For a precision-machined component that goes into a medical blower, an ISO 9001 certificate is table stakes, not the bar — and confusing the two is the most expensive mistake a sourcing team can make. This guide explains what ISO 13485 actually requires (and what it does not), how to read a factory’s certificate file, and the red flags that should stop an RFQ in its tracks. The reference product is a representative 24V high-pressure centrifugal medical blower from a Chinese OEM such as those in the Wonsmart medical blower family; the buyer’s perspective comes from a precision CNC machining partner with 15+ years in custom medical mechanical parts.
TL;DR — What sourcing teams need to know
- ISO 9001 is general QMS — it certifies the factory can run a quality system. It does not certify the factory is qualified to make medical device components.
- ISO 13485 is medical-device QMS — it certifies the factory has documented design controls, risk management per ISO 14971, validation, traceability, and a regulatory file that can be audited by a notified body or a regulatory authority.
- ISO 13485 is not the same as “medical-grade” product. It certifies the QMS, not the part. The buyer still has to verify design history file, biocompatibility, sterilisation compatibility, and electrical safety per IEC 60601-1.
- Red flag #1: a factory that claims “medical-grade” products but only lists ISO 9001 in the certificate set.
- Red flag #2: a factory that says “we can get ISO 13485 if you need it” without an existing certification — the lead time to a real ISO 13485 audit is 12-18 months.
- Document set a buyer should request — ISO 13485 certificate (current, scope-stamped, with the notified body name), quality manual excerpt, recent audit summary, and component-level traceability procedure.
ISO 9001 vs ISO 13485: What the Buyer Is Actually Buying
The single most expensive mistake a medical device sourcing team can make is to treat ISO 9001 and ISO 13485 as interchangeable. They are not. The gap between them is the gap between a factory that runs a quality system and a factory that is qualified to make medical device components under regulatory review.
Because a precision-machined component that ends up inside a medical blower is a regulated article under most jurisdictions, the bar for the upstream factory is not “do you have a QMS” but “can your QMS survive a notified body audit against a regulatory submission” — and only ISO 13485 answers that question.
| Requirement | ISO 9001 (general QMS) | ISO 13485 (medical-device QMS) |
|---|---|---|
| Quality system foundation | Yes — documented QMS, management review, corrective action | Yes — built on the same QMS foundation, plus medical-device specifics |
| Design controls | Optional / risk-based | Mandatory — documented design inputs, outputs, reviews, verification, validation, transfer |
| Risk management | Implicit | Mandatory per ISO 14971 — risk analysis, evaluation, control, residual risk acceptability |
| Document and record control | Yes | Yes — with medical-device-specific retention and traceability rules |
| Production and process control | Yes | Yes — plus validation of any process that affects product safety (sterilisation, cleaning, software) |
| Purchasing and supplier control | Yes | Yes — with traceability requirements down to the component batch |
| Corrective and preventive action (CAPA) | Yes | Yes — plus regulatory reporting pathways for safety-related issues |
| Management review | Yes | Yes — with mandated input topics including regulatory changes, complaints, and post-market data |
| Regulatory audit acceptability | No — not a medical-device standard | Yes — the recognised QMS basis for medical device regulatory submissions globally |
Practical implication: an ISO 9001 factory can run a clean production line and ship consistent parts. An ISO 13485 factory can also produce the documented design history file, the risk management file, the validation records, and the post-market surveillance plan that a notified body or FDA audit will ask for. The buyer pays for the second capability, not the first.
Reading the Certificate: Scope, Not Just the Number
The certificate number is the least important part of an ISO 13485 certificate. The scope statement is the part that determines whether the certificate actually covers the parts the buyer is sourcing.
Because the certificate scope statement defines which products, processes, and sites the certification covers, a certificate that says “manufacture of plastic components” does not cover a metal-blower supply, even if the same factory makes both, which is why reading the scope is the single most important step in a medical component RFQ.
What to look for in the certificate scope statement
- Product scope. Does the scope mention “medical device components”, “medical blowers”, or the specific category of part you are sourcing?
