Does the ISO 13485 requirement apply to my company?

SAHPRA's communication MD01-2025/2026_v2 applies it to medical device establishment licence holders under section 22C, naming manufacturers and distributors (importers). It does not name wholesalers or device classes. Read the communication and confirm with SAHPRA or your conformity assessment body if you are unsure.

Can any certification body issue the certificate?

No. The communication requires a certificate issued by a conformity assessment body that SAHPRA recognises, for ISO 13485:2016 or later, in the name of the South African licensed establishment at the same address.

Does the Gap Heatmap certify my company?

No. It is a free self-assessment of your own answers: it scores your readiness across nine ISO 13485 areas and ranks your biggest gaps. Only a recognised certification body can certify you.

ISO 13485 certification in South Africa: what SAHPRA now expects

Your certification body audit is booked, or about to be, and the quality system it will look at is half built. This is what SAHPRA has published, and how to decide what to fix first.

Last checked against its sources on 23 October 2026.

What SAHPRA has published

SAHPRA's communication MD01-2025/2026_v2 (18 September 2025) makes an ISO 13485:2016 certificate a prerequisite for the approval of a medical device establishment licence. It applies to holders of medical device establishment licences issued under section 22C of the Medicines and Related Substances Act, and names manufacturers and distributors (importers) as the main stakeholders.

The certificate must be valid, for ISO 13485:2016 or a later version, in the name of the South African licensed establishment at the same address, and issued by a conformity assessment body (CAB) that SAHPRA recognises. The communication says the requirement applies even where a licence holder is exempt from licensing. Applicants still being certified give documentary proof of their agreement with a recognised CAB, and submit the certificate once they have it.

The dates, as published

From	Applies to
1 June 2025	Licence renewals
1 April 2026	Licence holders who are not renewing or amending, and hold a certificate not yet submitted
1 June 2027	Amendments that affect the licence, and product list updates
1 April 2028	All applications relating to a licence, including new ones

Read the communication itself before you plan around these dates: SAHPRA updates its guidance, and this page is a summary, not a substitute. Its phases name manufacturers and distributors (importers), not wholesalers or device classes, so do not assume either way for your business; ask SAHPRA or your CAB.

What a certification audit looks at

A CAB audits your quality management system against ISO 13485:2016: that the system is documented, that it is followed, and that you keep the records to show it. Having a procedure is not enough on its own. Each procedure needs records that show it is working: training records, supplier evaluations, complaint files, internal audit reports, management review minutes, CAPA records.

Most companies that stall are not missing everything. They are missing a few areas where the procedure exists but the evidence does not, and they do not know which ones.

Where to start

Read the SAHPRA communication and confirm which date applies to you.
Speak to a SAHPRA-recognised CAB early: certification takes planning, and the CAB sets the audit timetable.
Find your weakest areas before you write anything new. Rewriting procedures you already have is the most common way to lose months.
Fix the areas with the least evidence first, then keep the records going: a system that only exists for audit week shows.

Common questions

Does the ISO 13485 requirement apply to my company?: SAHPRA's communication MD01-2025/2026_v2 applies it to medical device establishment licence holders under section 22C, naming manufacturers and distributors (importers). It does not name wholesalers or device classes. Read the communication and confirm with SAHPRA or your conformity assessment body if you are unsure.
Can any certification body issue the certificate?: No. The communication requires a certificate issued by a conformity assessment body that SAHPRA recognises, for ISO 13485:2016 or later, in the name of the South African licensed establishment at the same address.
Does the Gap Heatmap certify my company?: No. It is a free self-assessment of your own answers: it scores your readiness across nine ISO 13485 areas and ranks your biggest gaps. Only a recognised certification body can certify you.

Find your three highest-impact gaps before your next inspection.

The free Gap Heatmap: 27 questions across nine ISO 13485 areas, about 4 minutes. You get a readiness score, the gap between what you say you have and what you could show an inspector, and your biggest gaps ranked, each mapped to its clause. Free, no card.

Start my free Gap Heatmap →

Sources

SAHPRA, ISO 13485 certificate as a prerequisite for the approval of a medical device establishment licence (MD01-2025/2026_v2, 18 September 2025)

This guide summarises published documents; it is not legal or regulatory advice. Check the source before you rely on a date or requirement.

ISO-13485 Compliance OS is software, not a regulator, notified body or certification body, and is not affiliated with or endorsed by SAHPRA. Nothing here is legal advice; no regulatory outcome is promised or guaranteed.