Get ISO 13485 certification for medical device manufacturers

ISO 13485:2016 is an international quality management system (QMS) standard for manufacturers and distributors of medical devices. It sets requirements for documentation, risk management to ISO 14971, product traceability and complaint handling.

In Kazakhstan the certificate is needed for three tasks: the medical device registration certificate with the MoH Kazakhstan and EAEU, tenders of state hospitals and clinics, and CE Mark for export to the EU, UAE and Southeast Asia for classes Is, IIa and above under MDR 2017/745.

Unlike ISO 9001, it is designed specifically for the medical industry and takes into account the regulatory requirements of patient safety.

Yes, ISO 13485 is a mandatory document in the registration dossier for obtaining the unified EAEU registration certificate (Kazakhstan, Russia, Belarus, Armenia, Kyrgyzstan). In Kazakhstan, registration is handled by the Medical and Pharmaceutical Control Committee of the MoH Kazakhstan. This is the most common reason clients come to us: without the certificate, registration stalls — and with it, sales and tenders.

Important: 13485 is a necessary but not the only condition. Full registration also requires a technical file and clinical data / test results according to the device's risk class. We arrange the apostille on the certificate as a separate option — so the document is ready to be included in the registration dossier.

It's convenient to consider costs over two horizons: obtaining the certificate and maintaining its validity. The certificate is issued for 3 years, and its lifecycle includes three audits: the initial certification, the first surveillance (9th–12th month, ≈70% of the initial cost) and the second surveillance (21st–24th month).

Obtaining = consulting (QMS documentation, risk management to ISO 14971, team training) + the body's certification audit. If you build the QMS on your own — hiring a specialist, a workplace, salary, buying standards and training usually come to €4,400–7,000 and no less than six months. With consulting — 30–60 days.

Easy Standart benchmarks: for a company of up to 25 employees with no additional sites — turnkey from $2,200 (≈1.25 million ₸), for 26–125 employees — from $3,400 (≈1.9 million ₸). Each additional site or branch increases the volume of consulting and audit — the calculator above accounts for this and computes the exact figure in 45 seconds.

If there are several sites: the certificate specifies the certification scope — the sites and branches that passed the audit are entered into it. If you certify one site out of several — only that one will be on the certificate.

The cost includes: two copies of the certificate (RU + EN), training of two internal auditors, support during the body's audit. The apostille for the MoH Kazakhstan is a separate option for registration (not every body even provides it). Payment in stages: part on signing the contract, the final payment after receiving the certificate. Payment in KZT, USD or EUR — your choice.

Maintenance: an annual surveillance audit (≈70% of the initial) and running the QMS. If documents aren't kept up all year, the surveillance audit brings nonconformities — up to suspension of the certificate. Internal auditors trained on the project let your team pass surveillance on its own.

From 30 to 60 business days turnkey. Three scenarios:

— Fast-track: 10–14 business days from signing the contract with the body — with ready QMS documentation and a prepared team.

— Standard: 30–50 days when implementing the QMS from scratch.

— With CE Mark: 3–9 months depending on the device's risk class and the chosen notified body in the EU.

What speeds up the process: an existing ISO 9001, an assigned quality manager on staff, prompt provision of company data. A remote audit in Russian by video call — from anywhere in Kazakhstan, with no auditor visit.

If you have a hard deadline — a tender, renewal of a registration certificate, a client's requirement — give us the date on the first call: we'll honestly say whether we'll make it and build a plan around your deadline.

Yes, in most medical device procurement through goszakup.gov.kz, ISO 13485 is a qualification requirement. Without the certificate, a company doesn't pass the technical selection.

Large private medical networks in Kazakhstan also require 13485 from suppliers. An IAF-accredited certificate from the bodies we work with is recognised by the MoH Kazakhstan and verifiable in the international register.

If the tender allows GOST RK ISO 13485 or a non-IAF line — they are cheaper and faster. Send us the terms of reference — within an hour we'll tell you what fits.

ISO standards are developed by the International Organization for Standardization (iso.org) and updated periodically. The current version for medical device QMS in 2026 is ISO 13485:2016: ISO is already preparing the next edition, but until it's published, :2016 applies, and certificates issued now work for the full three-year term. An IAF-accredited certificate is recognised in 50 countries through IAF MLA.

National prefixes — GOST R (Russia), ST RK (Kazakhstan), STB (Belarus), EN (European Union), DIN (Germany) — mean adaptations: the national standards body takes the ISO standard as a basis and makes adjustments for local legislation. Formally this is already a different document, distinct from ISO 13485:2016.

