Which Quality System Does Your Machined Part Need?

September 21, 2026

The word medical on an RFQ narrows the list of shops that will quote it and raises the price of the ones that do. Sometimes that is necessary. Often it is a habit, and it is worth knowing which case you are in.

What each standard is

ISO 9001 is a general quality management system standard. It requires a documented system, defined processes, records, corrective action and management review. It applies to any industry.

ISO 13485 is the quality management system standard for medical devices. It shares the structure of ISO 9001 but adds requirements that follow from the regulatory context: risk management throughout, stricter document and record control, process validation, design controls where applicable, traceability and retention periods driven by device lifetime rather than by convenience.

AS9100 is the aerospace equivalent, and IATF 16949 the automotive one. Both are also built on ISO 9001.

Importantly, none of these is a product standard. A certificate tells you a shop has a system and is audited against it. It does not tell you the parts are good, and it does not tell you the shop is any good at stainless. That is a separate question covered in vetting a stainless machine shop.

Where the requirement actually comes from

This is the part that gets skipped. A machine shop is a supplier to a device manufacturer. The device manufacturer holds the regulatory obligation, and its quality system requires it to control its suppliers in proportion to the risk the supplied part carries.

So the question is not is this part medical. It is what does our supplier control procedure require for a part with this risk classification.

In practice that produces roughly three tiers.

Tier 1, ISO 13485 expected. Implantable components, parts in a sterile fluid path, anything where a dimensional or material defect could reach the patient without being caught. Also anything where your own notified body or auditor has told you so.

Tier 2, ISO 9001 plus supplier qualification. Surgical instrument components, handles, housings, reusable device parts. Very common. The device maker qualifies the shop, specifies the part fully and inspects on receipt. The shop works to ISO 9001 and to the device maker’s requirements on top.

Tier 3, ISO 9001 is plainly enough. Lab equipment, test fixtures, cart and trolley hardware, enclosures, non contact structural parts.

If you are not sure which tier your part is in, the person who can tell you works at your company, not at the machine shop. Ask your quality function before you write the requirement into an RFQ, because writing it in costs money and removing it later is awkward.

What you actually get from an ISO 13485 shop

Lot and heat traceability maintained through every operation, including at subcontractors
Retained records for a defined period tied to device lifetime
Validated processes where the output cannot be fully verified by inspection, which for machining usually means passivation, cleaning and sometimes marking
Change control, so the shop cannot quietly change a tool, a coolant or a subcontractor without notice
Documented supplier controls over its own finishers and material suppliers
Audit readiness, meaning you can audit them and so can your notified body

That last bullet is often the real reason. If your auditor will want to see the supply chain, a shop that has been audited before will handle it calmly.

What it does not give you

It does not give you better machining. An ISO 13485 shop that cuts stainless occasionally will still work harden your 316L. The certificate and the capability are independent, and you have to check both.

It also does not give you a validated passivation process unless you ask. Passivation is the classic special process in this context, because you cannot verify the result on every part without destroying it. If your part needs validated passivation, say so, and expect a shop to either show you its validation or name the finisher that holds it. Citric against nitric covers the process itself.

The material side

Certificates do not replace a specification. A medical stainless part still needs the same drawing discipline as any other:

Grade and standard. 316L per ASTM A276 for most instrument work. 316LVM per ASTM F138 only if the part is implantable, because it is a different specification with a different price. See 316, 316L and 316Ti.
17-4 PH with its condition where hardness is needed.
Surface finish with a number, especially where the part is cleaned or sterilised. Surface finish guide.
Passivation with a standard and a test.
Cleaning and packaging, which for medical work is frequently specified and frequently forgotten on the drawing.

What to write in the RFQ

Be specific about the requirement rather than the label:

Medical device component, non implant, reusable surgical instrument. Supplier must hold ISO 13485 or be qualified under our supplier control procedure. Lot traceability to heat number required. Passivation per ASTM A967 citric, validated process, certificate with lot number.

That tells a shop whether it can quote. Medical device part, ISO 13485 required does not, because half the shops that could do the work well will not respond and the ones that do will price the certificate rather than the part.

How this works here

We do not hold any certificate and we do not certify suppliers. We are a matching service. When you say in the RFQ which quality system you need, we only pass it to shops that hold it, and you verify the certificate with them directly before you place the order. Send your RFQ, or start with the full checklist.

Frequently asked questions

Does every part in a medical device need an ISO 13485 shop?

No. The requirement flows from the device manufacturer's own risk assessment and supplier controls, not automatically from the word medical. Many instrument components, fixtures and lab equipment parts are made by ISO 9001 shops under the device maker's supplier qualification.

Is ISO 13485 shop work more expensive?

Generally yes, often noticeably. You are paying for document control, validated processes, lot traceability, retained records and audit readiness. That is real work, and it is worth paying for only when your regulatory position requires it.

Can a shop have both?

Frequently. ISO 13485 shares its structure with ISO 9001, so shops that serve both medical and industrial customers commonly hold both certificates.

Need a quote for this part?

Send the drawing. We match you with up to 3 stainless shops and reply within 24 business hours.

Get matched with a stainless shop

Figures in this guide are published specification limits or published typical values for the alloy, not measurements of any part. Machinability is rated against free-machining carbon steel B1112 at 100 and PREN is chromium plus 3.3 times molybdenum plus 16 times nitrogen. The conventions are set out in thereference section and the editorial standards.