ISO 13485 is an organization quality-management system for medical-device-related manufacturing: document control, risk, supplier discipline, and product realization records. It is not a product class stamp, not “ISO 13485 certified PCB,” and not a substitute for IPC-A-610 acceptance, IPC-6012 bare-board class, approved MPN lists, or revision-locked travelers. Buyers who award medical PCBA on a certificate PDF alone often receive mixed revisions, silent substitutions, and incomplete lot genealogy — then discover gaps at audit, complaint handling, or a field return.
This China-fab note is a thin QMS / RFQ hub for medical-adjacent PCBA: what the certificate actually covers versus what drawings and travelers must still lock; how ISO 13485 sits next to ISO 9001 and IPC; revision, component, ECO, and NCR controls; a short risk-based inspection callout; and an RFQ matrix that stops certificate-only buying. It is not a medical-device design guide, not an IEC 60601 deep dive, and not a claim that any one supplier’s certificate covers your plant, your scope, or your part number.
Certificate scope is org / site — not a product label
| Phrase you hear | What it actually means | What it does not mean |
|---|---|---|
| “We are ISO 13485” | The organization runs a medical-device QMS under a defined scope and site | Every board or assembly is “ISO 13485 certified” as a product |
| “Medical PCBA house” | Marketing for market focus / process familiarity | Automatic Class 3, sterile packaging, or device-level validation |
| “ISO 9001 + medical experience” | General QMS plus claimed sector history | Equivalent to ISO 13485 scope coverage for your product realization |
| “IPC Class 3 + ISO 13485” | Two different locks: product acceptance + org QMS | Redundant — you often need both, and neither replaces the other |
One-line definition: ISO 13485 disciplines how the plant manages quality under its certified scope. IPC class, approved MPNs, firmware revision, and test procedures discipline what the lot must be. Certificate-only RFQs leave the traveler free to quote the cheapest path that still looks “medical-ish.”
Verify three things on every certificate before it becomes a bid filter: scope wording (does it cover PCB assembly / electronic manufacturing you are buying?), manufacturing site (does the address match the plant that will build your lots?), and current status (issue / expiry / accreditation body). A group-level cert that does not cover the SMT line you are quoting is a paper shield, not a process shield.
A strong QMS reduces uncontrolled changes and lost history; it does not freeze your BOM or invent Class 3. Write product locks as if the supplier were ISO 9001-only — then add ISO 13485 when the program requires that filter.
💡 Procurement Pro-Tip: Put ISO 13485 (if required) on the supplier qualification line. Put IPC class, revision set, approved MPN list, and inspection/test matrix on the product line. One vague “medical quality” sentence is how Class 2 defaults and silent substitutions survive quote review.
ISO 13485 vs ISO 9001 vs IPC — none auto-implies Class 3
These standards answer different questions. Treating any one as a full substitute for the others is how RFQs go soft.
| Standard | Answers | Does not auto-provide |
|---|---|---|
| ISO 13485 | Medical-device QMS: docs, risk, records, supplier control under scope | Product acceptance class, stackup, or MPN list |
| ISO 9001 | General QMS discipline | Medical-specific controls your auditor may still expect |
| IPC-A-610 | Workmanship acceptance for assembly (cite Class + revision) | Bare-board fabrication class or org certification |
| IPC-6012 | Acceptance for bare PCB fabrication (cite Class + revision) | Assembly class or ISO 13485 coverage |
None of the above automatically means Class 3. Class is a drawing / PO callout. A plant can hold ISO 13485 and still ship IPC-A-610 Class 2 solder joints if the traveler never said Class 3. A bare board can be IPC-6012 Class 2 under a Class 3 assembly RFQ if fab and assembly were not both locked. Cite each lock separately: QMS ask (ISO 13485 if required), bare-board class (6012), assembly class (A-610), and any coupon / microsection plan the program flows.
Revision lock — Gerber, BOM, CPL, firmware, test
Medical-adjacent builds fail when “latest files” means different things to CAM, SMT, and test. Freeze a revision set before award and refuse mixed WIP:
- Gerber / ODB++ / fab notes — one approved rev for the bare board that enters SMT.
