ISO 13485 Contract Manufacturer: How to Verify One

What ISO 13485 certification actually buys you

When a contract manufacturer tells you it’s ISO 13485 certified, you’ve learned exactly one thing: the organization runs a quality management system built for medical devices, and a registrar has audited it against the standard. You haven’t learned whether the certificate covers your product, or whether the system works the way you need it to. This guide is about that gap, and how to check it when you’re sourcing from Taiwan.

ISO 13485:2016 is the international quality management standard for organizations that design, produce, install, and service medical devices. Unlike some quality standards, it’s built around regulatory requirements. The goal isn’t continual improvement for its own sake; it’s proving the factory can consistently produce devices that meet both customer and regulatory requirements. For a sourcing manager, that changes what the certification is worth. You’re not buying a plaque for the lobby. You’re buying a documented, auditable, traceable process.

ISO 13485 vs ISO 9001: why the distinction matters for sourcing

Both are quality management standards, and a factory can hold both. One doesn’t substitute for the other.

ISO 9001:2015 is a general standard that works for any industry; the emphasis is continual improvement and customer satisfaction. ISO 13485:2016 is specific to medical devices, and the emphasis is keeping an effective, documented, regulation-conformant system running. A few differences change what you can expect from a supplier:

• Medical-device regulatory scope. Identify the applicable requirements for the device, market and supplier’s activities. The FDA’s QMSR overview explains how ISO 13485 is incorporated into US device quality-system requirements alongside applicable FDA provisions. A general ISO 9001 certificate does not, by itself, demonstrate that those medical-device requirements are met.
• Documentation is heavier and mandatory. ISO 13485 requires documented procedures where ISO 9001 leaves more to the organization’s discretion. For a regulated device, that documentation is what makes the product defensible when questions come up.
• Risk is tied to safety and efficacy. ISO 13485’s risk-based thinking points at product safety and performance, and it works alongside ISO 14971 for medical-device risk management. ISO 9001’s risk focus is broader and more business-oriented.
• Structure. ISO 13485:2016 kept the earlier high-level clause structure instead of adopting the “Annex SL” layout ISO 9001:2015 uses, so the two don’t map clause for clause. ISO 13485 is a stand-alone standard; differing clause structures do not create a universal requirement to hold both certificates. Confirm the standards and certification conditions that apply to your markets and contract.

For sourcing, match the supplier’s documented activities, certificate scope and actual records to the work you need. Certification requirements can depend on the market and contract. The FDA’s QMSR FAQ explains that FDA does not require an ISO 13485 certificate and that a certificate does not exempt a manufacturer from FDA inspection. Neither one certificate nor a pair of certificates, by itself, establishes compliance for your device or proves what a particular site manufactures.

Traceability: the thing you’re actually paying for

Traceability connects relevant product, production and inspection records within the scope defined for the device and the work being performed. Agree which component or material lots, processing records and distribution information need to be linked, and check how those links are maintained.

Determine the required extent of traceability from the device, applicable regulatory requirements and agreed project controls. Use actual records and defect evidence to scope a field investigation. Traceability can help identify affected units, but it does not guarantee that a defect is confined to one lot or that every relevant record has the same required granularity.

How to verify it during an audit: pick a finished unit or a recent lot number and ask the supplier to walk it backward. They should produce component lot numbers, the production records for that batch, calibration status on the equipment used, and the inspection results, without a scramble. A supplier who can do that in front of you has a real system. One who promises to “send it later” may be describing a system that doesn’t exist yet.

Device History Record and the medical device file

Two documentation concepts are worth understanding before you audit, because they’re where 13485 turns process into evidence.

The Device History Record (DHR) is a legacy term from FDA’s former Quality System regulation. Since February 2, 2026, the Quality Management System Regulation (QMSR) has been in effect. In its final rule, response 31, FDA removed separate DHR, DMR and DHF terminology and record-type requirements because their underlying elements are largely covered by ISO 13485 clauses 4.2 and 7. Many former DHR elements are required in the device or batch record under clause 7.5.1. The recordkeeping obligations did not disappear. For US work, ask how current procedures and records meet applicable QMSR requirements and how earlier records map to them; the legacy folder name alone is not evidence of compliance, and the change does not by itself require renaming every old record.

