
The core difference is that ISO 9001 is a general framework for managing quality with a customer satisfaction orientation, while ISO 13485:2016 emphasizes a regulatory compliance framework with device safety and traceability requirements at its center.
What ISO 13485:2016 Requires of a Converting Supplier Operationally
In precision converting, many risks are not visible at the component level. They surface during validation, scale-up, or in the field — when they are most expensive and difficult to resolve. ISO 13485:2016 addresses those risks at the system level, before they reach the component.
Process Validation
ISO 13485:2016 requires that processes which cannot be fully verified by subsequent inspection must be validated. In precision converting, this applies directly to laminating, die cutting, and slitting operations where the internal quality of a bond, the consistency of a tolerance, or the integrity of a multilayer construction cannot be confirmed by visual inspection alone.
Validation means the supplier must demonstrate, through documented testing under defined conditions, that the process consistently produces conforming output. This is not optional for regulated converting work — and it is not the same as running a first article inspection.
Understanding how process validation requirements affect the prototype-to-production transition
Environmental Controls
ISO 13485:2016 requires that the work environment be controlled to the extent that environmental conditions could affect product quality. For converting operations involving skin-contact adhesives, microfluidic substrates, or other contamination-sensitive components, this connects directly to cleanroom requirements.
Understanding the cleanroom requirements that apply to regulated converting applications
ISO 13485:2016 does not define specific cleanroom classifications — but it does require that the supplier identify the environmental conditions required for their products and demonstrate they are controlled and monitored.
Traceability and Record Keeping
ISO 13485:2016 requires that product and process records be maintained in sufficient detail to support full traceability—from raw material lot through finished component. For device manufacturers, this record set supports complaint investigations, corrective actions, and regulatory submissions.
For converting specifically, this means material lot traceability through production records, equipment calibration and maintenance records linked to production runs, in-process and final inspection records with defined acceptance criteria, and nonconformance records with documented disposition and root cause when applicable.
Change Control
Any change to a process, material, or piece of equipment that could affect product quality must go through a defined change control process under ISO 13485:2016. This is particularly relevant during scaling — when a supplier moves from prototype tooling to production tooling, or when a material lot changes.
A change made without going through the quality system creates a gap in the traceability record and potentially invalidates prior validation work. This is one of the most common ways regulated programs encounter problems during scale-up.
Supplier Controls
ISO 13485:2016 governs how approved suppliers manage their own supply chain. Material suppliers, subcontractors, and service providers used by the converter must be evaluated and approved under their quality system. The materials used in your components — and the controls governing how they are handled — may be subject to the same quality system requirements, not just the converting operations themselves.
What ISO 13485:2016 Does Not Cover
Understanding the limits of the standard is as important as understanding what it requires.
ISO 13485:2016 does not certify the component itself. It certifies the system under which the component is produced. Buyers are responsible for confirming that their own design, material specifications, and acceptance criteria are correctly defined and communicated.
ISO 13485:2016 does not replace device-level validation. A component produced by an ISO 13485:2016-certified converter still requires validation within the context of the finished device. The supplier’s certification supports that process—it does not substitute for it.
ISO 13485:2016 does not automatically mean FDA registration or 21 CFR Part 820 compliance. For U.S.-regulated devices, additional regulatory requirements may apply depending on device classification and the supplier’s role in the supply chain. Buyers
with FDA-regulated devices should state and confirm the role and requirements of the supplier in the applicable regulatory scope in the manufacturing of the device or components during selection and qualification.
What to Verify When Evaluating a Supplier's ISO 13485:2016 Certification
Confirming a supplier is ISO 13485:2016 certified is the starting point, not the conclusion. A structured evaluation should include the following.
Certificate validity and scope
Is the certificate current? Certificates require surveillance audits and periodic recertification. What is the scope statement on the certificate? ISO 13485:2016 certificates define the specific operations and product categories covered — a supplier may be certified for some converting operations but not all.
Registrar credibility
Who issued the certificate? Accredited third-party registrars provide meaningful certification. Self-declared or unaccredited certifications do not carry the same weight.
