🏥 ISO 13485
ISO 13485:2016 Sheet Metal Fabrication for Medical Devices
A medical device enclosure looks like any other sheet metal box until you ask who can prove the cleaning validation, the lot history, and the change record behind it. ISO 13485:2016 is the quality system that makes a fabricator able to answer those questions, and it is the cert that lets a shop's parts go into a device that touches a patient or a clinician.
ISO 13485ISO 9001ISO 14001
How ISO 13485 reshapes a sheet metal quality system
ISO 13485:2016 shares DNA with ISO 9001 but is purpose-built for medical devices, and the differences are deliberate. It strips out 9001's continual-improvement and customer-satisfaction emphasis and replaces it with risk-based controls aimed at patient safety, aligned to ISO 14971. For a sheet metal shop, the clauses that reshape the floor are 7.5.1 (control of production with documented procedures), 7.5.6 (validation of processes whose output cannot be fully verified, which captures welding and some forming and cleaning steps), and 4.2.5 (record retention for the lifetime of the device, often a decade or more).
Document control under 4.2.4 is tighter than commercial work. Every procedure, drawing, and work instruction is version-controlled, and changes route through a formal review that asks whether the change affects device safety or regulatory status before it is released. A 13485 shop cannot informally tweak a deburring step on a surgical-cart panel without assessing whether that tweak changes a validated cleaning outcome.
The defining habit of a 13485 fabricator is the device history record mindset: building and retaining objective evidence that a specific lot was made under controlled conditions. That means lot traceability on the sheet stock and hardware, recorded process parameters, retained inspection data, and cleanliness or handling controls appropriate to whether the part is non-contact electronics housing or a fluid-path component.
The FDA 21 CFR Part 820 connection buyers rely on
ISO 13485 is not itself U.S. law, but it is the practical backbone of compliance with the FDA Quality System Regulation. As of the FDA's Quality Management System Regulation final rule, 21 CFR Part 820 is being harmonized to incorporate ISO 13485:2016 by reference, which makes a 13485-certified supplier directly relevant to a device manufacturer's FDA obligations rather than a parallel track. For a component fabricator, this matters because the device OEM is responsible for its entire supply chain under design controls and purchasing controls.
When a device maker buys a sheet metal enclosure, chassis, or bracket, they extend their own supplier controls to the fabricator. A 13485 shop already operates with the supplier-evaluation, change-notification, and complaint-handling discipline the OEM needs to satisfy an FDA investigator. The fabricator's change-control under 7.3 and the requirement to notify the customer before altering a process are what keep the device's design history file intact.
For devices sold in the EU, ISO 13485 also underpins the technical documentation and quality-system expectations of the EU MDR (Regulation 2017/745). A fabricator certified to 13485 fits cleanly into a manufacturer's MDR quality system, whereas a 9001-only shop would force the OEM to impose and audit those controls externally.
Cleanliness, materials, and traceability that actually matter
Not every medical sheet metal part needs cleanroom handling, and a good 13485 shop will scope the controls to the part's risk. A painted equipment enclosure for an imaging cart has very different requirements from a stainless component near a sterile field. Common materials run from 304 and 316L stainless (chosen for corrosion resistance and compatibility with cleaning agents) to aluminum 5052 and 6061 for lightweight housings. Surface finish callouts, passivation per ASTM A967 on stainless, and electropolishing show up on parts where cleanability and corrosion matter.
Traceability is the non-negotiable. A 13485 fabricator records the heat or lot of the raw sheet, the hardware lot for press-in fasteners, and the process records that tie a finished lot back to that material. If a raw-material recall hits, the OEM has to identify every device that contains the affected lot, and that is only possible if the fabricator maintained the chain.
Process validation under 7.5.6 is where buyers should focus their audit attention. Welding, certain cleaning processes, and any step whose result you cannot fully inspect after the fact must be validated (IQ/OQ/PQ) and kept under control. Ask how the shop validated its weld parameters and cleaning, because that is the substance behind the certificate.
