ISO 13485 Certified Suppliers in Vietnam: What Medical Device Buyers Need to Know

Vietnam has a growing number of manufacturers that hold ISO 13485 certification — the quality management system standard for medical device manufacturing. However, holding the certificate and being genuinely ready for customer quality system audits (QSAIs) or FDA-regulated production are different things. This guide helps medical device buyers understand what ISO 13485 actually covers, how to verify it, and what additional scrutiny is needed before committing production.

ISO 13485:2016 certifies a medical-device quality management system — not product safety or FDA compliance. A growing number of Vietnamese factories hold it, but buyers must verify scope, CAPA records, and traceability directly, because the certificate alone is not sufficient basis for supplier approval.

Step Inside a Real Vietnamese Factory with Our Sourcing Team

Watch on YouTube

Real footage from an audited DEWIN partner factory in Vietnam.

What ISO 13485:2016 Actually Covers

ISO 13485:2016 is a quality management system standard specifically written for organizations involved in the design, production, installation, and servicing of medical devices and related services. It is not a product safety certification — it certifies that a facility's processes are documented, controlled, and subject to continual improvement.

ISO 13485:2016 applies to organizations that design, produce, install, or service medical devices. It certifies that processes — documentation, risk management, traceability, sterilization control, and CAPA — are controlled and continually improved, but it does not certify a product's safety.

Key requirements the standard covers:

• Documented QMS: Quality manual, procedures, work instructions, and records covering the full manufacturing process.
• Risk management integration: ISO 13485 requires risk management throughout the product lifecycle, intended to align with ISO 14971 (medical device risk management).
• Design and development controls: DHF (Device History File) procedures, design input/output reviews, design verification and validation. Note: many Vietnam factories are certified to ISO 13485 but only for manufacturing scope, not design — verify the scope carefully.
• Traceability: Lot-level traceability of components, materials, and finished devices. Required for any implantable or life-sustaining device.
• Sterilization controls: If the manufacturer performs sterilization, the standard requires validation and ongoing monitoring.
• Cleanroom requirements: Where applicable (ISO Class 7/8 environments for devices that require them), environmental monitoring must be documented.
• Corrective and Preventive Action (CAPA): Formal system for identifying, investigating, and resolving quality escapes and systemic issues.

Surveillance Audit Frequency

ISO 13485 certificates are issued for 3-year cycles with mandatory surveillance audits. The schedule varies slightly by registrar, but a typical program looks like this:

• Year 1: Certification audit (Stage 1 document review + Stage 2 on-site audit)
• Year 2: Surveillance audit (on-site, typically 1–2 days)
• Year 3: Surveillance audit + recertification preparation
• Year 3 end: Recertification audit for next 3-year cycle

When you receive a certificate from a Vietnam supplier, check the issue date and the "valid to" date. A certificate issued in 2021 and not yet renewed is technically still valid if within its 3-year window, but a factory whose surveillance audit was 18 months ago with no intermediate improvements is a different situation than one audited last quarter.

Certificate vs. Audit-Readiness: A Critical Distinction

There is a meaningful gap between a factory that holds an ISO 13485 certificate and one that is ready for a customer-conducted Quality System Audit and Inspection (QSAI) or an FDA inspection. Here's where that gap typically shows up:

What to Check Beyond the Certificate

When evaluating an ISO 13485-certified Vietnamese supplier, request and review these specific elements — not just the certificate:

1. Corrective Action Records

Ask to see 2–3 closed CAPA records (with customer and supplier names redacted if needed). A good CAPA record includes: the original defect description with data, root cause analysis method (5-Why, Ishikawa), the specific corrective action taken, verification that the action was effective (with follow-up measurement data), and the closure date. A one-paragraph "we retrained the operator" response with no data is a red flag regardless of what the certificate says.

2. DHF Procedure and Sample

If the factory's ISO 13485 scope includes design (not all do), ask to see their DHF procedure and a redacted example. If they cannot produce either, they're certified for manufacturing only — which may or may not match your need.

3. Traceability Depth Demonstration

Ask the factory to demonstrate traceability on a recent production lot. Give them a lot number or date range and ask: "Show me the material MTR, the operator records, and the inspection data for this lot." How quickly and completely they can pull this tells you more than any certificate.

4. Certificate Scope and Registrar

The certificate must list the specific scope of certification (e.g., "Manufacture of surgical instruments" or "CNC machined components for medical devices") and the facility address. Verify directly on the registrar's certificate lookup — BSI, TÜV SÜD, SGS, DNV, and Bureau Veritas all have public registries. A certificate covering one facility does not cover a subcontractor they use.

Vietnam's Medical Manufacturing Geography

Medical device manufacturing in Vietnam is concentrated in two areas:

• Ho Chi Minh City and Binh Duong Province: The largest concentration of ISO 13485-certified facilities. Medtronic has manufacturing operations in Binh Duong; B. Braun has a significant HCMC presence. The supplier ecosystem around these anchor manufacturers has matured. Factories in industrial zones like VSIP Binh Duong and Amata have better infrastructure and more experience with international quality systems.
• Hanoi and surrounding areas: Smaller medical manufacturing cluster, but growing. Some facilities in Hanoi serve the government hospital procurement market, which has different documentation requirements than export-focused production.

Industrial zone location matters because it affects utilities reliability (consistent power is important for controlled environments), logistics to port, and the concentration of experienced quality personnel in the local labor market.

Honest Assessment: What Vietnam Can and Cannot Handle

Not all ISO 13485-certified Vietnamese facilities are appropriate for all medical applications. Here's a candid breakdown:

The bottom line: Vietnam ISO 13485 suppliers are appropriate for many medical device supply chain applications, but require the same due diligence you would apply to any regulated manufacturer — certificate alone is not sufficient basis for supplier approval.

Key Takeaways

• ISO 13485:2016 certifies a QMS process framework — not product safety or FDA compliance.
• Surveillance audits occur in years 2 and 3 of the 3-year cycle; check certificate issue date and audit history.
• Verify certificate scope: manufacturing-only scope does not cover design or DHF requirements.
• Always verify certificates directly via the registrar's public lookup — do not rely on PDF copies alone.
• CAPA record quality, traceability demonstration, and DHF readiness are better indicators than the certificate itself.
• Vietnam is appropriate for Class I and selected Class II medical device components; Class III requires exceptional facility scrutiny.
• HCMC and Binh Duong host the most mature medical manufacturing clusters in Vietnam.

Frequently Asked Questions

Source an ISO 13485 Supplier in Vietnam

Send the drawing, the material and the regulatory market you serve. We shortlist verified Vietnamese supplier facilities with a medical device quality system and confirm certification scope before you engage.