ISO 13485 is the quality management standard for medical devices. A glass supplier does not always need to hold it, but your regulatory position and the way you delegate work decide whether you should insist on it. If the supplier carries out a delegated manufacturing activity, expect to require ISO 13485 certification. If it supplies a component that you inspect on receipt, a well-run ISO 9001 system with strong traceability can be adequate. This article explains how to tell which case applies, what the certificate does and does not prove, and what to check before you approve a glass supplier.
TL;DR
- ISO 13485:2016 sets quality management system requirements for medical-device organisations. Under the UKCA framework, use of designated standards is optional, not generally mandatory.
- BSI guidance says ISO 13485 certification is needed when responsibility is delegated to a supplier. ISO 9001 may be adequate for raw materials or components that the ISO 13485 manufacturer inspects.
- The certificate is a process certificate, not product approval. Your own specification, incoming inspection and records still carry the weight.
- Check the certificate scope, the issuing body, and the supplier’s traceability, change control and audit-access terms before approval.
- We hold ISO 9001 certification and run batch-level traceability on custom glass for medical device makers.
Table of Contents
- What ISO 13485 means for glass
- Does your glass supplier need ISO 13485?
- What the certificate shows, and what it does not
- How to check a glass supplier’s certificate and controls
- Documentation to expect with every delivery
- Where this sits in your UK regulatory duties
- Our perspective
- Glass components for medical device programmes
- FAQ
- Sources
What ISO 13485 means for glass
ISO 13485:2016 specifies quality management system requirements for medical-device development and is the standard the MHRA recommends for structuring a QMS under the UK Medical Devices Regulations 2002. It is written for organisations, not materials. There is no such thing as “ISO 13485 glass” in the way there is toughened or borosilicate glass. What exists is glass made, processed or supplied by an organisation whose management system has been assessed against the standard.
In practice, glass appears in medical devices in several forms: display cover glass on patient monitors and diagnostic instruments, optical windows and sensor windows in imaging and analysis equipment, scanner glass, lenses and filters, and protective panels on handheld or bedside equipment. Each is a component, and the manufacturer of the finished device remains responsible for it. Our guide to types of medical glass for procurement sets out how those forms differ by application.
The standard also reaches beyond finished-device makers. It can apply to organisations involved in one or more lifecycle stages, including suppliers and external parties that provide products or services to medical-device organisations. That is why buyers receive supplier questionnaires asking about it, and why glass fabricators are asked the question so often.
Does your glass supplier need ISO 13485?
The short legal answer is that the standard itself is voluntary. GOV.UK states that using designated standards, including ISO 13485, is optional under the UKCA framework. Complying with a designated standard gives you conformity with the requirements it covers, but it does not replace the manufacturer’s wider conformity-assessment obligations. ISO makes the same point from its side: certification is not required by the standard, and an organisation can implement the QMS without it, although third-party certification can demonstrate conformity to regulators.
The practical answer is more demanding. Two situations matter.
When a supplier takes on delegated responsibility
BSI’s outsourcing guidance separates the supplier’s activity and medical-device technical area in the certificate scope. It states that ISO 13485 certification is needed when responsibility is delegated to a supplier. If a glass processor carries out a step that determines device safety or performance on your behalf, with little verification on your side, treat ISO 13485 as a requirement.
For critical subcontractors the position is firmer still. BSI’s UKCA process says critical subcontractors must hold valid ISO 13485 or MDSAP certification from a UK Approved Body or a recognised or designated subsidiary. For some crucial suppliers certification may be required, and otherwise the body may audit the supplier directly.
When you inspect what you buy
The same BSI guidance notes that ISO 9001 may be adequate for raw materials or components when the ISO 13485 manufacturer inspects the supplied output. A cut, edge-finished and coated cover glass to a drawing, checked at your goods-in against defined dimensional and optical criteria, often falls in this group. Here, the supplier’s job is to deliver to specification, document what it did and keep every batch traceable.