- BOM — approved manufacturer part numbers (MPN), not descriptions alone.
- CPL / centroid — pick-and-place data that matches the approved Gerber and BOM rev.
- Firmware / programmed content — hex / binary / checksum / version recorded on the traveler when devices are programmed in-house or at the CMS.
- Test procedures — FPT / FCT / burn-in scripts and acceptance limits at the same approved rev as the build.
If Rev B boards, Rev C BOM, and an unversioned FCT fixture share one traveler, you do not have configuration control. Require the quote and traveler to list the same rev IDs; any change is an ECO, not a chat message.
Component control — MPN, substitution, lot / date codes
ISO 13485 does not invent your AVL. You do.
| Control | What to write on the RFQ | Fail mode if missing |
|---|---|---|
| Approved MPN | Exact manufacturer + MPN (and alternates if pre-approved) | “Equivalent” commodity parts enter without review |
| Substitution | No substitute without written buyer approval before use | Silent second-source mid-lot |
| Lot / date code | Required where program / risk demands (critical actives, sensors, passives per your plan) | No genealogy when a date-code family fails |
| Counterfeit / broker rules | Authorized channel or documented exception path | Gray-market risk under schedule pressure |
| MSD / bake | Moisture-sensitive device handling per procedure | Latent popcorning blamed on “mystery process” |
Component control is product risk management. The QMS should force records; the RFQ must force the rules. “We follow ISO 13485” without an approved MPN list is not component control.
Traceability chain — bare PCB → parts → PCBA → test → rework
For medical-adjacent PCBA, ask for a genealogy story that survives audit and complaint:
- Bare PCB lot / panel ID tied to fab CoC and incoming inspection.
- Component lots (and date codes where required) tied to each PCBA lot or serial range.
- PCBA lot / serial as the unit of shipment and complaint lookup.
- Inspection and test records — SPI/AOI/X-ray/FPT/FCT results linked to that lot/serial.
- Firmware version / checksum when programming is in scope.
- Rework disposition — what was reworked, under which NCR, with what verification, and whether the unit remains in the same lot identity or was re-identified.
If any link is “we can look it up somehow,” treat the reply as incomplete. Traceability that only exists in a personal spreadsheet is not traveler-grade.
ECO and WIP — no mixing Rev B and Rev C
Engineering change between builds is normal; mixing revisions inside one WIP wave is not.
- ECO before change — class, stack, MPN, firmware, or test-limit changes need a signed ECO (or equivalent) before the traveler moves.
- WIP disposition — state what happens to boards already in SMT, already tested, or already packed when an ECO hits: scrap, rework to new rev, use-as-is with buyer sign-off, or hold.
- No mixed rev shipping — one shipment lot should not blend Rev B and Rev C assemblies unless the buyer explicitly accepts a split and labels it.
- Cut-in identity — first article or first ship of the new rev should be identifiable so field data separates cleanly.
Schedule pressure tempts finishing old panels while starting a new BOM without paperwork. Put the ECO / WIP rule on the RFQ so price includes the discipline.
NCR and rework — detect, segregate, disposition, verify
Nonconforming product needs a closed loop, not a quiet touch-up bench:
- Detect — inspection/test finds the defect; record against lot/serial.
- Segregate — physical or system hold so nonconforming units do not ship by accident.
- Disposition — rework, scrap, return-to-vendor, or use-as-is with buyer authorization when the program requires it.
- Verify — re-inspect / re-test after rework to the same (or ECO-updated) acceptance criteria; record the verifier and result.
Ask rework-cycle limits on critical joints or BGAs, who authorizes use-as-is, and whether reworked units keep original serials. Soft answers are a risk flag even when the ISO 13485 PDF looks current.
