ISO 13485 and Medical 3D Printing Explained

Summary

ISO 13485 is a medical-device quality management system standard. A quality management system, or QMS, is the documented set of processes used to control design, purchasing, production, traceability, complaints, corrective actions, and related activities. The current edition is ISO 13485:2016, Edition 3, published in March 2016 and confirmed in 2025. It is a QMS standard, not blanket approval for every printer, material, or part a company touches. Certification can be useful third-party evidence, but certification is not required by the standard itself, and ISO does not perform certification. [1] [2]

For medical 3D printing, that distinction matters even more after February 2, 2026, when FDA’s Quality Management System Regulation became effective and amended 21 CFR Part 820 to incorporate ISO 13485:2016 and clause 3 of ISO 9000:2015 by reference. That alignment does not convert a certified QMS into FDA clearance, approval, or proof that a device is suitable for a specific patient. It also does not prove biocompatibility, which FDA assesses on the final finished device form, including sterilization if applicable. If a device has no direct or indirect tissue contact, FDA says no further biocompatibility information would be needed in the submission. [3] [8]

Why this matters in medical additive manufacturing

Medical additive manufacturing adds control points that are easy to underestimate. Build orientation, support strategy, file conversion, material handling, machine state, software settings, post-processing, cleaning, sterilization, and inspection can all change the finished part. FDA’s additive-manufacturing guidance recommends characterizing each critical manufacturing step from initial device design through post-processing, with documented risks and mitigations. [6]

That is where ISO 13485 matters. It helps create a disciplined record of how evidence is generated, reviewed, changed, and retained across the workflow. But QMS control still sits alongside device-specific design documentation, verification, design validation, performance testing, and biological evaluation. FDA evaluates finished devices and the evidence supporting them, not a generic claim that a printing workflow is compliant. [6] [7]

Current standards and regulatory context

The current ISO 13485 edition remains ISO 13485:2016, Edition 3, published in March 2016 and confirmed in 2025. In the United States, the major recent shift is FDA’s QMSR, which became effective on February 2, 2026, and incorporates ISO 13485:2016 by reference. For many U.S.-regulated device manufacturers, that makes ISO 13485 more than a voluntary reference point. [1] [3]

The broader pattern is convergence around structured quality systems, but the convergence is not total. In the European Union, MDR Article 10(9) requires manufacturers to establish, document, implement, maintain, keep up to date, and continually improve a QMS. That does not create a universal passport across markets, because each jurisdiction still has its own conformity assessment, technical documentation, evidence, and post-market obligations. [14]

What ISO 13485 actually controls in an additive-manufacturing workflow

Additive manufacturing (3D printing) builds an object by sequentially forming two-dimensional layers and joining each layer to the one below. FDA’s final technical guidance for additively manufactured medical devices was issued on December 5, 2017. In an ISO 13485-based workflow, control reaches well beyond the printer itself. It covers document control for design files and work instructions, equipment maintenance and calibration, operator training, material status, traceability, nonconformance handling, release records, supplier interfaces, complaints, and CAPA. [5] [6]

AM workflow control points that make ISO 13485 matter

FDA recommends characterizing critical AM steps from initial design through post-processing, with documented risks and mitigations. In practice, that means controlling how geometry moves from source data to printable files, how build placement and support material are chosen, how slicing and build paths affect quality, how machine parameters and environmental conditions are maintained, and how material reuse is justified. FDA also notes that software changes may trigger revalidation, and that final device files for printing should be maintained and archived when possible. [6]

AM workflow controls an ISO 13485-based QMS should lock down. [6]

• CAD or source-file control
• Segmentation controls where patient imaging is used
• File-format conversion and repair history
• Nesting, orientation, build placement, and support strategy
• Approved machine parameter sets and calibration status
• Build records and operator signoffs
• Powder or resin handling and reuse
• Recoater or build anomalies where relevant
• Post-processing records, including support-removal methods in the Device Master Record
• Rework limits and post-rework acceptance
• Software version control and revalidation triggers
• Outsourced finishing, testing, packaging, or sterilization interfaces
• Change control

