The short answer is no. There is no device class where the law says you must hold an ISO 13485 certificate before you can UKCA or CE mark, and that surprises a good number of the founders and smaller manufacturers we speak to. The relationship between ISO 13485 and UKCA marking (the CE position is much the same) is more subtle than that. The regulations ask for a quality management system in substance, not a certificate, and from Class Is, Im and IIa upwards the approved body or notified body will audit that system as part of conformity assessment anyway. So the honest answer to “do I need the certificate” depends on your device class and on who you need to convince, and I’ll go through both below.
The certificate and the QMS are not the same thing
It helps to separate two ideas that often get merged. ISO 13485 is a standard describing what a medical device QMS should contain (document control, design controls, purchasing, production, feedback, CAPA and so on). An ISO 13485 certificate is a third party’s written confirmation that your system conforms to that standard, usually after a stage 1 and stage 2 audit and with surveillance audits each year after that.
Neither the UK Medical Devices Regulations 2002 nor the EU MDR mentions the certificate as a condition of placing a device on the market. What they ask for is the system itself. BS EN ISO 13485:2016 is a designated standard in Great Britain and EN ISO 13485:2016 is harmonised under the EU MDR, which means that conforming to the standard gives you a presumption of conformity with the QMS requirements of the legislation. That is why nearly everyone builds their system around ISO 13485, since it is the easiest way to show you meet the requirements, and it is also the whole of the legal link between ISO 13485 and UKCA marking. The certificate is a separate step on top.
Class I: no certificate, no audit, but a QMS all the same
For a Class I device (non sterile, no measuring function and, for CE marking, not a reusable surgical instrument) you self certify under both regimes. You compile the technical documentation, draw up a declaration of conformity, register with the MHRA for Great Britain, and no approved body or notified body is involved at all. Nobody will ask to see an ISO 13485 certificate, and plenty of compliant Class I manufacturers have never held one.
That does not mean you can skip the QMS. Under the EU MDR, Article 10(9) explicitly requires every manufacturer, Class I included, to have a quality management system covering regulatory compliance, design, risk management, post-market surveillance and vigilance. For Great Britain, the strengthened post-market surveillance requirements that came into force on 16 June 2025 are specific enough (PMS plans, data collection, trending, reporting timelines) that you need documented procedures and records to meet them. The sensible approach for a Class I manufacturer is a lean QMS written around ISO 13485 but scaled to the size of the company, kept as live working documents rather than a shelf of binders, with certification treated as a commercial decision you can take later.
Class Is, Im, IIa and above: someone audits your QMS whether you like it or not
Once your device is sterile, has a measuring function, or sits in Class IIa or higher (and, under the EU MDR, if it is a reusable surgical instrument, Class Ir), an approved body (UKCA) or notified body (CE) has to be involved, and the most common conformity assessment routes are built around an audit of your quality management system. For a sterile Class I device the audit is limited to the aspects of manufacture concerned with securing and maintaining sterility, for a measuring device it covers the metrological aspects, for a reusable surgical instrument it covers the aspects relating to reuse, and from Class IIa upwards the body assesses the QMS as a whole alongside sampling of your technical documentation.
The body audits you against the regulation rather than against ISO 13485 as such, but in practice the two are assessed together and most approved and notified bodies will offer a combined audit, so you come out the other side holding the regulatory certificate and an ISO 13485 certificate from the same visits. At these classes the original question rather answers itself. You will be audited to the same depth either way, so the extra effort of adding the ISO 13485 certificate is small and there is rarely a good reason not to take it.
One practical point that catches people out: the audit needs evidence that the system has actually been operating for a while. Records of design reviews, supplier evaluations, training and at least one internal audit and management review are what the auditor wants to see, and they take calendar time to generate. We covered how to prepare for that first internal audit in a separate post.
What a certificate proves to a buyer
Even where the law does not require certification, the market often does. NHS procurement frameworks, distributors, licensing partners and investors all use the certificate as a quick screen, because it tells them an accredited auditor has been through your system recently and found it working. If you are a small company hoping to be acquired or to sign a distribution deal, the certificate takes a good chunk out of the due diligence on their side. It also travels well internationally, since ISO 13485 underpins MDSAP and most other national schemes, so one certificate supports conversations in several markets. My view is that for most companies heading past Class I it is worth certifying, and for Class I companies it is worth building the system as if you will certify, then deciding on the certificate when a buyer or market makes it worthwhile.
ISO 13485 and UKCA marking in November 2026
A quick word on the UK picture, since it moved in October. CE marked devices remain accepted in Great Britain until 30 June 2028 (devices certified under the old directives) or 30 June 2030 (devices certified under the EU MDR or IVDR), and on 21 October 2026 the government confirmed that EU MDR certified devices will go on being recognised long term, with the implementing legislation expected to be laid before Parliament by the end of 2026. None of that changes the QMS position described above, because the EU MDR QMS requirements apply to anyone CE marking and the UK requirements apply to anyone UKCA marking, but it does mean the CE route remains a sound way into the GB market for many devices. If you are weighing up which marking to pursue first, our UKCA vs CE post goes through that decision properly.
How we approach it at MDIN
We design, prototype and test devices in our workshop near Bristol and prepare the technical files that sit behind UKCA and CE marking, and as part of that we set up ISO 13485 quality systems scaled to small companies, which usually means a lean documented system the team will actually use, built alongside the design work rather than bolted on at the end (writing the design control procedures while the design is happening tends to produce procedures that fit). We don’t certify anyone ourselves, since certification is the auditor’s job, but we get clients to the point where the stage 1 audit holds no surprises.
If you are trying to work out what ISO 13485 and UKCA marking require for your device class, or whether certification is worth it for your situation, I’d be happy to have a call. You can book a free 30 minute call here.
FAQ
No. The EU MDR requires every manufacturer to operate a quality management system (Article 10(9)), but it does not require an ISO 13485 certificate. EN ISO 13485:2016 is harmonised under the MDR, so conforming to it gives a presumption of conformity with the QMS requirements, and for Class Is, Im, Ir, IIa and above the notified body audits your QMS during conformity assessment.
Yes. A non sterile, non measuring Class I device is self certified, so no approved body is involved and no certificate is required. ISO 13485 and UKCA marking are linked only through the designated standard, which gives a presumption of conformity with the QMS requirements. You still need documented procedures covering the technical documentation, post-market surveillance, vigilance and complaint handling, and the GB post-market surveillance requirements in force since 16 June 2025 make records of that system a practical necessity.
Not automatically. The body audits your QMS against the regulation as part of conformity assessment, and most bodies offer a combined audit so you can receive an ISO 13485 certificate from the same process, but you need to ask for it to be included in the scope.
No, the certificate is not a precondition for applying. What you do need is a QMS that has been implemented and is generating records before the audit, because the auditor assesses evidence of operation (internal audits, management reviews, design reviews, supplier evaluations and training records), and the written procedures alone won’t show that.
That an accredited certification body has audited your quality system recently and found it conforming. Buyers, NHS frameworks, distributors and investors use it as a quick screen during due diligence, and it supports regulatory conversations in other markets because ISO 13485 underpins most national schemes.