Risk-based inspection — RFQ language, not a second FCT encyclopedia
Inspection depth should follow product risk and package technology — stated on the RFQ so bids are comparable:
| Method | Typical RFQ ask | Keep it short |
|---|---|---|
| SPI | Solder-paste inspection on critical pads / fine pitch | Coverage % or “all SMT” per your plan |
| AOI | Post-reflow AOI; cite IPC-A-610 class | Do not invent pixel criteria |
| X-ray | BGA / QFN / hidden joints as required | Sample vs 100% — say which |
| FPT | Flying probe for bare or assembled nets when fixtures are not ready | Netlist / procedure rev locked |
| FCT | Functional test when the program needs powered verification | Fixture ownership, coverage intent, limits rev — not a novel here |
Name methods and coverage intent. Acceptance numbers and fixtures stay OEM-owned unless you flow them. Do not paste an FCT encyclopedia into every RFQ; do not leave “visual only” when the BOM has fine-pitch BGAs and the risk file says otherwise.
Technical capability is still separate from QMS
ISO 13485 does not enlarge a process window. HDI, flex/rigid-flex, fine-pitch SMT, underfill, and coat still need a plant that can hold registration, paste, and reflow for your design. Ask capability on the product line; ask QMS on the supplier line. A certified QMS with an unfit window still yields scrap; a capable but uncertified line still fails a program that mandates ISO 13485. Buy both fits when both are required.
China fab RFQ matrix — stop certificate-only buying
Paste this block so every bidder prices the same QMS and product risk:
| RFQ / drawing field | What to write | Fail mode if missing |
|---|---|---|
| ISO 13485 (supplier) | Required / not required by program; verify scope + site if required | Cert shopping without product locks — or cost if program does not need it |
| ISO 9001 | Acceptable only if program allows; do not treat as 13485 equivalent | False comfort on medical QMS expectation |
| Bare-board class | IPC-6012 Class + revision when justified | Silent Class 2 fab under “medical” title |
| Assembly class | IPC-A-610 Class + revision explicit | Hole-fill / solder disputes after award |
| Revision set | Gerber + BOM + CPL + firmware + test procedure revs | Mixed-rev WIP; audit gaps |
| Approved MPN / sub rules | AVL + no substitute without written approval | Silent second-source |
| Lot / date code | Where required by risk / program | No complaint genealogy |
| Traceability | PCB lot → component lots → PCBA lot/serial → inspect/test/firmware → rework | “We can check” without traveler evidence |
| ECO / WIP | Signed ECO before change; disposition of in-process lots; no mixed-rev ship | Rev B/C mixed in one carton |
| NCR / rework | Detect → segregate → disposition → verify; cycle limits | Quiet touch-up; unverified escapes |
| Inspection matrix | SPI / AOI / X-ray / FPT / FCT coverage intent | Visual-only under fine-pitch risk |
| No silent downgrade | No class / MPN / test / rev cut without signed ECO | Traveler quietly de-scopes medical controls |
Treat the matrix as a bid equalizer. Scope-matched ISO 13485 + Class 3 + locked revs + genealogy is not comparable to “medical experience” Class 2 with visual ship. Force the matrix onto every bid; reject incomplete replies before negotiation.
Minimum viable medical-adjacent PCBA RFQ: QMS ask (ISO 13485 if required, scope/site check) + IPC-6012 / A-610 classes as applicable + revision set + approved MPN / substitution rules + traceability + ECO/WIP + NCR/rework + inspection matrix. Add device-level validation only when the program truly flows it — this hub does not invent IEC 60601 theater.
Soft next step
If your program needs medical-adjacent PCBA from a China fab, decide first whether ISO 13485 is program-required. If it is, ask for the current certificate and verify that scope and manufacturing site match the plant quoting your Gerbers and BOM. Lock revision set, approved MPNs, class callouts, ECO/WIP rules, and the inspection/test matrix in the first RFQ — not after award. XFPCB supports drawing-driven PCB fabrication and PCBA with documentation and traveler discipline aligned to what you specify (class, revision, MPN rules, and inspection intent on the order). Buyers should treat organization certificates as a supplier qualification question, not as proof that a part number is “ISO 13485 certified,” and should confirm scope against the quoting site rather than assuming any brochure claim. Pair QMS filters with product locks; neither replaces the other.