Release controls then tie the build to acceptance evidence. FDA points to specified tolerances, worst-case dimensional measurements, orientation and build-location effects, visual criteria, nondestructive evaluation, and test coupons as examples of AM acceptance activities. After release, the same QMS has to connect supplier control, complaints, nonconformances, CAPA, and post-market feedback back to the build history. In medical AM, that loop matters because a software update, reused powder ratio, finishing vendor change, or machine-maintenance change can affect later builds. [6]

Verification, validation, design controls, and process validation in AM

Verification asks whether outputs meet inputs. Design validation asks whether the device specifications meet user needs and intended use. Software validation asks whether the digital workflow behaves as intended for its use. Process validation asks whether the manufacturing process repeatedly produces acceptable output when later inspection cannot fully verify every important characteristic of every unit. FDA’s design-control materials use the classic shorthand: verification is “Did I make the product correctly?” and design validation is “Did I make the correct product?” FDA also notes that design controls remain applicable in investigational contexts. [10] [11]

In AM, these distinctions prevent a common mistake: using “validated” as a synonym for “tested.” A dimensional check may verify one printed coupon, but it does not by itself validate intended clinical use or every upstream software step. FDA says software changes may trigger revalidation, and it says AM process validation should address quality across build cycles and even across machines when outputs cannot be fully verified later. Acceptance evidence can include dimensional tolerances, worst-case measurements, orientation effects, visual criteria, nondestructive evaluation, and coupons. [6]

What ISO 13485 does not certify

Certificate scope matters. IAF MD 9:2023 says the certification body shall precisely document the scope of certification and shall not exclude processes, products, or services from scope when they influence the safety and quality of products. It also says sites involved in design, development, and manufacturing of medical devices cannot be sampled in multi-site sampling. A buyer should read the actual certificate scope, sites, and activities rather than treating a brand name or logo as a company-wide claim. [20]

In the U.S., QMSR now incorporates ISO 13485 by reference, but other FDA duties remain in force. A certified QMS can show that an organization has documented controls, records, responsibilities, and audits. It does not by itself certify a printed implant, prove biocompatibility, validate a software workflow, or establish that an outsourced sterilization step is under adequate control for your device. [3] [8] [20]

ISO 13485, risk management, and biocompatibility

Biocompatibility is the biological suitability of a device for its intended contact with the body. ISO 13485 can control how biological-evaluation evidence is planned, reviewed, approved, changed, and retained, but it does not make a material biocompatible. Risk management is typically handled through a related but separate framework; ISO 14971:2019 is Edition 3, published in December 2019 and confirmed in 2025. Biological evaluation is anchored in the ISO 10993 series; ISO 10993-1:2025 is Edition 6, a 42-page standard published on November 18, 2025, and ISO describes it as the cornerstone standard for biological evaluation. FDA’s own submission guidance also frames ISO 10993-1 within a risk-management process rather than as a stand-alone checklist. [12] [13] [9]

Questions to ask before calling a 3D printing material biocompatible. [8] [9] [13]

• What is the intended use?
• Is contact direct or indirect?
• Which tissue type is contacted?
• What is the contact duration?
• Does final geometry or porosity change exposure or cleaning?
• What cleaning steps are used?
• What curing, sintering, or heat-treatment steps are required?
• What sterilization method is used?
• What residuals could remain from material, cleaning, processing, or sterilization?
• What is the packaging and storage state before use?
• Does the claim apply to the raw material, a printed coupon, or the finished device?

