🏥 ISO 13485
ISO 13485:2016 CNC Machining for Medical Device Components
A bone screw and a bracket can be cut on the same machine, but only one of them needs a documented risk file, a validated cleaning process, and a device history record that survives an FDA audit. ISO 13485:2016 is the quality standard that turns a capable CNC shop into a defensible medical device supplier, and it is built around a different mindset than ISO 9001: documented control and risk over continual improvement.
ISO 13485ISO 9001ISO 14001
ISO 13485:2016 shares structural DNA with ISO 9001 but deliberately drops the continual improvement emphasis in favor of maintaining the effectiveness of the quality system and meeting regulatory requirements. For a CNC shop machining implants, instrument components, or fluidic device parts, that shift is concrete. The standard pulls risk management forward (clause 7.1 references ISO 14971), so the shop must understand and control the risks tied to the specific features it produces, not just hit a tolerance.
The documentation expectations are heavier and more rigid. Clause 4.2.3 requires a medical device file for each device or device family the shop contributes to, and clause 4.2.4 imposes strict document and record control with defined retention periods that often run the life of the device plus a regulatory tail. Process validation under clause 7.5.6 is mandatory where output cannot be fully verified by later inspection, which on the machining floor commonly applies to cleaning and passivation rather than the cut itself.
The other practical difference is the device history record (DHR) discipline. Each lot of machined parts carries a record proving it was made under the released, validated process, by trained operators, on calibrated equipment, with the correct material lot. A 13485 audit will trace a finished part backward through that record, and a shop that cannot reconstruct it fails.
How ISO 13485 Connects to FDA 21 CFR 820 and EU MDR
ISO 13485 is the international quality standard, but it does not replace the regulations a device must satisfy in a given market. In the United States the FDA Quality System Regulation, 21 CFR Part 820, governs device manufacturers, and the FDA has been harmonizing it toward ISO 13485 under the Quality Management System Regulation final rule. A 13485-certified contract machining supplier makes a device manufacturer's own 820 compliance dramatically easier, because the supplier's controls, validation, and records already map to what an FDA investigator expects.
In Europe, the EU Medical Device Regulation (MDR 2017/745) raised the bar on traceability and technical documentation, and ISO 13485 is the practical backbone manufacturers use to demonstrate conformity. For your machined component, MDR pressure shows up as deeper material traceability, UDI-driven lot control, and supplier controls flowed down to the shop.
The key point for a buyer: ISO 13485 certification at the contract machining level is not the same as the finished device being cleared or CE marked. The shop's certification supports your regulatory submission; it does not constitute it. What you gain is a supplier whose system speaks the same language as the regulators auditing you.
Cleanliness, Validation, and the Materials That Drive Demand
Medical machining concentrates in implantable and instrument-grade materials: titanium Ti-6Al-4V and the lower-interstitial Ti-6Al-4V ELI for implants, 316L and 17-4 PH stainless for instruments and housings, cobalt-chrome for wear surfaces, PEEK and other implantable polymers for spinal and fixation hardware. The tolerances are often tight, but the differentiator is what happens after the cut: deburring, passivation per ASTM A967 or AMS 2700 for stainless, and validated cleaning to remove machining fluids and particulate.
Because final cleanliness usually cannot be fully verified by inspection on every part, clause 7.5.6 forces process validation through IQ, OQ, and PQ protocols. The shop establishes that its cleaning and passivation processes, run within defined parameters, reliably produce conforming, biocompatible surfaces. This validation file is something a serious buyer should expect to review.
Demand for this combination is heaviest in orthopedics, spinal, dental, surgical instruments, drug-delivery and fluidic components, and increasingly in diagnostic and lab-on-chip device housings. In all of these, the machined part is a regulated component, and the 13485 system is what keeps it defensible.
Frequently Asked Questions
If the machined part is a component of a regulated medical device, you almost always want ISO 13485. ISO 9001 proves a credible general quality system, but ISO 13485:2016 adds the medical-specific controls regulators expect: ISO 14971 risk management, medical device files, strict record retention, mandatory process validation where output cannot be fully verified, and device history record discipline. A 13485-certified machining supplier makes your own FDA 21 CFR 820 or EU MDR compliance far easier because their controls already align with what auditors look for. There are edge cases where a 9001 supplier is acceptable, for example non-contacting accessory parts or capital equipment components that are not part of the device itself, but those are exceptions and your regulatory team should make the call. As a default, regulated device components should come from a 13485-certified shop, and the certification should be verified for current status and a scope that names medical device machining.
Expect more than a commercial shop provides. At minimum you should receive a certificate of conformance referencing the device or part number and the controlling drawing revision, full material certifications (mill test reports) traceable to the heat or lot, and lot or serial traceability connecting finished parts back to the material and the production record. For surface-treated parts, expect passivation certifications per ASTM A967 or AMS 2700, and where cleaning is validated, evidence that the validated process was run within parameters. The supplier should also be able to produce, on request, the device history record for the lot, training records for the operators, and calibration records for the gauges used to accept the parts. Because clause 4.2.4 imposes defined retention periods, the shop must keep these records for years, often the life of the device plus a regulatory margin. Specify the exact documentation package on your PO so the shop ships it with each lot rather than scrambling at audit time.
ISO 13485 clause 7.5.6 requires validation of any process whose output cannot be fully verified by subsequent monitoring or inspection. In machining, the cut itself is usually verifiable, you can measure the dimensions, so the cutting is typically verified rather than validated. The processes that get validated are the ones you cannot fully inspect on every part: cleaning to remove machining fluids and particulate, passivation of stainless, and sometimes deburring of internal features you cannot see. Validation means the shop runs formal installation, operational, and performance qualification (IQ, OQ, PQ) to prove the process reliably produces conforming results within a defined parameter window, then controls those parameters in production. This matters because a residual coolant film or embedded iron on a stainless implant is a biocompatibility and corrosion risk that no dimensional check would catch. When you audit or qualify a 13485 machining supplier, asking to see the validation files for cleaning and passivation is one of the fastest ways to tell a real medical shop from a general shop with a medical certificate.
Start with the certificate itself: confirm the issuing registrar, the scope (it should explicitly cover machining of medical device components, not a generic statement), the registered site address matching where your parts will actually be cut, and the expiry date within the three-year cycle with a recent surveillance audit. Then verify the registrar is accredited by a recognized accreditation body that is an IAF MLA signatory, such as ANAB in the US. Unlike aerospace, ISO 13485 has no single universal public database like OASIS, so verification usually means checking the registrar's own online directory or contacting them with the certificate number. Be alert to scope mismatches and multi-site traps, where a corporate certificate is presented but the parts are machined at an uncertified location. Also note that ISO 13485 certification is not the same as FDA registration or a device clearance; a shop can be 13485 certified and still need to be a registered establishment for certain activities. ManufacturingBase listings surface the registrar and scope so you can run these checks before requesting a quote.
Last updated: July 2026
Find ISO 13485-Certified CNC Machining Suppliers
Search verified cnc machining shops that hold ISO 13485.
No logins. No email gates. Just results.