Audit history
When was the last surveillance audit? What findings, if any, were documented? Has the supplier undergone a customer audit, and are they open to one?
Process validation records
Can the supplier demonstrate validated processes for the specific converting operations your project requires — laminating, die cutting, slitting? Are validation records available for review?
Traceability and documentation capability
What does a standard production record package look like? Does it include material lot traceability, in-process inspection records, and certificates of conformance? How are nonconformances documented and dispositioned?
Change control process
What triggers a formal change control review? How and when are customers notified of changes that could affect their components?
For a structured framework covering these and additional evaluation criteria → How to verify supplier certifications and quality systems during evaluation
Why Advantage Converting
For regulated applications, ISO 13485:2016 only matters if it governs the actual converting process — not just a quality department operating alongside it.
Advantage Converting operates under an ISO 13485:2016-certified quality management system that covers precision die cutting, laminating, slitting and rewinding, and cleanroom manufacturing. The quality system is not a separate compliance layer — it governs how production is planned, executed, documented, and controlled for regulated and high-spec applications.
This includes process validation for converting operations where output cannot be fully verified by inspection alone, material and equipment traceability through production records, nonconformance management with documented root cause and corrective action, and change control processes that protect the integrity of validated production.
Advantage Converting also maintains ISO 14644-compliant cleanrooms — ISO 7 and ISO 8 — operating under the same quality system, for applications where environmental control is a production requirement.
Advantage Converting is not merely a contract manufacturer, it is a precision converting partner that produces components and sub-assemblies for regulated and high-spec applications. The quality system is one of the foundations that makes that work auditable and repeatable.
Evaluate Whether a Supplier's Quality System Can Support Your Application
ISO 13485:2016 certification tells you a supplier has a documented quality management system. Evaluating whether that system is operationally integrated into the converting processes your application requires is what the qualification process needs to determine.
Frequently Asked Questions
Is ISO 13485:2016 required for all medical device component suppliers?
Not universally — but it is usually the expected requirement for suppliers producing components used in regulated medical devices. Device manufacturers operating under FDA or international regulatory frameworks typically require their critical component suppliers hold ISO 13485:2016 certifications as a baseline qualification condition. Whether it is formally required depends on the device classification, the regulatory jurisdiction, and the manufacturer’s supplier qualification requirements.
What is the difference between ISO 13485:2016 and ISO 9001 for a converting supplier?
ISO 9001 is a general quality management standard applicable across many different types of industries. ISO 13485:2016 is specific to medical devices and adds requirements for regulatory compliance, risk management, process validation, and traceability that ISO 9001 does not mandate. For regulated device programs, ISO 9001 alone does not necessarily satisfy the quality system expectations that ISO 13485:2016 is designed to address.
Does ISO 13485:2016 certification mean the supplier is FDA registered?
No. ISO 13485:2016 is an international standard administered by third-party registrars where their accreditation is overseen by ANAB. FDA registration is a separate regulatory requirement for U.S.-regulated device manufacturers and, in some cases, their suppliers. Buyers with FDA-regulated programs should confirm the applicable regulatory scope during supplier qualification.
How does ISO 13485:2016 relate to cleanroom requirements for my application?
ISO 13485:2016 requires environmental controls where the environment could affect product quality — but it does not prescribe specific cleanroom classifications. The cleanroom classification required for your application is determined by the contamination sensitivity of your component and converting process and is generally, then, stated in the customer’s requirements
Determine whether cleanroom converting is required for your application.
How does ISO 13485:2016 affect the transition from prototype to production?
Process changes during scale-up — new tooling, higher volumes, different material lots — must go through change control under ISO 13485:2016. Components developed at an R&D or developmental level are not yet operating under a validated production process. Scaling up requires demonstrating that the production process consistently meets specification under real production conditions, which means validation steps are required before full production release — not just operational adjustments. This makes the transition to production-level manufacturing a defined quality event, not just an operational one.
Understand how a structured production transition manages these requirements.
