Not every EMS provider that lists ISO 13485 on a capabilities page has the same depth behind it. The certification sets a baseline. But it’s the provider’s operational maturity that determines whether it can support a medical device program through its full lifecycle.
Read on as we detail what to look for in an ISO 13485 partner, covering eight key considerations.
ISO 13485 is the international quality management standard written specifically for medical device manufacturers. It sets requirements for quality management processes, including document control, risk management, design controls, and traceability. Facilities earn it through an external audit, conducted by an independent, accredited certification body.
Two providers can both hold ISO 13485 and still differ in how mature their systems are. When evaluating providers, it helps to know what to look for. Here are eight key considerations.
ISO 13485 is the baseline. Depending on program requirements, such as the device type and target markets, a provider may also need additional certifications. These may include ISO 9001 for general quality management, IATF 16949 for automotive applications, or country-specific marks tied to where the product will be sold. Ask which certifications apply to the specific facility that will build the device, not just the company as a whole (since certification is granted site by site).
Certification confirms that a quality management system exists. It says less about how mature that system actually is. To evaluate a provider’s QMS maturity, ask:
Every component in a medical device's bill of materials has to stay available for as long as the device stays on the market, which for some devices is a decade or more. Sourcing decisions made during design need to account for what happens when a part reaches end of life.
The practical response is a mix of approved vendor lists, qualified second sources for critical components, and active monitoring of supplier product change notifications, so a discontinuation gets flagged and an alternate evaluated before it forces a production stop.
Where a substitute is needed, the change goes back through the OEM and, if the part affects performance, through revalidation. Long lead-time components are ordered early for the same reason: committing to them before the rest of the design is settled is safer than discovering a shortage once the line is running.
Moving from a pilot build to full production is where a validated process gets tested at scale. That step typically runs through an IQ/OQ/PQ framework:
Traceability lets a manufacturer track the complete history of a device and its components. This includes linking finished devices to the components, production steps, and test results involved in their manufacture. A provider’s traceability capability depends on how production records are captured (for example, automated systems can support more consistent recordkeeping). Ask how quickly a provider can produce a complete record if a field issue requires investigation.
A provider's own certification supports an OEM's regulatory submission, but it does not replace it. What matters is whether the provider can hand over the documents a submission actually needs. That means maintaining supporting documentation (from device history records to validation protocols) as work happens—not reconstructing it once an audit is scheduled.
Where a provider's certified facilities are located affects logistics and operational factors, including lead times, freight costs, and how easily a program can move between sites without losing its validated process. For example, Asteelflash holds ISO 13485 certification at eight facilities:
That footprint allows a device program to move between early builds near an OEM’s engineering team and higher-volume production sites selected for regional cost or market proximity, while remaining within the same certified quality system. When evaluating providers, confirm certification at the specific facility involved. Don’t assume it applies across all company locations.
Some ISO 13485-certified providers are built for high-volume, consumer-scale production. Others focus on medium-mix work at lower volumes, which is more typical of medical device programs serving specialized clinical or diagnostic markets. Ask where a provider’s certified capacity is best suited, since a line built for one volume profile may not be easily repurposed for another.
ISO 13485 requires risk management to run throughout a product’s lifecycle. In manufacturing, a provider should apply failure mode and effects analysis (FMEA) to its own process steps and follow control plans that define what is monitored and what triggers a response. It should also be able to explain how it determines when a deviation is logged and when production should stop. Ask to see how that process was applied to an actual production issue, not just the procedure on paper.
A provider's audit history (from its certification body and customers) can provide more insight than the certificate alone. Ask how recently the facility was audited and whether any findings required corrective action. Providers should be able to share relevant audit results or summaries as part of a supplier qualification process.
Asteelflash holds ISO 13485 certification at eight facilities across the United States, Mexico, France, Germany, Poland, Tunisia, and China, supporting medical device programs from early prototype builds through full-scale volume production.
Explore Asteelflash's medical device capabilities.
ISO 13485 is the international quality management standard for medical device manufacturers, covering document control, risk management, design controls, and traceability. For an EMS provider, it means production operates within a quality system designed specifically for regulated medical devices.
Asteelflash works across a range of industries, including aerospace and defense, industrial, automotive, consumer, medical, and humanoids.
Since February 2026, FDA’s 21 CFR Part 820 has incorporated ISO 13485:2016 by reference, aligning U.S. quality system requirements more closely with the standard. EU MDR also recognizes ISO 13485 as a standard manufacturers use to demonstrate their quality management system, though certification alone does not establish compliance for a specific device.
IPC Class 3 is the most demanding of three workmanship classes in IPC-A-610, covering products that must keep working and cannot be taken out of service. It applies by contract, not regulation.