- Process scope. Does the scope include the manufacturing process (CNC machining, motor assembly, winding, calibration) the buyer is buying?
- Site scope. Is the certification tied to the specific production line, or is it a multi-site certificate that may or may not cover the site the buyer is being quoted from?
- Regulatory exclusions. Some scope statements exclude certain clauses (sterile processes, design control). Read the exclusions as carefully as the inclusions.
- Issue and expiry dates. ISO 13485 certificates are valid for three years with surveillance audits. Confirm the certificate is current and the surveillance audit is up to date.
Buyer insight: in the precision-machining world, the most common scope mismatch we see is a factory that holds ISO 13485 for “orthopaedic implant manufacturing” but is being quoted for “respiratory equipment sub-components.” Both are Class II medical devices in the US FDA framework, but the design controls, risk profile, and validation requirements are different. The certificate does not bridge the gap.
The Document Set a Sourcing Team Should Request
Before placing a first PO, the medical device sourcing team should request a structured document set from the candidate factory. The set below is the working minimum, not the complete medical-device file (which lives at the device maker, not the component supplier), but it is the set that lets the buyer evaluate the supplier’s QMS depth without over-asking.
| Document | What it tells the buyer | What to check |
|---|---|---|
| ISO 13485 certificate (current) | QMS covers medical-device activities | Notified body name, scope, issue and expiry dates |
| ISO 9001 certificate (if separate) | Broader QMS coverage | Same as above; useful for non-medical lines in the same factory |
| Quality manual (excerpt) | How the QMS is structured, including the design control procedure | Document number, revision, table of contents |
| Recent audit summary | Whether the factory has had open or closed major non-conformities | Issued by the notified body, last 12-18 months |
| Component-level traceability procedure | How the factory traces a component batch back to raw material and forward to the customer | Lot tracking, batch records, retention period |
| Risk management procedure or summary | Whether the factory can speak the language of ISO 14971 in customer discussions | Reference to ISO 14971 in QMS documents |
| Product safety / EMC test reports (if relevant) | Whether the blower or its subassemblies have been tested to the right standards | IEC 60601-1 for medical electrical equipment, plus any regional electrical safety standard |
| Customer references in regulated medical applications | Whether the factory has a track record with similar end-use applications | Logos or case studies, ideally with permission to contact references |
For the full certificate file on the example supplier, see the Wonsmart certificate page; for a representative product spec on the 24V medical blower line, see the Wonsmart 24V high-pressure medical blower.
Procurement principle: the document set is the buyer’s first filter. A factory that cannot produce these documents in a one-week turnaround is signaling that the QMS is not mature enough to support a medical device RFQ, and the buyer should walk before investing engineering time.
Five Red Flags That Should Stop a Medical Blower RFQ
Most failed medical device sourcing engagements do not fail at the audit stage. They fail earlier, at the document-and-conversation stage, when the buyer has the chance to spot the warning signs but does not. The five red flags below are the ones I have seen most often over the last 15 years of precision-machined medical components.
Red flag 1 — “We are medical-grade” but only ISO 9001 is in the cert file
This is the most common red flag. The factory uses the words “medical-grade” or “medical quality” in marketing, but the certificate set shows only ISO 9001. The buyer needs to distinguish between a factory that aspires to serve the medical market and a factory that has been audited against the medical-device QMS. The first one may eventually get there; the second one is the only one that can serve the buyer today.
Red flag 2 — “We can get ISO 13485 if you need it”
A real ISO 13485 certification, with document controls, internal audits, management review, and external audit by a notified body, takes 12-18 months from a standing start. A factory that offers to “get ISO 13485 for you” is not certified today, and the buyer is being asked to fund the certification in exchange for production capacity. That is a different deal than the buyer thought they were making.
Because the medical device regulatory framework assumes a mature, audited QMS, the buyer is paying the cost of any certification gap, not the supplier — if a device maker lists an ISO 13485-certified component supplier in their regulatory submission, and that supplier is not actually certified at the time of the audit, the device maker is the one that answers for it.