The EAEU has a unified GOST ISO 13485-2017 — it is accepted for registering medical devices within the union. If you already have the international ISO 13485:2016, it can be used across the EAEU countries, and if a GOST equivalent is specifically required — having the international certificate simplifies and reduces the cost of obtaining it.

Who issues it: certification bodies accredited by international associations (IAF, IAS) or national centres — in Kazakhstan this is the National Accreditation Centre. Accreditation confirms the reliability of the audit: the body itself regularly undergoes checks. The authenticity of an IAF certificate is verified in the IAF CertSearch register — we work directly with 10+ IAF/IAS/ANCAB-accredited bodies. On 1 January 2026, IAF and ILAC merged into Global ACI — the IAF MLA mark is licensed by the new organisation and remains valid.

A simple rule. IAF — if the certificate is needed for export, CE Mark, large foreign clients or MoH Kazakhstan tenders with international recognition. Verified in the IAF CertSearch register.

Non-IAF — if the task is purely local: an internal corporate requirement, a private tender, a partner ready to accept any certification. Cheaper and faster.

We run both lines and select the body for the specific task. We never substitute one for the other and never claim that "only IAF works" — that's not true.

Already have GOST RK ISO 13485? We'll switch you to the IAF line without losing your track record: a preliminary documentation audit, targeted refinement (usually risk management to ISO 14971 and post-market surveillance), an audit by the new body — typically 30–45 days.

The standard doesn't set a specific list of documents — the quality system is built around the organisation's activities. At the audit you need to demonstrate a working QMS: documents are kept, staff are trained, internal audits are conducted.

A typical set: documented procedures (internal audits, post-market surveillance, data analysis, product traceability, risk assessment, corrective and preventive actions, staff training and competence, equipment control), a quality manual, a quality policy, logs and orders, records and schedules, risk and supplier registers, SOPs.

Documents must comply with related standards: risk management — ISO 14971-2019, post-market surveillance — ISO/TR 20416.

If you have "nothing yet" — that's the usual start for most of our clients. We develop the whole set from scratch for your processes (steps 1–4 of the diagram above); your team only needs to adopt the documents and complete training. Behind us — 430+ projects in the medical device industry.

After a successful audit you have:

— Two ISO 13485:2016 certificates (in Russian and English), valid for 3 years.

— An apostille for the MoH Kazakhstan — arranged as a separate option for registration.

— A record in the international register of IAF-certified companies (for the IAF line).

— A full set of QMS documents, developed for your processes.

— Training of two internal auditors in your team — they maintain the system and pass surveillance audits after the project.

Yes, this is the most cost-effective path for export to the EU, UAE, Saudi Arabia, Southeast Asia and Latin America. ISO 13485 is the base standard for CE Mark under MDR 2017/745 (devices) and IVDR 2017/746 (in vitro) for classes Is, IIa and above.

Joint implementation saves 20–30% of time and budget: many documentation requirements overlap, and the technical file is built on the basis of the ISO 13485 QMS.

Turnkey timelines: 4–6 months for 13485 + the CE Mark application for class I / Is; 6–9 months for IIa / IIb; for class III — individually, taking clinical evaluation into account. We work through partners in the EU: notified body selection, the technical file, an authorised representative in the EU, registration in the EUDAMED database.

Yes. This is the packaging localisation scenario, one of the common ones among our clients: the device is manufactured in China, India or the EU, while packaging, repackaging and release control are performed at a site in Kazakhstan. Your site becomes part of the medical device's production chain — and the registration dossier requires its own QMS under ISO 13485.

The certification scope is formulated for your operation: packaging, wrapping, labelling, storage and release control of medical devices. Often the foreign factory itself sets the condition for the local partner — "get the international standard": its auditors and regulators check the whole chain.

Such projects are usually more compact than a full production cycle — in both timelines and budget. We run it turnkey: documentation from scratch for the packaging operation, team training, an IAF body's audit, the certificate; the apostille for the MoH Kazakhstan as an option for registration.

Yes, if your software is itself a medical device by intended purpose — diagnosing, monitoring or treating patients. Under MDR 2017/745, such software is treated as a medical device, and ISO 13485 is required to enter the EU market via CE Mark.

Relevant for Kazakhstani developers of medical IT products: telemedicine, AI-assisted diagnostics, monitoring platforms. Often together with ISO 27001 (information security) — large European clients and investors require both standards.