Why we promote ISO 13485 & 9001 vendors

What ISO 13485 actually requires

The certificate is not a logo — it is a yearly audit against a documented quality system. The auditor checks evidence in six core areas:

• Documented risk management

  Every product or service line must have a written risk file: what can go wrong, how it is mitigated, what the residual risk is. This file is reviewed every time the product or process changes.

• Traceability of components

  Every part installed in a repair must be traceable back to its source — vendor, lot, date received. If a recall surfaces six months later, the vendor can identify every device that received that part.

• Calibrated test equipment

  Test equipment used to verify a repair must itself be calibrated against a traceable reference standard. A vendor cannot certify that an infusion pump delivers within ±5% if their flow analyzer has not been calibrated.

• Trained personnel

  Each technician must have documented training for the device families they service. Training records are auditable.

• Post-market surveillance

  When a refurbished device fails in use, the vendor must capture the failure, investigate the root cause, and feed it back into their process. This is the loop that distinguishes a quality system from a one-time inspection.

• Annual recertification

  Certification is not a one-time event. The certifying body audits the vendor at least annually; major nonconformances must be remediated to maintain the certificate.

Frequently asked questions

What is ISO 13485?

ISO 13485 is the international quality-management standard specifically for organizations that design, manufacture, install, or service medical devices. Unlike the broader ISO 9001, it adds medical-device-specific requirements: documented risk management, traceability of every component back to its source, sterilization and cleanliness controls, regulatory documentation, and post-market surveillance.

How is it different from ISO 9001?

ISO 9001 is a general quality-management standard applicable to any industry. ISO 13485 builds on the same foundation but adds medical-device-specific clauses around risk, traceability, and regulatory compliance. Many of the strongest medical equipment vendors hold both — 9001 for general quality, 13485 for the medical-device-specific scope.

Why does the certification matter for refurbished or repaired equipment?

A repaired infusion pump or patient monitor that fails in use can harm a patient. ISO 13485 forces the repair vendor to document each step, keep traceability on every part installed, calibrate against known references, and run post-repair functional tests. Without that scaffolding, a "repaired" device is often just a unit that powered on once on a workbench.

Are all EzMedSource vendors ISO 13485 certified?

No — but every approved vendor is independently classified, and certifications are listed publicly on each vendor profile. We surface ISO certifications as filters on the vendor directory so buyers can scope their RFQs to the certification floor their procurement policy requires.

Is ISO certification the same in the US and Europe?

The standard itself is identical worldwide. The major difference is uptake: ISO 13485 / 9001 certification is more universally required by EU procurement processes than by US ones. For US hospitals, an ISO-certified supply chain is increasingly a procurement-policy floor — but it is not (yet) a regulatory requirement the way it is for European markets.

How do you verify a vendor's certification?

Vendors submit certificate copies during onboarding. Our admin team checks the certification body, the scope of the certification (the certificate must cover the activity the vendor performs on the marketplace), and the expiry date. Certifications are re-verified annually.