Red flag 3 — Certificate scope excludes the actual product
As above. A factory with ISO 13485 for “sterile-packaged wound dressings” is not automatically qualified to make a medical blower housing, and the certificate file will not bridge the gap. Read the scope, not the headline.
Red flag 4 — No risk management language in customer-facing documents
If a factory’s published QMS documents do not mention risk management, design controls, or ISO 14971 in any form, the QMS is probably a generic ISO 9001 with “medical” marketing on top. A real medical-device QMS leaves fingerprints in every customer-facing document, from the quote template to the deviation report.
Red flag 5 — Inability to name medical-device customers or use cases
A factory with real medical-device experience can name two or three past or current medical-device customers (with permission) and can describe the use case in general terms. A factory without that experience tends to deflect to industrial or consumer applications and avoids medical specifics. The buyer should not accept the deflection.
Procurement rule of thumb: any one of these red flags is enough to ask a follow-up question. Two or more of them in the same RFQ response is enough to walk.
What ISO 13485 Does Not Buy You
Because the medical device industry sometimes treats ISO 13485 as a master key that unlocks every regulatory question, it is worth listing the things the certificate does not cover.
- Product-level safety clearance. ISO 13485 is a QMS standard, not a product standard. A blower or its components still need electrical safety testing per IEC 60601-1 (or regional equivalent) at the finished-device level, and biocompatibility testing per ISO 10993 if the part contacts the patient.
- Regulatory submission on the device maker’s behalf. The QMS supports the submission; it is not the submission. The device maker is the regulatory sponsor, and the submission depends on the device maker’s own file, not the component supplier’s certificate.
- Country-by-country regulatory clearance. FDA 510(k), EU MDR under the new regulation, China NMPA, and other national systems each have their own additional requirements on top of ISO 13485.
- Performance under the buyer’s specific use case. A factory with ISO 13485 is still a factory; the buyer must verify the technical fit of the specific blower for the specific device.
- Ongoing performance after certification. ISO 13485 is monitored through surveillance audits, and the buyer is responsible for ongoing supplier monitoring, not just the initial certification check.
What this means for sourcing: ISO 13485 is a necessary but not sufficient condition. The certificate gets the factory into the qualified-supplier list; the technical documentation, the validation records, and the ongoing monitoring keep it there.
Decision Framework: How to Use ISO 13485 in a Sourcing Decision
| If your situation is… | ISO 13485 bar to set | Why |
|---|---|---|
| Component goes into a Class I medical device (low risk, non-sterile) | ISO 13485 required, scope-aligned | Regulatory minimum; covered by most major factory QMSs |
| Component goes into a Class II medical device (moderate risk, e.g. CPAP, BiPAP blower) | ISO 13485 required, scope-aligned, plus component-level validation record | Regulator expects design controls, validation, and traceability at component level |
| Component goes into a Class III medical device (high risk, life-supporting) | ISO 13485 required, scope-aligned, plus extended quality agreement and on-site audit | High-risk class demands the deepest supplier involvement; QMS is the starting point, not the finish line |
| Component goes into a non-medical industrial application | ISO 9001 typically sufficient | ISO 13485 is medical-specific; an industrial use case does not need the medical overhead |
| Component is being sourced for an early-stage R&D prototype | ISO 9001 acceptable at this stage; ISO 13485 expected before design freeze | Prototype sourcing can move faster on a lighter QMS, but the production-intent factory must meet the medical bar |
One-line summary: ISO 13485 is the price of admission for medical device component sourcing; the buyer’s job is to confirm the certificate is real, current, scope-aligned, and supported by the rest of the QMS, not to treat it as a marketing label.
Auditing a Chinese medical component supplier?
If you are auditing a Chinese CNC or blower supplier against the ISO 13485 framework in this article and want a second pair of eyes on the certificate set before you fly to Ningbo, send the certificate PDFs to the FRIMA team. We will return a red-pen review within three business days. The review is on us; we get the program whether or not you pick FRIMA at the end.
