The short answer
They are two standards with two different purposes. ISO 9001 is about running a business that consistently delivers what it promised and gets better at it. ISO 13485 is about demonstrating, to a regulator, that a medical device was made under control.
The practical consequence is the one that costs money: ISO 9001 certification does not get you ISO 13485 and does not substitute for it. If a customer asked for 13485 and you certify to 9001, you have bought a certificate they did not ask for.
Does ISO 13485 include ISO 9001?
No. This is the difference that catches people out. AS9100 contains ISO 9001 in full; ISO 13485 does not. It shares ancestry with it and has since gone its own way, so being certified to one does not certify you to the other.
Do I need both?
Only if you serve both markets. Contract manufacturers who make medical parts alongside general engineering work commonly hold both, and the systems overlap enough that the second certification is cheaper than the first. A pure device supplier usually needs only ISO 13485.
Why does ISO 13485 look older in structure?
Deliberately. ISO 9001 was restructured in 2015 onto a common framework shared with other management standards. ISO 13485 did not follow, because regulators around the world cite it and stability is worth more to them than harmonisation.
Which is harder?
Different rather than harder, though most people find 13485 heavier. It is written for demonstrating control to a regulator — documentation, traceability and risk run through it — where ISO 9001 leans more on improving over time.
The change that reframes this question
On 2 February 2026 the US Food and Drug Administration’s Quality Management System Regulation took effect, amending 21 CFR Part 820 to incorporate ISO 13485:2016 by reference. Rather than restating each requirement in its own words, the regulation now largely points at the standard — and the FDA’s inspection programme changed with it on the same date.
For a US device manufacturer that changes the character of the question. ISO 13485 is no longer only what a customer asks for; its requirements are what a federal inspector works from. It does not make certification mandatory — the regulation and the certificate are different things — but it does mean the gap between “we comply” and “we are certified” is narrower than it was.
If you are a general manufacturer being pulled into medical work by one customer, this is the paragraph to take seriously before quoting.
What they share
Enough that holding both is not double the work. Document control, competence and training records, internal audits, management review, supplier control, corrective action, control of nonconforming product — the machinery of a quality system is recognisably the same in both, and a shop with one in genuine use is a long way into the other.
What does not transfer is the emphasis. Traceability, risk and documentation carry further in the medical standard, and the regulatory dimension has no counterpart in ISO 9001 at all.
Before you buy any help
Ask your customer which standard they actually require, and whether they require certification or will accept compliance. Those two questions between them decide what you should spend, and a surprising number of these requests turn out softer than they read.
Cornerstone9 covers ISO 9001 only, including the 2026 revision. We say so plainly because sending a device maker down the wrong road would cost them a year. If the answer is 13485, you want somebody who does that. The aerospace comparison is a different shape again — there, one standard really does contain the other.