ISO certification is one of the clearest ways for a life-sciences company to prove, to partners and regulators alike, that its quality and information systems are built to an internationally recognised standard. Three standards do most of the work in this sector — and one of them is about to change.
ISO 13485: the medical device standard
ISO 13485:2016 specifies requirements for a quality management system where an organisation needs to demonstrate its ability to provide medical devices that consistently meet customer and regulatory requirements. For manufacturers and their suppliers, it is effectively the baseline QMS standard, and it aligns closely with the expectations of the EU Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR). Certification is often a practical prerequisite for doing business across the device supply chain.
ISO 9001 — and the 2026 revision
ISO 9001 is the general quality-management standard used across industries. The current edition dates from 2015, but a significant update is imminent: the Draft International Standard was published in August 2025, and ISO 9001:2026 is expected to be published around September 2026, with a three-year transition period running to September 2029. The revision is evolutionary rather than revolutionary — core requirements stay intact, with refinements around quality culture, ethical behaviour and risk management, and the 2024 climate-change amendment now built into the main text. Organisations certified to the 2015 version should start planning their transition now.
ISO/IEC 27001: information security
As pharmacovigilance databases, clinical data and regulatory dossiers move onto digital systems, information security has become a compliance issue in its own right. ISO/IEC 27001:2022 sets the requirements for an information security management system (ISMS) and is increasingly requested by partners who need assurance that sensitive health and safety data is properly protected. For companies handling patient-level safety data, it complements GxP controls rather than duplicating them.
How certification supports GxP compliance
ISO certification and GxP compliance are not the same thing, but they reinforce each other. A certified management system provides the documented processes, internal audits and continual-improvement discipline that inspectors also expect to see. The route to certification — gap assessment, system design, internal audit and a certification audit by an accredited body — mirrors the readiness work that underpins a successful regulatory inspection.
PQRA helps life-sciences companies design, implement and maintain ISO-aligned quality and information-security systems, and prepare for certification and GxP inspection alike. If you are certifying for the first time or transitioning to ISO 9001:2026, we can map the fastest compliant path.
No responses yet