ISO 9001 versus ISO 13485 in Iraq

1. Key takeaways

For the quality system requirement in company-level device registration in Iraq, the official wording is a quality assurance certificate, such as ISO 9001, 9002 or equivalent; the text contains no ISO 13485. ISO 9001/9002 are generic quality management standards that ignore device risk classes; ISO 13485 is the device-specific standard. GRZAN’s position is to build to ISO 13485:2016 and interface with the authority through the ISO 9001 family framing, running both tracks in parallel. As of 29 October 2026, no provision making ISO 13485 mandatory in Iraq was retrieved in any officially accessible channel; because the Ministry of Health site and official legal repositories were unreachable, the situation must not be stated as “Iraq does not require ISO 13485”, and the operative wording remains Section D item 2.

• The operative requirement is a quality assurance certificate “such as ISO 9001, 9002 or equivalent” (Section D item 2).
• The words “or equivalent” open the door to submitting an ISO 13485 certificate.
• ISO 13485:2016 and ISO 9001:2015 are international standards, not Iraqi law, listed for comparison only.
• Negative finding: across all 106 articles of Public Health Law No. 89 of 1981, the Arabic word for “standard” (مواصفة) hits 0 times.
• The listing of ISO 9002, discontinued after ISO 9001:2000, shows the checklist has not been updated for years.

2. Legal basis

The requirement sits in the Drug Registration Regulations, issued by the Republic of Iraq, Ministry of Health, Technical Affairs Directorate, Registration Department, bearing no number and no publication date in the copy reviewed. The operative provision is Section D item 2, listing the quality assurance certificate among the company-level registration documents.

Evidence level: row one is [second-hand source; must not be cited as law] — the original was not obtained and the surviving text is the Pharmexcil reposted PDF (https://pharmexcil.com/uploadfile/ufiles/380351111_drug_regpdf.pdf ); rows two and three are ISO standards, not Iraqi law, listed for comparison only.

Verbatim extracts of the provisions:

• Section D item 2: «Quality assurance certificate such as ISO 9001, 9002 or equivalent».
• The words “or equivalent” are the most valuable three words in the sentence: they create the framing space for an ISO 13485 submission.
• Negative comparison: across the full 106 articles of Public Health Law No. 89 of 1981, “standard” (مواصفة) hits 0 times — no standard-referencing mechanism at statutory level.

3. Expert insights

Insight 1: listing 9001 and 9002 side by side exposes the age of the text. ISO 9002 ceased to exist as a standalone standard after ISO 9001:2000 (a matter of ISO’s own evolution, not Iraqi drafting). A checklist still naming 9002 shows the text has not been updated for years; GRZAN judges it took shape earlier, but the year cannot be fixed because the original carries no date. At submission, the operative convention is what the authority applies at receiving, not a literal copy of this checklist.

Insight 2: why a generic system rather than a device-specific one. The object of registration is the company and the scope of inquiry is whether the manufacturer has quality assurance capability; product risk classification never enters. This matches the design described in article 21 — company registration, not product registration: a country without product registration does not pair system standards with risk classes.

Insight 3: falsification check — the claim that Iraq mandates ISO 13485 has no retrievable provision. The claim finds no clause in the Section D checklist or in Public Health Law No. 89 of 1981, which does not even contain the word “standard”. Because the Ministry of Health site and the legal repositories were unreachable, the situation must not be stated as “Iraq does not require ISO 13485”; the wording here is limited to “not retrieved”. The “ISO 13485 mandatory” formulations GRZAN has seen in online service-provider lists mostly transplant Gulf-state requirements onto Iraq.

Insight 4: horizontal comparison — Iraq sits in the “generic system suffices” tier. Gulf markets such as Saudi Arabia and the UAE name ISO 13485 as an express device requirement; EU MDR (EU) 2017/745 requires a corresponding quality management system. Iraq asks only for “ISO 9001 or equivalent”. For companies deploying across several Middle East markets, ISO 13485 is the option where one cost covers the most entry points — it satisfies the Gulf states directly and lands in Iraq via “equivalent”.

Insight 5: what running the two tracks in parallel means. The system body is written to ISO 13485:2016, giving substance to design and development, risk management, sterilisation process validation and traceability; the cover statement for submission marks the correspondence to ISO 9001 so the reviewer maps it onto “ISO 9001 or equivalent” at a glance. GRZAN issues a clause correspondence table with the package.

4. Practical recommendations

• Take ISO 13485:2016 as the backbone: it is likewise required across the EU, the UK and most Gulf markets, so one build serves many destinations.
• Submit through the “equivalent” framing: satisfy Section D item 2 with the ISO 13485 certificate plus a one-page clause correspondence note.
• If only an ISO 9001 certificate is held, submit it first and supplement with ISO 13485 later rather than shelving the registration. This is a practical estimate (no official provision on a transition deadline).
• The certificate scope must cover the registering entity and the production site and name the design and manufacture of medical devices — a scope without the word device is the most common point of challenge.
• The certificate must be valid and accompanied by the certification body’s credentials. GRZAN also requires evidence of closure of nonconformities from the last audit, to answer the Registration Department’s inspection-power provisions.

5. Verification checklist

• □ Obtain the .gov.iq original and confirm whether Section D item 2 still reads “ISO 9001, 9002 or equivalent”
• □ Seek evidence of any ministerial instruction updating the requirement to ISO 13485; until obtained, do not write it as mandatory
• □ Search Ministry of Health and Technical Affairs Directorate sites using «شهادة ضمان الجودة» and «الايزو» for the current wording
• □ Verify whether the ISO 13485 certification body is accepted in Iraqi receiving practice (practical estimate: no official recognition list found)
• □ Re-check that the certificate scope covers the filing entity, the production site and the word “medical devices”
• □ Compare system requirements across target markets and confirm whether one certificate is reusable in several jurisdictions
• □ Re-verify whether the cited official documents have been superseded (verification baseline date: 29 October 2026)

Regulatory information verified as of 29 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Iraqi market. Our team prepares registration dossiers and legalisation chains, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com