The medical device file (ISO 13485 clause 4.2.3) is the master reference for a device type: product specifications, manufacturing and inspection procedures, and where relevant, installation and servicing requirements. It answers “how this device is supposed to be built.” The production records answer “how this batch was actually built.” During an audit, ask to see a redacted medical device file and a completed batch record for the same product, then check that the second follows the first. The gaps between them are where quality problems live.

Design controls, even if you own the design

Design controls are the disciplined process for taking a device from requirements to a verified, validated, production-ready design: design inputs, outputs, review, verification, validation, transfer, and change control, all documented.

Owning the design and controlling manufacturing changes are different responsibilities. Agree who manages design transfer, approved revisions, change assessment and release before production starts. Ask the supplier to show how its assigned work connects to the design owner’s controlled information. The activities and evidence to review depend on the actual work allocation and applicable requirements, rather than simply on which party owns the design.

If your supplier performs design and development, check that its quality-system scope and records cover those assigned activities, and examine any claimed exclusions or non-applicability. The FDA’s final rule, response 45, explains device-specific design-and-development applicability under the QMSR and recognizes documented exclusions permitted by the regulatory authority. Confirm the requirements with your regulatory team; a particular phrase on a certificate is not a substitute for checking scope, responsibilities and records.

CAPA and complaint handling: how a factory learns

A quality system shows its worth in how it responds to failure. ISO 13485 requires corrective and preventive action (CAPA) and complaint-handling processes, and this is where you find out whether a manufacturer treats problems as events to close or as data to learn from.

Ask to see a closed CAPA record and examine the problem, any immediate correction or containment, cause analysis, chosen action and evidence of effectiveness appropriate to the issue and risk. Corrective action addresses actual nonconformities and their causes; preventive action addresses potential nonconformities. The FDA’s final rule, response 20, preserves that distinction. A record that lists only operator retraining leaves cause and effectiveness questions unresolved; it does not, by itself, prove the defect will recur. For complaints, ask how information reaches the responsible team, how the response is recorded, and how any applicable reporting criteria are assessed.

Internal audits and management review

Two 13485 requirements tell you whether the system runs on its own or only when a customer is watching. Internal audits: the organization audits itself against the standard on a schedule. Management review: leadership formally reviews the quality data (audit results, complaints, CAPA status, nonconformances) and acts on it.

During a supplier audit, ask for the internal-audit schedule and a recent internal-audit report, and ask when the last management review happened. A factory that audits itself regularly, and whose management reviews produce actions, has a self-correcting system. One where these exist only as blank templates has a certificate but not a working QMS. That difference will show up in your product.

How to verify an ISO 13485 contract manufacturer when sourcing from Taiwan

Taiwan has a deep base of ISO 13485-certified manufacturers. That’s exactly why you need a verification routine instead of trust in the logo.

1. Confirm the certificate is real and current. Get the certificate number, the certification body, and the accreditation behind it. Check it against the certification body’s registry or a cross-registrar database, and match the legal entity name to your contract.
2. Read the scope statement. Confirm it covers your device type and the work you need: manufacture only, or design and development plus manufacture.
3. Audit traceability live. Pull a lot number and have them walk it backward on the floor.
4. Check documentation against reality. Compare a medical device file to an actual batch record for the same product.
5. Test change control. Ask how an engineering change order moves through their system and who signs off.
6. Confirm regulatory support matches your market. For US work, ask how the supplier’s current procedures and production records meet applicable QMSR requirements, including how earlier records are mapped. Confirm the manufacturing documentation and testing support included in its agreed scope.

For the broader question of choosing a Taiwanese partner (the factory tour checklist, red flags, and IP protection), see our guide to evaluating a Taiwan supplier.

How we run it

Gooten Innolife holds ISO 13485:2016 and ISO 9001:2015 certification, and every certificate we hold is verifiable. Ask, and we’ll give you the numbers to check. We manufacture in Taichung, Taiwan, with production, R&D, and quality assurance on one site, so traceability questions and engineering changes get resolved on the floor.

Quality assurance runs across our five-phase process, with pre-production, in-process, and final inspection plus third-party testing. We have compliance experience with CE, FCC, RoHS, and PSE, and we provide documentation and testing support for FDA submissions. We’ve shipped more than 1,000,000 units to customers in over 50 countries, including a US hair-growth device leader who’s built four product generations with us since 2008.

You can review our quality and certifications and OEM/ODM services for the full picture.

Verify us before you commit

If you’re vetting an ISO 13485 contract manufacturer, put us through the checklist above. Contact our engineers, send the technical detail, and check our answers against your own audit standard.