Connect with Frank on LinkedIn · View sample supplier certificate set
Frequently Asked Questions
Is ISO 13485 mandatory for medical blower sourcing?
ISO 13485 is the recognised QMS basis for medical device regulatory submissions in most major jurisdictions, including the EU MDR, US FDA 21 CFR 820 (QSR, which is being replaced by the Quality Management System Regulation harmonised with ISO 13485), Canada, Japan, and others. For a component that ends up inside a finished medical device, ISO 13485 on the supplier side is functionally mandatory if the device maker wants to use the supplier in a regulatory submission.
Is ISO 9001 the same as ISO 13485?
No. ISO 9001 is a general QMS standard applicable to any industry. ISO 13485 is a medical-device-specific QMS that adds design controls, risk management per ISO 14971, validation, traceability, and post-market surveillance on top of the ISO 9001 foundation. An ISO 9001 certificate alone does not qualify a factory to make medical device components.
How long does it take a Chinese factory to get ISO 13485?
A factory starting from a documented ISO 9001 QMS typically takes 12-18 months to reach a fully issued ISO 13485 certificate, including gap analysis, QMS upgrade, internal audits, management review, stage 1 and stage 2 external audits, and certificate issuance. A factory with no documented QMS at all takes longer. A factory that claims it can “get ISO 13485 in 60 days” is not describing a real certification path.
Does ISO 13485 cover the product or just the factory?
ISO 13485 certifies the QMS, not the part. The certificate scope statement describes which products, processes, and sites the certification covers, but the actual product safety clearance comes from product-level testing (IEC 60601-1 for medical electrical equipment, ISO 10993 for biocompatibility) and from the device maker’s regulatory submission, not from the component supplier’s certificate.
What is the difference between a notified body and a certification body for ISO 13485?
A certification body issues ISO 13485 certificates. A notified body is a certification body that is additionally “notified” by an EU member state to assess medical devices and the QMS of their manufacturers under the EU MDR. For CE-marked medical devices sold in the EU, the supplier’s ISO 13485 certificate should be issued by a notified body, not by a non-notified certification body. For other jurisdictions, the relevant local authority’s requirements apply.
How do I verify a Chinese ISO 13485 certificate is real?
Three checks: (1) confirm the issuing body is an accredited certification body and check the accreditation number on the certificate against the relevant accreditation register; (2) request the scope statement and confirm the products and processes in scope match what the factory will be supplying; (3) request the most recent surveillance audit summary, which a real certification body issues on a documented cycle. A factory that cannot produce these in a one-week turnaround is signaling a QMS gap.
What is the role of ISO 14971 in medical component sourcing?
ISO 14971 is the application of risk management to medical devices. ISO 13485 requires the supplier’s QMS to integrate risk management per ISO 14971 throughout the product lifecycle, which is why a factory’s published procedures and customer-facing documents should reference risk analysis, risk evaluation, and risk control in language that aligns with ISO 14971. A factory that cannot speak the language of risk management is not in a position to support a regulatory submission, even if its ISO 13485 certificate is current.
What is the right first step for a sourcing team new to medical blower procurement?
The right first step is to classify the end device by regulatory class (I, II, or III in the US FDA system; Class I, IIa, IIb, or III in the EU MDR system), then set the supplier certification bar accordingly. ISO 13485 with scope-aligned product coverage is the floor for any medical device component; beyond that, the bar depends on the device class and the specific risk profile of the component.
Can a single Chinese factory supply both ISO 9001 and ISO 13485 production lines?
Yes, and many do. The common pattern is a single QMS that covers both standards, with the medical-device line physically segregated (cleaner environment, separate work-in-process, dedicated calibration) and the certificate scope identifying the medical line as a separate audit scope. The buyer should ask for the scope statement and the site map, not just the headline certificate number, to confirm the segregation is real.
Post time: Oct-09-2026