FDA’s biocompatibility framing is device-specific. If a device has no direct or indirect tissue contact, FDA says no further biocompatibility information would be needed in the submission. If there is contact, FDA says the evaluation should address the final finished form, including sterilization if applicable, and should consider manufacturing methods and residuals. That is especially important in AM, where cleaning, cure state, porosity, support-removal residues, and post-processing can change the exposure picture. [8]

A bounded vendor example shows why wording matters. Formlabs markets BioMed Durable Resin as being manufactured in an FDA-registered, ISO 13485-certified facility and states specific contact-duration claims under stated conditions, including long-term skin contact, mucosal membrane contact, and short-term tissue, bone, and dentin contact. That may be relevant evidence for a defined material and workflow, but it does not generalize to every printed geometry, printer, cure cycle, cleaning method, sterilization route, package configuration, or clinical indication. [21]

Who may need ISO 13485 in the medical-AM chain?

In medical AM, ISO 13485 relevance depends less on the printer model than on legal responsibility, market, risk class, and contract structure. In the U.S., QMSR applies in FDA’s finished-device manufacturing context. In the EU, MDR Article 10(9) imposes a manufacturer QMS duty, and Annex IX is one major QMS-linked conformity-assessment route. But the chain also includes service bureaus, hospitals, dental labs, material suppliers, and software providers whose obligations differ. [3] [14]

Do not collapse categories. MDCG 2021-3 says patient-matched devices are not custom-made devices and must follow the standard MDR pathway. FDA’s point-of-care document also says patient-matched devices are not custom devices unless the statutory exemption criteria are met, and FDA is explicit that the document is a discussion paper, not guidance. The EU’s Article 5(5) in-house context is likewise narrow: it covers devices manufactured and used strictly in health institutions on a non-industrial scale for specific patient-group needs that cannot be appropriately met by an equivalent market device. As a bounded illustration, 3D Systems describes FDA-registered, ISO 13485-certified facilities in North America and Europe, but that kind of facility statement still has to be read against the certificate’s actual scope and sites. [15] [17] [18] [16] [20] [22]

U.S. and EU context without false harmonization

In the United States, the QMSR became effective on February 2, 2026, and incorporates ISO 13485:2016 and clause 3 of ISO 9000:2015 by reference. FDA also says that, on that same date, it stopped using the Quality System Inspection Technique and began using the updated inspection process in Compliance Program 7382.850. QMSR increases alignment with ISO 13485, but it does not erase jurisdiction-specific submission, classification, evidence, or enforcement requirements. For AM teams, the same controlled build workflow may still require different files, test rationales, and labeling depending on the device pathway. [3] [4]

In the EU, MDR Article 10(9) frames the manufacturer’s QMS broadly, covering regulatory strategy, supplier control, risk management, clinical evaluation, product realization, UDI, post-market surveillance, vigilance, CAPA, and monitoring. Annex IX is one QMS-based conformity-assessment route, not the only route and not a shortcut around technical documentation. MDSAP is a different kind of tool again: FDA describes it as a single regulatory audit program for participating authorities, with members including Australia, Brazil, Canada, Japan, and the United States. It is an audit pathway, not product approval for a printed implant, surgical guide, dental device, or patient-matched instrument. [14] [19]

Practical checks for buyers and in-house teams

For buyers selecting partners, treat an ISO 13485 claim as a QMS claim and then ask whether it matches the device, site, and outsourced process you are buying. [1] [20]

• Read the certificate scope, not just the logo, because the audited scope, sites, and activities define what is covered. [20]
• Check whether the supplier’s QMS covers design control, production, inspection, release, complaints, and change control relevant to the printed device. [1]
• Separate the certificate from product evidence, because biocompatibility still depends on the final finished form, including sterilization if applicable. [8]

For in-house teams building workflows, use ISO 13485 to connect traceability, design control, validation, and release evidence rather than treating printing as an isolated lab task. [3] [14]

• Map each controlled AM step to records: source files, build preparation, material lots, machine settings, post-processing, inspection, and release
• In the U.S., remember that QMSR incorporates ISO 13485 by reference, but device-specific duties remain. [3]
• In the EU, align the workflow with Article 10(9) duties, including supplier control, risk management, product realization, post-market surveillance, vigilance, and CAPA. [14]

