Updated August 2026. Scope: EU MDR 2017/745, the harmonised standards EN ISO 13485 and EN ISO 14971, and how they map to MDR requirements.
Key takeaways
- EN ISO 13485 (quality management) and EN ISO 14971 (risk management) are harmonised standards under the MDR. Meeting them gives a presumption of conformity with the MDR requirements they cover (MDR Article 8).
- Harmonised does not mean mandatory. Using the standard is voluntary, but it is the most direct route to demonstrating conformity, which is why almost everyone uses it.
- The crosswalk is not one-to-one. ISO 13485 covers most of the MDR quality management requirements, but MDR Article 10 adds obligations that sit outside the standard.
- Risk management is where the two regulations and the standard meet most tightly: the MDR general safety and performance requirements demand a risk management system, and EN ISO 14971 is the recognised way to run one.
Harmonised standards and presumption of conformity
Under MDR Article 8, a device that conforms to the relevant harmonised standards, once their references are published in the Official Journal of the European Union (OJEU), is presumed to conform to the MDR requirements those standards cover. The presumption applies to system and process requirements, including quality management and risk management.
Two standards carry most of that weight:
- EN ISO 13485:2016, Medical devices, Quality management systems, Requirements for regulatory purposes.
- EN ISO 14971:2019 (with amendment A11:2021), Medical devices, Application of risk management to medical devices.
Both are on the harmonised list for the MDR, added through Commission implementing decisions and updated since. Conforming to them is voluntary. It is simply the cleanest path: instead of arguing from first principles that your system meets the MDR, you show conformity to the standard and inherit the presumption.
Where ISO 13485 maps to the MDR, and where it does not
MDR Article 10 requires manufacturers to establish, document, implement, maintain, and keep up to date a quality management system. EN ISO 13485 is the standard built for exactly that, so it carries most of the MDR quality management requirements. But the map has gaps, because Article 10(9) lists quality management aspects that go beyond the classic scope of ISO 13485:
| MDR quality management aspect (Article 10(9)) | Relationship to ISO 13485 |
|---|---|
| Regulatory strategy, including conformity assessment and change management | Broadly covered |
| Resource management, including supplier and subcontractor control | Covered |
| Risk management (per Annex I) | Interfaces with EN ISO 14971 (see below) |
| Clinical evaluation, including post-market clinical follow-up | MDR-specific, beyond ISO 13485 |
| Post-market surveillance | MDR-specific, beyond ISO 13485 |
| UDI assignment and verification | MDR-specific, beyond ISO 13485 |
| Vigilance reporting under Articles 87 to 92 | MDR-specific, beyond ISO 13485 |
The practical consequence: an ISO 13485 certificate is necessary groundwork, but it does not by itself demonstrate a compliant MDR quality management system. The MDR-specific processes, clinical evaluation, post-market surveillance, UDI, and vigilance, have to be built on top and integrated into the same system.
Where ISO 14971 maps to the MDR
Risk management is the tightest connection of the three documents. The MDR general safety and performance requirements (Annex I) require manufacturers to establish, implement, document, and maintain a risk management system, and to reduce risks as far as possible without adversely affecting the benefit-risk ratio. EN ISO 14971 is the recognised process for doing that: risk analysis, risk evaluation, risk control, and the ongoing review of production and post-production information.
Two points matter in practice:
- ISO 14971 gives you the process; the MDR Annex I sets the acceptability bar (reduce risks as far as possible, then weigh residual risk against benefit). The standard does not lower that bar.
- The risk management system is not a standalone binder. It feeds the technical documentation, the clinical evaluation, and the post-market surveillance, and those feed back into it.
How to read the three together
A clean way to hold the relationship:
- The MDR sets the legal requirements.
- EN ISO 13485 and EN ISO 14971 are harmonised standards that, when met, presume conformity with the quality management and risk management requirements the MDR sets.
- The gap between them is the MDR-specific work, clinical evaluation, post-market surveillance, UDI, vigilance, that the standards do not fully cover and that you build into the same system.
Treating ISO 13485 and ISO 14971 as the whole answer is the common misread. They are the backbone; the MDR adds ribs the standards do not.
Frequently asked questions
Are EN ISO 13485 and EN ISO 14971 mandatory under the MDR?
No. They are harmonised standards. Using them is voluntary, but conforming to a harmonised standard listed in the OJEU gives a presumption of conformity with the MDR requirements it covers (MDR Article 8), which is why they are the standard route.
Does an ISO 13485 certificate mean my quality system is MDR-compliant?
Not on its own. ISO 13485 carries most of the MDR quality management requirements, but MDR Article 10(9) adds aspects beyond the standard, including clinical evaluation, post-market surveillance, UDI, and vigilance, which must be built into the same system.
How does ISO 14971 relate to the MDR?
The MDR general safety and performance requirements (Annex I) require a risk management system. EN ISO 14971 is the recognised process for running one. The standard provides the method; the MDR sets the risk-acceptability bar.
What does “presumption of conformity” actually mean?
It means that if you conform to a harmonised standard published in the OJEU, you are presumed to meet the corresponding MDR requirements, without having to demonstrate compliance from first principles. It shifts the evidential burden in your favour for what the standard covers.
Which standard covers the gap the others leave?
No single standard covers the MDR-specific processes (clinical evaluation, post-market surveillance, UDI, vigilance). Those are MDR obligations you implement directly and integrate with your ISO 13485 quality system and ISO 14971 risk management.
Related guides and services
- Quality management support from CENIT Consulting: building an ISO 13485 quality system that carries the MDR-specific processes it does not cover on its own.
- Regulatory Affairs support: mapping MDR requirements to the harmonised standards and closing the gaps between them.
For the risk-management method, see the guide on how to analyze risk under ISO 14971.
This article is for general information only and is not legal or regulatory advice. Teams remain responsible for regulatory decisions and staying current with applicable regulations and guidance.
Talk to CENIT Consulting about aligning your quality and risk systems to the MDR: book a 30-minute consult.