ISO 13485 Certification and On-Site Audit Requirements in Iran

1. Key takeaways

The Iranian authorities generally require an ISO 13485:2016 quality management system certificate and reserve the power to conduct on-site audits of high-risk products or complex situations. The judgement of GRZAN is that the certificate itself is only an entry ticket; what really decides the audit outcome is whether the evidence chain behind the certificate is traceable. The common reasons for rejection are not the absence of a certificate, but a certificate whose scope does not cover the product under application, or a certificate that is approaching expiry. In other words, the certificate opens the door; the traceability of the evidence behind it determines how smoothly the review inside proceeds.

• An ISO 13485:2016 certificate is generally required, and the authority retains the power to audit production sites for high-risk products or complex situations.
• The certificate is only an entry ticket; the decisive factor is whether the evidence chain behind it is traceable from the certificate down to the production floor.
• The most frequent grounds for rejection concern scope and validity, not the existence of the certificate, which nearly every applicant holds.
• A certificate whose scope omits the declared product, or whose validity is nearly exhausted, invites supplementary demands that delay the whole dossier.

2. Legal basis

The legal and normative references supporting this module are the following.

1. ISO 13485:2016 (Medical devices — Quality management systems — Requirements for regulatory purposes): generally accepted by the Iranian authorities; where a corresponding ISIRI standard exists, conformity is judged against the ISIRI standard — this is a practical estimate.
2. On-site audit mechanism: for high-risk products or complex situations, the authority may dispatch its own staff or commission a third party to inspect the production facility on site, verifying that the production processes, the quality system and the submitted documents are consistent — based on publicly available industry materials; no official Iranian document number has been released through public channels, so this is a practical estimate.
3. Law on the Administration of Medical, Pharmaceutical and Food-Beverage Affairs, FAOLEX LEX-FAOC227692, 1955-06-20, Article 3.

3. Expert insights

Insight 1: the scope of the certificate matters more than its existence. Almost every applicant holds an ISO 13485:2016 certificate, so the certificate’s mere presence distinguishes no one. What distinguishes applicants is what the certificate actually says. The product scope stated on the certificate must cover the product being registered in Iran; a scope that is written too narrowly, or that uses product descriptions inconsistent with the Iranian classification, will be met with a request to supplement the certificate. That request means going back to the certification body, amending the scope and waiting for a reissue — a delay that no amount of dossier quality can compensate for. Reading the scope clause before submission costs minutes; fixing it after submission costs months. The scope clause is a short sentence with a long consequence, and it deserves the same scrutiny as the product description itself.

Insight 2: the substance of an on-site audit is a consistency check. When the authority sends auditors or commissions a third party, they are not re-certifying the quality system from zero. They are verifying that the submitted documents and the production floor tell the same story: that key components can be traced to their sources, that process parameters match those described in the dossier, that finished-product inspection procedures are followed as written, and that sterilization process validation is in place as claimed. The implication is direct and demanding — every sentence in the submission must be something the factory can demonstrate in practice. A dossier that overstates what the plant actually does will be exposed on site, and the gap between paper and floor is the most damaging kind of inconsistency an applicant can create. The rehearsal is best run by someone who did not write the dossier, because the test is whether the factory floor can produce the answers independently of the documents.

Insight 3: certificate validity must be aligned with the review cycle. Reviews take time, and certificates expire on fixed dates regardless of how the review proceeds. If the certificate expires while the review is still under way, the applicant faces the awkward situation of an unfinished review resting on a lapsed certificate, which effectively forces a pause while a renewed certificate is obtained. GRZAN recommends that the remaining validity of the certificate cover the expected review period plus a buffer of 6 months. The buffer is not paranoia; it is the recognition that review timelines can stretch for reasons entirely outside the applicant’s control, and that a certificate renewed in advance is far cheaper than a review restarted from the middle. The buffer also absorbs the ordinary friction of renewing a certificate, which itself takes calendar time.

4. Practical recommendations

• Check the certificate scope: verify, word by word, that the product scope stated on the quality system certificate covers the product under application.
• Reserve a validity buffer: make sure the certificate’s validity covers the review period plus 6 months.
• Self-check document–site consistency: run a rehearsal at the factory against four items — key component traceability, process parameters, finished-product inspection, and sterilization validation.
• Keep a third-party audit report in reserve: prepare the most recent third-party or notified-body audit report as supplementary evidence of the effectiveness of the quality system, filed with the dossier rather than held privately.

5. Verification checklist

• □ The ISO 13485:2016 certificate is within its validity period and its scope covers the declared product
• □ The remaining validity of the certificate covers the expected review period plus 6 months
• □ A document–site consistency rehearsal has been completed (component traceability, processes, inspection, sterilization)
• □ A third-party or notified-body audit report has been prepared
• □ Reception and interpretation arrangements for an on-site audit have been prepared

Regulatory information verified as of October 29, 2026

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Iranian market. Our team prepares IFDA-compliant dossiers, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com