Common misconceptions to avoid

• Myth: “ISO 13485 certified” is universal. Correction: certification is not required by the standard itself, and the claim only becomes meaningful when tied to a defined organization, scope, and activity. [2] [20]
• Myth: a certified facility covers every branded offering. Correction: certificate boundaries matter, and IAF MD 9 requires scope to be documented precisely. [20]
• Myth: a medical material is cleared for all printed devices. Correction: FDA typically clears or approves finished devices, not specific materials for general use across every device type. [7]
• Myth: biocompatible 3D printing materials stay biocompatible under any workflow. Correction: biocompatibility depends on intended use, contact type, and the final finished state. [8]
• Myth: process validation is just a successful build. Correction: it concerns whether a defined process repeatedly stays within limits when later inspection cannot fully verify every important characteristic. [6]
• Myth: hospital point-of-care printing is a single settled category. Correction: FDA’s PoC paper is for discussion purposes, and the EU’s in-house health-institution context is narrow and non-industrial scale. [17] [18] [16]

Research and standards update to note

For biological-evaluation discussions, ISO 10993-1:2025 is now the current ISO reference point. That matters because the language around contact, duration, material characterization, and biological hazards should follow the current edition rather than older shorthand about a “biocompatible resin.” [13]

For U.S. readers, the key date is February 2, 2026, when QMSR became effective. After that date, the quality-system conversation is framed more directly around ISO 13485, while FDA submission and enforcement questions remain device-specific. [3]

What ISO 13485 means for medical 3D printing teams

ISO 13485 is a medical-device QMS standard, and in the U.S. it is now incorporated by reference under QMSR. For buyers selecting partners, the practical move is to read the certificate scope carefully, because the audited sites and activities define what the claim covers. [1] [3] [20]

For in-house teams building workflows, the useful question is whether the system controls the AM-specific evidence trail from design inputs and files to materials, machine settings, post-processing, inspection, release, complaints, and changes. In both U.S. and EU contexts, biocompatibility still has to be evaluated on the final finished form, including sterilization if applicable. The core point is simple: ISO 13485 governs the QMS, while device authorization, biological evaluation, and process or device evidence remain separate obligations. [8] [14]

FAQ

What is ISO 13485 medical device certification?

It is third-party attestation that an organization’s QMS was audited against ISO 13485 requirements. The current edition is ISO 13485:2016, and certification is not required by the standard itself. The certificate applies to the audited scope, sites, and activities, not everything sold under the brand. [1] [2] [20]

Does ISO 13485 mean a 3D printed device is FDA approved or CE marked?

No. In the U.S., QMSR became effective on February 2, 2026, and incorporates ISO 13485 by reference, but that does not turn a QMS certificate into product authorization. In the EU, conformity assessment remains separate, and Annex IX is only one route. [3] [14]

How does ISO 13485 relate to 3D printing?

It helps control the workflow around 3D printing, not just the printer. FDA’s AM guidance points to controls over digital files, software, build preparation, material handling and reuse, post-processing, acceptance activities, and traceability. [5] [6]

Are biocompatible 3D printing materials always required for medical devices?

Not always. If a device has no direct or indirect tissue contact, FDA says no further biocompatibility information would be needed in the submission. If there is contact, the final finished form matters, including sterilization if applicable. ISO 10993-1:2025 is the current key ISO reference point. [8] [13]

Do ISO 13485-certified 3D printing services make my device compliant?

Not by themselves. They may support a compliant supply chain, but the certificate must match the site, process, and activity you are buying, and device-specific regulatory responsibilities still remain with the relevant manufacturer and product pathway. 3D Systems’ facility language is a useful illustration of market phrasing, not a substitute for certificate-scope review. [20] [22]

How is process validation different from design validation in additive manufacturing?

Design validation asks whether the device meets user needs and intended use. AM process validation asks whether the manufacturing process repeatedly stays within predefined limits when later inspection cannot fully verify every important characteristic of every part. In practice, a surgical guide may be design-validated through simulated use, while the AM process is validated through repeated builds across cycles or machines. [10] [11] [6]

Are patient-matched and custom-made devices the same under EU rules, and is hospital point-of-care printing a separate category?