The decision is yours, and it should be recorded. Your supplier control procedure should say which suppliers need ISO 13485, which need ISO 9001 plus verification, and why.
| Situation | Typical supplier expectation | What carries the assurance |
|---|---|---|
| Glass processor performs a delegated step that affects device safety or performance | ISO 13485 certificate with a matching scope | Supplier QMS plus your supplier audits |
| Critical subcontractor within your UKCA certification | Valid ISO 13485 or MDSAP certificate, or audit by the approved body | Certificate, audit access, change control |
| Machined or coated glass component to your drawing, inspected on receipt | ISO 9001 can be adequate | Your incoming inspection, certificates of conformity, traceability |
| Standard stock glass with no medical-specific processing | Evidence of consistent quality and traceable lots | Your acceptance criteria and records |
Use the table as a starting framework, then confirm with your Approved Body, because the final judgement depends on your device class and your technical file.
What the certificate shows, and what it does not
Buyers sometimes read an ISO 13485 certificate as a guarantee that the glass is fit for use. It is not. The IAF explains that ISO 13485 certification is not product certification and is not directly linked to product specifications. It indicates that design and manufacturing processes are appropriate for consistent product quality and safety.
That has three consequences for a glass buyer.
- The specification stays with you. Thickness tolerance, flatness, surface quality, transmission, chemical strengthening depth, coating performance and cleaning compatibility must be written into your drawing and purchase specification.
- Biocompatibility is a separate question. Where glass contacts the patient or fluids, material evaluation is a device-level matter. We cover it in our piece on ISO 10993 actions for medical device makers.
- A certificate is a snapshot. MHRA’s perspective is lifecycle control: the QMS should stay in use across the device lifecycle and be audited and maintained rather than treated as a one-time certificate.
A certificate also says nothing about whether your supplier’s capability matches your part. A fabricator certified for cutting flat glass is not automatically capable of holding tight tolerances on a CNC-machined, ceramic-printed and coated cover. That is why scope matters.
How to check a glass supplier’s certificate and controls
Before approving a supplier, work through the following steps and file the evidence.
- Read the certificate scope. The scope should name the activity you are buying, such as the processing or finishing of technical glass components, and the medical-device technical area. MHRA guidance says the QMS scope must be defined before assessment and must include all required lifecycle activities, and changes in scope require reassessment by the approved body. A scope that does not mention your process is a warning sign.
- Identify the issuing body and validity. Check the certification body, the certificate number and the expiry, and ask for the latest surveillance outcome. For critical subcontractors, confirm the issuer meets the UK Approved Body or recognised-body requirement quoted above.
- Define your approval criteria. BSI guidance says supplier selection or qualification criteria and performance monitoring should be defined, with controls scaled to risk, and regular audits advisable for critical or high-risk suppliers. Write the criteria down before you shortlist.
- Agree audit access. BSI says an approved body may conduct unannounced audits at the legal manufacturer, critical subcontractor or crucial-supplier premises. Your supply agreement should therefore include audit-access and cooperation provisions.
- Review a sample batch record. Ask to see how a lot is traced from incoming material through cutting, machining, strengthening, coating and inspection to dispatch.
- Agree change control. Any change in material source, process step, tooling, coating chemistry or inspection method should require notice and your approval before it is applied to your parts.
- Set the monitoring plan. Track on-time delivery, rejection rate and corrective actions, and review them on a set schedule.
The process-mapping approach in BSI’s white paper helps here: a process map of the supply chain from glass blank to finished component, together with a traceability matrix linking requirements to procedures, makes gaps visible quickly. Our guide to partnering with glass manufacturers covers the commercial side of the same relationship.
Documentation to expect with every delivery
GHTF guidance on supplier controls says a manufacturer must define and document the type and extent of controls applied to suppliers and retain objective evidence that supplied products and services meet predefined specifications. It lists receiving inspection, acceptance activities, review of certificates of conformity or analysis, measurement and monitoring, and data analysis as typical controls once a supplier is accepted. Supplier controls may also include traceability and change control, and receiving, inspection, acceptance and correction records should be readily available.
For glass components, a sensible delivery pack contains:
- a certificate of conformity referencing your drawing number and revision;
- the lot or batch identifier and the material source record;
- dimensional inspection results against the critical-to-quality features you flagged;
- optical or surface inspection results where the part is a window, lens or display cover;
- coating or strengthening process records where applied;
- notice of any deviation or concession, signed off before shipping.
The same guidance treats a supplier as an organisation independent from your QMS, including a separate internal division, and says such suppliers should be controlled in a similar way to external ones. If your own group has a glass shop, hold it to the same standard.
