ISO/IEC 42001 concerns AI management systems, ISO 13485 concerns quality-management systems for medical devices, and medical-device conformity assessment concerns the applicable requirements for a device. These claims can complement one another, but they are not interchangeable. None should be translated into a guarantee that every clinical AI output is correct.
This comparison uses the standards and official regulatory descriptions checked on 13 October 2026. It is published by iatroX, which offers clinical safety and readiness advice through Insights; that advisory role should be kept separate from the independent certification activities discussed here.
ISO/IEC 42001: organisational management of AI
The precise standard is ISO/IEC 42001:2023, although it is often shortened to ISO 42001. ISO describes it as a management-system standard for organisations providing or using AI. Its object is the organisation's approach to managing AI, not a clinical accuracy score for one application.
For a buyer, the relevant questions include which legal entity, activities and scope the certificate covers. A group-level brand may contain several businesses, and the activities described on a certificate may not match every product promoted by the group.
A fictional supplier could have an AI management system covering development of an internal support tool. That would not, without further information, establish the status of a patient-facing medical product developed elsewhere in the organisation. The example illustrates why the scope needs to be read rather than assumed.
ISO 13485: quality management for medical devices
ISO 13485:2016 addresses quality-management systems for medical devices. As checked on 13 October 2026, ISO's catalogue identifies this edition as current following review and confirmation in 2025.
A quality-management system can be highly relevant to how a manufacturer develops and maintains a device. However, the existence of a QMS certificate should not be used as a shortcut to the conclusion that a particular clinical claim has been demonstrated or that a product has completed every market-access requirement.
The distinction is practical rather than dismissive. Organisational processes and product evidence need to fit together. A well-organised manufacturer still needs relevant evidence for its device, while a favourable product experiment does not by itself establish a dependable lifecycle process.
Medical-device conformity asks about the applicable product requirements
Medical-device conformity depends on the relevant regulatory route, product and intended purpose. Where a designated body is required, its authorised scope matters. The European Commission's notified-body guidance and the MHRA's UK market-access guidance explain different frameworks that should not be collapsed into one worldwide certificate.
Some lower-risk routes involve different levels of third-party participation. It would therefore be inaccurate to assume that every health-related software product needs identical external certification. Qualification and classification must be established for the actual product.
For a fictional clinical recommendation tool, a buyer should request the applicable conformity documents and the intended-use statement. A badge identifying a management-system standard does not answer those requests merely because the tool uses AI.
Compare the object of assessment
| Claim | Object being assessed | Useful assurance to examine | Conclusion not established by the label alone |
|---|---|---|---|
| ISO/IEC 42001 | AI management system within scope | How the organisation manages the relevant AI activities | Every clinical recommendation is correct |
| ISO 13485 | Medical-device quality-management system within scope | How relevant quality processes are organised | Every product has completed its market-access route |
| Medical-device conformity | Applicable requirements for the specified device and purpose | The documented product assessment and conditions | Every local deployment or future feature is covered |
This is a conceptual comparison, not a substitute for reading a real certificate. The supporting documents may contain schedules, exclusions or qualifications that materially change what can be concluded.
A fictional badge collection under review
Imagine a hospital receiving a proposal from Example Health Systems. The presentation includes an AI management-system badge, a medical-device QMS certificate and a statement that one module is CE marked. The hospital plans to use a different module with automatic patient messaging.
The first task is to map each document to the proposed purchase. Which entity is certified? Which activities are covered? Which device is CE marked? Does the proposed messaging workflow fall within the relevant scope or affect the assessed function?
The MHRA's intended-purpose guidance supports identifying the actual function, users, population and environment. The FDA's multiple-function guidance, relevant as a separate US example, also illustrates why interactions between functions may matter even when they have different descriptions.
The fictional hospital should not reject all the documents as meaningless. It should identify what each contributes, what remains unresolved and which additional evidence is needed before the proposed use can be justified.
Standards do not replace clinical evidence
The clinical claim still needs its own evaluation. A product that promises to improve a clinician's decision should not rely only on organisational certification or a model's performance on unrelated questions.
The good machine learning practice principles emphasise relevant testing and the human-AI team. An evidence review should examine the configuration tested, appropriate reference data, intended users and clinically important failures.
A management-system assessment and a clinical evaluation can therefore answer complementary questions. The error is to use the former as proof of the latter, or to treat the latter as proof that the organisation can safely manage all future changes.
Local NHS assurance is another connected layer
For applicable English NHS deployments, DCB0129 and DCB0160 distinguish manufacture from deployment and use. The adopting organisation needs to establish how supplier assumptions translate into its own workflow, staff roles and controls.
A certificate cannot show whether a particular hospital has enough review capacity, whether its interface exposes necessary information or whether its exception queue has a reliable owner. Those questions require local examination informed by the supplier's evidence.
The appropriate goal is not badge accumulation. It is an intelligible assurance chain from organisational processes to product evidence to the conditions of actual use. Missing links should remain visible rather than being obscured by the number of certificates on the presentation slide.
Which claim matters most depends on the reader's decision
A founder establishing AI governance may find ISO/IEC 42001 relevant to that organisational task. A medical-device manufacturer needs to consider its quality-management responsibilities and applicable product route. A buyer assessing a specific deployment should examine all relevant documents without substituting one for another.
As described on 13 October 2026, Insights by iatroX offers clinical safety and regulatory-readiness support. That can help organise the questions and evidence, but neither an advisory engagement nor this article certifies a management system or device.
For the clinician at the point of care, the most useful translation remains concrete: what task is supported, what limits apply, what must be checked and who responds when something goes wrong. Organisational and product assessments matter most when their implications reach that decision.
Frequently asked questions
Does ISO/IEC 42001 certify that a medical AI gives correct answers?
No. It concerns an AI management system within a defined organisational scope, not a guarantee about every output of a clinical application.
Does ISO 13485 automatically establish product conformity?
No. Quality-management certification and the applicable medical-device conformity route are related but distinct claims.
Should NHS buyers ignore management-system certificates?
No, but they should interpret their scope accurately. Relevant organisational assurance should be considered alongside product evidence and local deployment requirements, not used instead of them.