Guides / Quality and Compliance

The Scope Line: How to Read an ISO 13485 Certificate Properly

September 23, 2026

Almost every machine shop selling into medical devices leads with the same line: ISO 13485 certified. It appears in the page title, the header and the footer, usually next to a logo.

The certificate is worth having. It is also the single most misread document in this supply chain, because buyers treat it as a pass or fail when it is neither. A certificate is a statement that a defined set of activities, at defined sites, was audited against the standard by a named body, on a date, for a period.

Change any of those four variables and the certificate means something different. Here is how to read one in about four minutes.

1. The scope line

This is the one that catches people, so it goes first.

Certification is granted against a scope: a sentence describing what the certified quality system actually covers. Scopes in this industry legitimately read things like:

• “Design, development and manufacture of orthopedic implants and instruments”
• “Contract manufacture, assembly and packaging of medical devices”
• “Distribution and servicing of medical devices”
• “Precision machining of medical device components”

Only the last of those tells you the machining is inside the certified system. A shop certified for assembly and distribution holds a completely genuine, completely current certificate that says nothing at all about how it machines a bone screw.

Nobody is necessarily lying. The certificate is real and the logo on the website is real. But if your supplier file rests on that certificate covering machining, and the scope line does not say so, the file does not say what you think it says.

What to do: ask for the certificate as a document, read the scope sentence, and satisfy yourself it names machining or the manufacture of the kind of part you are buying. If the scope is vague, ask the shop which activities its certification body audited.

2. The issuing body, and whether it is accredited

Certification bodies are not all equivalent. The ones worth relying on are themselves accredited, normally by a national accreditation body that is a signatory to the International Accreditation Forum arrangement. Accreditation is the mechanism that puts the certifier under oversight instead of leaving it to mark its own homework.

A certificate from an unaccredited body is not automatically meaningless, but it carries much less weight, and if your own auditor raises it you will be the one explaining.

What to do: note the body’s name and its accreditation mark, then check the accreditation body is an IAF signatory. It takes a minute and it is the sort of thing that is embarrassing to discover late.

3. The sites

Certificates name the site or sites covered. Groups with several plants hold multi-site certificates that list each one.

The failure mode here is ordinary and commercial rather than sinister: work gets quoted by the certified site, then moved to a sister plant with spare capacity, and the sister plant is not on the certificate. Your parts are now made outside the certified system and your file does not record it.

What to do: check that the site making your part is named. Then put change of manufacturing location into your change notification agreement, because a certificate check only tells you about today.

4. The dates

Certificates run on roughly three year cycles with surveillance audits in between. Two dates matter, the expiry and the issue, and one thing that is not on the certificate matters more than either: whether it has been suspended or withdrawn since it was issued.

What to do: take the current certificate at qualification, ask again at re-evaluation, and do not let a 2024 copy sit in a file until 2029. Some certification bodies publish a searchable directory of valid certificates, which is the cheapest possible check.

5. What the certificate still does not tell you

Even a perfect certificate, correctly scoped, accredited, current and naming the right site, is silent on the things that decide whether your part arrives right.

• Whether they can hold your tolerance
• Whether they have machined your material before
• Whether cleaning, passivation and marking are in house or outsourced
• Whether they have capacity for your volume
• Whether they will tell you before changing something
• Whether anyone there has read your drawing properly

ISO 13485 certification is a quality system audit. It is not a capability audit and it is not a capacity audit. A shop can run an immaculate quality system and still be the wrong shop for your part, and the certificate will not warn you.

That is the reason a certificate is where supplier qualification starts rather than where it ends.

A four minute version

Ask the shop for the certificate as a PDF. Then:

1. Read the scope line. Does it name machining, or the manufacture of the part type you are buying?
2. Note the issuing body. Is it accredited by an IAF signatory?
3. Check the site list. Is the plant that will make your part on it?
4. Check the expiry. Is it current today, and will you ask again at re-evaluation?
5. Then start the real work, which is everything in the section above.

If a shop hesitates at any of steps one to four, that hesitation is data. A shop that is proud of its quality system enjoys this conversation.

The certificate is one step of medical device supplier qualification; the guide shows the steps before and after it.

Where we stand

We ask every supplier for the certificate number, the issuing body and the expiry date before it sees a single RFQ preview, and we re-ask when the date passes. We do not audit, we do not qualify a supplier on your behalf and we hold no certification of our own. The scope line in particular is yours to read, because only you know what scope your device needs.

The full version of what we check and what we refuse to claim is on how we check a supplier.

See also: CE certificate or ISO 13485 certificate, on which of the two a part supplier can show.

Sources

• ISO 13485:2016, Medical devices, Quality management systems
• ISO/IEC 17021-1, Requirements for bodies providing audit and certification of management systems
• International Accreditation Forum, list of accreditation body signatories

Standards and regulations change. Check the current text at the source before you rely on it in a submission.

Frequently asked questions

Keep reading

• Supplier Change Notification: What a Machining Shop Must Tell You and What You Do With It
• ISO 10993 and Cutting Fluids: How Machining Residue Enters the Biological Evaluation