First-article approval is a natural companion to these records. Our article on PPAP for glass parts shows how a structured approval package works for buyers and suppliers.
Where this sits in your UK regulatory duties
The regulatory duty belongs to the device manufacturer. MHRA guidance says UK developers must create and maintain a QMS to meet the UK Medical Devices Regulations 2002 and recommends using ISO 13485 requirements to structure it. GOV.UK’s perspective is that standards are a conformity route rather than an automatic legal substitute for the manufacturer’s full conformity-assessment obligations. Your glass supplier’s certificate supports your file, but it does not discharge your responsibility.
For how the 2002 Regulations and the later amendment affect manufacturers, see our summary of UK MDR 2002 Part 4A and the 2025 amendment. For the wider picture of standards that touch glass production, our 2026 guide to quality standards in glass manufacturing is a good companion.
Our perspective
We make custom technical glass for medical device manufacturers, and the same question reaches us in nearly every first conversation: do you hold ISO 13485? Our answer is built on what we can document. We are ISO 9001 certified, we trace production at batch level, we work to tight tolerances backed by advanced inspection, and we maintain documented export compliance. We scale from prototype to volume without changing the process route, which matters when a design moves through verification and into production.
We do not tell buyers that ISO 9001 is the same thing as ISO 13485. It is not. What we say is that, in line with BSI’s outsourcing guidance, a component that the device manufacturer inspects on receipt can sit comfortably under a strong ISO 9001 system, while a delegated process that affects device safety calls for a different level of certification. That decision belongs in your supplier control procedure, and we would rather help you make it correctly than win an order on an assumption.
What we can do is make the evidence easy to audit: clear drawings reviewed before we cut, controlled process routes, inspection records tied to the lot, and prompt notice of any change. Buyers who agree the specification, the inspection plan and the change-control terms with us at the start rarely meet surprises at goods-in.
— Alexandra
Glass components for medical device programmes
We fabricate optical windows, display glass, sensor windows, scanner glass, chemically strengthened and protective glass, CNC-machined technical glass, ceramic-printed parts and coated glass, with traceability from batch to delivery. If you are qualifying a supplier for a medical programme, send us your drawing and the controls you require, and we will tell you what we can document against them.
See our glass fabrication and machining services for the full range, or read about our technical glass products. For design choices that affect both performance and approval, our engineer’s guide to medical device and industrial display glass is a useful next step.
FAQ
Is ISO 13485 mandatory for a glass supplier in the UK?
Not by the standard itself. GOV.UK describes use of designated standards under the UKCA framework as optional, and ISO says certification is not required by the standard. Your Approved Body or your own supplier-control rules may still require it, particularly for critical subcontractors.
Is ISO 9001 enough for a medical glass component?
Sometimes. BSI’s outsourcing guidance says ISO 9001 may be adequate for raw materials or components when the ISO 13485 manufacturer inspects the supplied output. If responsibility for a process is delegated to the supplier, ISO 13485 certification is needed.
Does an ISO 13485 certificate mean the glass is approved for medical use?
No. The IAF states that the certificate is not product certification and is not directly linked to product specifications. It indicates that processes are appropriate for consistent quality and safety, so you still need your own specification, inspection and records.
What should I look at on a supplier’s certificate?
Check the scope first: it should cover the activity you are buying and the medical-device area. Then confirm the issuing body, the validity dates and the outcome of recent surveillance. Scope changes need reassessment by the approved body, so ask whether anything has changed since issue.
What records should come with each glass batch?
Expect a certificate of conformity, lot traceability, inspection results against your critical features, and process records for any strengthening or coating. GHTF guidance lists certificates of conformity or analysis, traceability and change control among typical supplier controls, with receiving and acceptance records kept available.
Sources
- MHRA-aligned guidance: creating and maintaining quality management systems for medical devices
- GOV.UK: medical devices conformity assessment and the UKCA mark
- BSI Insight Series: from prototypes to production
- ISO: ISO 13485 medical devices
- IAF: accredited certification to ISO 13485
- BSI: UKCA certification process
- BSI: developing and maintaining a quality management system
- GHTF SG3: quality management system guidance on supplier controls