Frequently Asked Questions
You sometimes can, but it shifts a heavy burden onto you. ISO 9001 does not require the medical-specific controls a device manufacturer must demonstrate to the FDA and notified bodies: risk management aligned to ISO 14971, lifetime record retention, validation of processes whose output cannot be fully verified, formal change notification, and the device-history-record discipline that proves each lot was made under control. If you buy from a 9001-only shop, your own quality system has to impose and audit all of those controls externally, and you become responsible for closing every gap an FDA investigator might probe. For low-risk, non-contact parts like a painted equipment cart panel, a strong 9001 fabricator under your supplier controls can work. But for anything where cleanliness, material traceability, or process validation drives device safety, a 13485-certified shop already operates with the controls baked in, which is faster and lower risk than retrofitting them onto a commercial supplier. Match the supplier's certification to the part's role in the device's risk profile, and document the rationale in your purchasing controls either way.
ISO 13485 is an international quality-system standard; 21 CFR Part 820 is the FDA's Quality System Regulation, U.S. law for device manufacturers. Historically they were similar but separate. Under the FDA's Quality Management System Regulation final rule, Part 820 is being harmonized to incorporate ISO 13485:2016 by reference, which closes most of the gap between them. The practical effect for a sheet metal buyer is that a 13485-certified fabricator now maps directly onto your FDA obligations rather than running on a parallel track. The device OEM remains responsible for the whole supply chain through design controls and purchasing controls, so a 13485 supplier's change-notification, supplier-evaluation, and traceability discipline is exactly what you need to satisfy an investigator. Note that the certification itself is not an FDA registration or clearance; it is evidence of a compliant quality system. You still register the device and supplier relationships under your own FDA obligations. For devices sold in Europe, the same 13485 certification also supports the quality-system expectations of the EU MDR, so a single certified fabricator can serve both markets.
Specify it on the purchase order so it is contractual rather than assumed. At a minimum require a certificate of conformance tied to your drawing and revision, material certifications (mill test reports) traceable to the heat or lot of the sheet stock, and lot identification for press-in hardware. For controlled characteristics, require a dimensional inspection report against the print. Where the part is stainless and corrosion or cleanability matters, request passivation certification per ASTM A967 and the applicable passivation method. If the part undergoes a validated process such as welding or a defined cleaning step, ask for evidence the process ran within its validated parameters, and for cleaning-validation summaries where the part's risk warrants it. The fabricator must retain its device-related records for the lifetime of the device, commonly ten years or more, but retention is not the same as delivery, so you contract for the copies you need. Finally, require change notification in writing: a 13485 shop must tell you before altering a process or material that could affect the part, which protects the integrity of your device history file.
It depends entirely on the part's role in the device, and a competent 13485 shop scopes the controls to that role rather than applying cleanroom handling to everything. A painted outer enclosure or a structural bracket inside a diagnostic instrument usually needs only good housekeeping, lot traceability, and controlled handling to avoid damage and contamination. A component near a sterile field, in a fluid path, or in a patient-contact assembly may require controlled-environment handling, validated cleaning, passivation or electropolishing on stainless, and documented cleanliness limits. Material choice tracks the same logic: 316L stainless for corrosion resistance and compatibility with aggressive cleaning agents, 304 for general structural use, and 5052 or 6061 aluminum for lightweight housings. The right move is to define the cleanliness and handling requirement on the drawing or spec, derived from your device risk analysis under ISO 14971, and confirm the fabricator can meet and document it. Do not pay for cleanroom handling on a part that does not need it, and do not assume a shop will infer a cleanliness requirement you never specified.
Last updated: July 2026
Find ISO 13485-Certified Sheet Metal Suppliers
Search verified sheet metal shops that hold ISO 13485.
No logins. No email gates. Just results.