What Is ISO 13485 and Who Needs It in Nigeria?
Published
ISO 13485 certification suits organisations involved in the medical device life cycle. This includes manufacturers, importers, distributors, storage and cold-chain providers, and servicing companies. Certification is voluntary under the standard itself, although customers or partners may require it.
What is ISO 13485?
ISO 13485 is a quality standard for companies that work with Medical Devices. It checks how your company works, not the products themselves. Auditors look at how you choose suppliers, keep records, store goods and handle complaints. An independent certification body audits your system and issues the certificate.
Who needs ISO 13485 in Nigeria?
If your business makes, imports, distributes, stores or services medical devices, ISO 13485 certification in Nigeria can fit you. Any company in the medical device chain can apply. The certificate covers only the work you actually do. Buyers and partners like to see it, but the standard doesn’t force anyone to get it.
● Manufacturers: Auditors look at production, records and design, if you design devices.
● Contract manufacturers: Auditors look at production controls and customer requirements.
● Importers: Auditors look at supplier checks, traceability and storage.
● Distributors: Auditors look at traceability, storage and complaints.
● Storage and cold-chain providers: Auditors look at temperature control, handling and records.
● Servicing and installation providers: Auditors look at service records, competence and complaints.
● Pharma supply companies handling devices: This may apply in some cases. However, you need to check where this applies.
Design controls apply mainly to organisations that design devices. Everyone else can exclude them but must give a reason.
Key takeaway: If your business is part of the medical device chain, ISO 13485 can fit you. The certificate covers only what you actually do.
Is ISO 13485 mandatory in Nigeria?
No, ISO 13485 certification in Nigeria does not itself make certification mandatory. A company can run a good quality system without ever applying for a certificate. However, buyers, hospitals, foreign partners or regulators might still ask for it. Some tenders and supply contracts, for example, may list it as a condition. Check what applies to your products and customers before you decide, and don’t assume a legal requirement either way. Additionally, confirm it from any Nigerian rules with NAFDAC directly.
Is ISO 13485 the same as NAFDAC registration?
ISO 13485 and NAFDAC registration are two separate things, and a company may need both.
● ISO 13485 checks how your company runs its quality system. An independent certification body audits it and issues the certificate.
● NAFDAC is the regulator. Its rules cover your products and your business in Nigeria.
The ISO 13485 certificate is not a NAFDAC registration, a licence or a product approval. It does not replace any of them. Having it also doesn’t mean you meet every Nigerian requirement, so check NAFDAC’s current rules separately.
What does ISO 13485 certification involve?
ISO 13485 certification follows a clear path, from planning your system to proving it works in an audit. You do the first part yourself. The certification body then checks your work. Here are the steps:
Define your scope.
Build your quality system yourself. The certification body can’t do this for you.
Run an internal audit.
Hold a management review.
Stage 1 audit: the auditor reviews your documents and readiness.
Stage 2 audit: the auditor checks the system in action.
Certificate decision.
Surveillance audits during the certificate cycle.
Recertification.
Auditors rely on evidence, not statements. An importer may be asked to choose one product and show where it came from and where it went. A cold-chain provider may be asked to produce its temperature logs. Records like these show that the quality system works consistently, even when no one is checking.
How do you choose an ISO 13485 certification body?
Pick an accredited certification body with auditors who know medical devices. Check its accreditation and scope in the accreditation body’s public directory. Make sure it’s impartial and doesn’t help clients build their systems.
What do companies often get wrong about ISO 13485?
Most problems come from misunderstanding what the standard covers or from gaps between paperwork and practice. These are the most common ones:
● Assuming it replaces NAFDAC registration: ISO 13485 certifies your quality system. It does not replace regulatory requirements.
● Assuming importers cannot be certified: Importers can be certified for the activities they carry out, such as import, storage and distribution.
● Writing procedures that do not match daily work: Auditors compare what the document says with what staff actually do.
● Choosing a certification body without checking its accreditation: Verify its accreditation and scope in the accreditation body’s public directory before you commit.
Example: A distributor writes a cold-chain procedure but never records fridge temperatures. The procedure exists, but there is no evidence that it is followed.
Key takeaway: A good system has three parts: a clear process, daily practice that matches it, and records that prove it.
Quick checklist: is ISO 13485 right for you?
● Clear certification scope covering actual activities
● Quality policy, objectives, and defined responsibilities
● Controlled procedures, forms, work instructions, and records
● Medical device file or equivalent product information, where applicable
● Risk management records
● Supplier approval, evaluation, and purchasing records
● Training and competence records
● Calibration and maintenance records
● Storage, handling, and temperature-monitoring records
● Product identification and traceability records
● Complaint, feedback, and CAPA records
● Internal audit and management review records
● NAFDAC and other applicable regulatory records
Need help getting certified?
Talk to a SIS Certifications specialist about the standards covered in this blog.
Get My Free Quote →