No. MDCG 2021-3 says patient-matched devices are not custom-made devices under the MDR. FDA’s PoC paper likewise says patient-matched devices are not custom devices unless the statutory exemption criteria are met, and FDA labels that document as a discussion paper rather than guidance. The EU in-house health-institution context under Article 5(5) is also narrow and non-industrial scale. [15] [17] [18] [16]

Sources

1. ISO 13485:2016 – Medical devices — Quality management systems — Requirements for regulatory purposes. https://www.iso.org/standard/59752.html
2. ISO 13485 — Medical devices. https://www.iso.org/iso-13485-medical-devices.html
3. Quality Management System Regulation (QMSR). https://www.fda.gov/medical-devices/postmarket-requirements-devices/quality-management-system-regulation-qmsr
4. Quality Management System Regulation – Frequently Asked Questions. https://www.fda.gov/medical-devices/quality-management-system-regulation-qmsr/quality-management-system-regulation-frequently-asked-questions
5. Technical Considerations for Additive Manufactured Medical Devices. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/technical-considerations-additive-manufactured-medical-devices
6. Technical Considerations for Additive Manufactured Medical Devices – Guidance for Industry and Food and Drug Administration Staff. https://www.fda.gov/media/97633/download
7. Process of 3D Printing Medical Devices. https://www.fda.gov/medical-devices/3d-printing-medical-devices/process-3d-printing-medical-devices
8. Basics of Biocompatibility: Information Needed for Assessment by the FDA. https://www.fda.gov/medical-devices/biocompatibility-assessment-resource-center/basics-biocompatibility-information-needed-assessment-fda
9. Use of International Standard ISO 10993-1, “Biological evaluation of medical devices – Part 1: Evaluation and testing within a risk management process”. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/use-international-standard-iso-10993-1-biological-evaluation-medical-devices-part-1-evaluation-and
10. Design Controls. https://www.fda.gov/media/94072/download
11. IDE Related Topics. https://www.fda.gov/medical-devices/investigational-device-exemption-ide/ide-related-topics
12. ISO 14971:2019 – Medical devices — Application of risk management to medical devices. https://www.iso.org/standard/72704.html
13. ISO 10993-1:2025 – Biological evaluation of medical devices — Part 1: Requirements and general principles for the evaluation of biological safety within a risk management process. https://www.iso.org/standard/10993-1
14. Regulation (EU) 2017/745 – Medical Device Regulation. https://eur-lex.europa.eu/eli/reg/2017/745/oj
15. MDCG 2021-3 Questions and Answers on Custom-made devices & considerations on adaptable medical devices and patient-matched medical devices. https://health.ec.europa.eu/system/files/2021-03/mdcg_2021-3_en_0.pdf
16. In-house medical devices. https://health.ec.europa.eu/medical-devices-topics-interest/house-medical-devices_en
17. 3D Printing Medical Devices at the Point of Care: Discussion Paper. https://www.fda.gov/medical-devices/3d-printing-medical-devices/3d-printing-medical-devices-point-care-discussion-paper
18. Discussion Paper: 3D Printing Medical Devices at the Point of Care. https://www.fda.gov/media/154729/download
19. Medical Device Single Audit Program (MDSAP). https://www.fda.gov/medical-devices/cdrh-international-affairs/medical-device-single-audit-program-mdsap
20. IAF MD 9:2023 – Application of ISO/IEC 17021-1 in the Field of Medical Device Quality Management Systems (ISO 13485). https://iaf.nu/iaf_system/uploads/documents/IAF_MD9_Issue_5_20112023.pdf
21. BioMed Durable Resin. https://formlabs.com/store/materials/biomed-durable-resin/
22. Medical Devices | 3D Systems. https://www.3dsystems.com/solutions/healthcare