Sri Lanka ISO 13485 and ISO 9001:2015 Acceptance Rules

1. Key takeaways

The baseline for quality system evidence in Sri Lanka is ISO 13485; ISO 9001:2015 is accepted only in limited situations — principally for listed devices at overseas sites and for some low-risk local manufacturers, whose ISO 9001:2015 must in addition be accredited by SLAB or by an equivalent accreditation authority. For low-risk Class I and Class A devices, the rule is stricter in a specific way: overseas sites must hold ISO 13485, while local sites must hold SLAB-accredited ISO 13485. Reading these rules together, the practical message is unambiguous: the further a manufacturer departs from the ISO 13485 baseline, the more conditions attach. Overseas manufacturers of non-listed devices should plan on ISO 13485 without exception, and local manufacturers should treat SLAB accreditation as a hard prerequisite rather than an administrative detail. The small number of situations in which ISO 9001:2015 suffices are the exception, not the rule, and building a submission strategy around the exception is a reliable way to generate a deficiency notice.

• The general baseline expectation is ISO 13485 (practical estimate, based on NMRA guidance).
• ISO 9001:2015 is accepted for listed devices at overseas sites, and for local sites only when accredited by SLAB or an equivalent body.
• Low-risk Class I and Class A devices require ISO 13485 at overseas sites, and SLAB-accredited ISO 13485 at local sites.
• New local manufacturers may apply first with ISO 9001 but must submit ISO 13485 within two years.

2. Legal basis

The quality system expectations summarised below are compiled as a practical estimate based on NMRA guidance, except for the scope of the low-risk pathway, which is set out in Annex 1 of GL-037, effective 2026-05-13. Each row distinguishes between overseas and local sites, because the acceptance conditions differ between the two.

3. Expert insights

Insight one: whether ISO 9001 can be used depends on two variables — whether the product is a listed device, and whether the site is local. Only when both variables point to the lenient option does the ISO 9001 route open. For overseas non-listed devices, ISO 13485 is required regardless of the risk class. This two-variable logic is easy to misapply: a manufacturer may read the listed-device provision and assume it extends to its whole portfolio, or read the local-manufacturer provision and assume it covers overseas production of the same product line. Neither reading survives contact with the rules. The safe habit is to answer the two questions separately for every site and every product before deciding which certificate to submit.

Insight two: local manufacturers face the additional condition of SLAB accreditation. Accreditation by the Sri Lanka Accreditation Board (SLAB) is the precondition for a local site’s quality certificate to be accepted. This is a threshold that local manufacturers easily overlook. A valid ISO 9001:2015 or ISO 13485 certificate issued without SLAB accreditation — or without accreditation from an equivalent authority — does not satisfy the local-site condition, however reputable the certification body may be. Checking the accreditation status at the time the certificate is commissioned, rather than at intake, avoids discovering the gap at the worst possible moment.

Insight three: new local manufacturers have a two-year transition period. They may apply first with ISO 9001, but ISO 13485 must be submitted within two years. This is a commitment with a clear deadline, not an indefinite grace period. Planning the ISO 13485 implementation from day one — with a gap analysis, an implementation schedule, and an audit date already booked — is the only way to make the two-year deadline comfortable. Companies that treat the transition as breathing room typically find that certification bodies’ lead times alone consume a large part of it. It is also worth noting that the ISO 9001 used for the initial application and the ISO 13485 submitted later must both describe the same manufacturing operation; a change of site or production arrangement in between adds a further layer of evidence work on top of the certification itself.

A final structural point: the low-risk pathway referenced in this article has its own defined scope. The list of products eligible for that pathway is set out in Annex 1 of GL-037, and whether a given device benefits from the lenient certificate conditions depends on whether it appears on that list. Consulting Annex 1 before choosing the certificate type therefore comes logically first in the planning sequence, because the answer there determines which of the rows in the table above applies.

4. Practical recommendations

• GRZAN’s advice to clients is direct: overseas manufacturers should prepare ISO 13485 from the outset and not count on the ISO 9001 exception, which applies only in the narrow situations described above.
• Local manufacturers must confirm whether their certificate carries the SLAB accreditation mark, and should record the name of the accreditation body in the certificate list.
• This item is checked on the spot during intake verification, so an accreditation gap will surface immediately rather than later in assessment.
• New local manufacturers should schedule ISO 13485 implementation against the two-year deadline at the moment of first application, not when the deadline approaches.

5. Verification checklist

• □ Quality certificate type confirmed (ISO 13485 or ISO 9001:2015)
• □ Site confirmed as overseas or local
• □ SLAB accreditation status confirmed for local-site certificates
• □ Certificate within its validity period and covering the scope of the products submitted
• □ New local manufacturer has scheduled ISO 13485 within the two-year period

Regulatory information verified as of 28 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across South Asia, including Sri Lanka. Our team prepares dossiers to NMRA expectations, manages submissions and deficiency responses, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com