Two quote packages land in your inbox. Both suppliers claim to be an ISO13485 PCBA manufacturer. Both attach a certificate. One price is lower. Which one do you pick?
Most procurement teams stop at the certificate. That is a mistake. ISO 13485 is a quality management system standard built specifically for medical devices. Holding the certificate means an auditor confirmed that documented procedures exist on paper. Whether those procedures run through every shift, every line, and every shipment is a different question entirely.
This article breaks down what ISO 13485 actually demands from a PCBA supplier, where most suppliers cut corners, and how to evaluate whether a manufacturer has genuinely embedded the standard into its production floor — or simply framed the certificate.
ISO 9001 is a general-purpose quality management standard. ISO 13485 inherits its framework but layers on requirements that matter when a circuit board ends up inside a patient monitor, a diagnostic instrument, or a surgical robot. The key additions include risk management (referencing ISO 14971), process validation, design controls, traceability, and handling of regulatory feedback.
For a PCBA supplier, this translates into tangible differences across the manufacturing chain:
| Requirement Area | ISO 9001 | ISO 13485 |
|---|---|---|
| Documented procedures | General QMS framework | Medical-specific, with risk files for each product |
| Component traceability | Lot-level preferred | Lot-level mandatory, with full chain-of-custody records |
| Process validation | Not explicitly required | Required for processes that cannot be fully verified by inspection |
| Change control | Documented | Formal impact assessment with risk re-evaluation |
| Corrective and preventive action | Standard CAPA | CAPA tied to regulatory reporting obligations |
A supplier that holds both ISO 9001 and ISO 13485 — along with IATF 16949 for automotive or ISO 14001 for environmental management — signals that quality is structural, not promotional.
Understanding where the standard bites hardest helps you ask the right questions during supplier audits. Here is a stage-by-stage breakdown.
ISO 13485 requires that component sourcing is controlled, documented, and traceable. This means the supplier should work with authorised distributors and original manufacturers, perform incoming quality inspection on every lot, and maintain records that tie each component on a board back to its original purchase order and certificate of authenticity. Under the standard, substituting an unverified component — even if it "looks the same" — is a non-conformance event.
Ask your supplier: Can you produce the full traceability record for any component on any board you shipped last quarter? If the answer involves digging through spreadsheets rather than pulling a report from an ERP system, the system is not ISO 13485-grade.
Surface-mount and through-hole assembly are the processes most visible to standard quality controls. Under ISO 13485, the expectations go further. Solder-paste inspection (SPI) and automated optical inspection (AOI) become mandatory checkpoints, not optional add-ons. First-article inspection (FAI) must be formally recorded and approved before volume production begins. X-ray inspection is required for BGA and other hidden-joint components.
The standard also demands that placement machines, reflow ovens, and wave-soldering equipment are maintained, calibrated, and operated within validated parameter windows. Process deviations — a reflow profile shift, for example — trigger documented corrective action, not just a line operator's adjustment.
Medical devices often operate in environments where moisture, dust, or chemical exposure is unavoidable. Conformal coating service under ISO 13485 means the coating process itself is validated: coating thickness is measured and recorded, masking is verified, and curing parameters are controlled. The coating material must be traceable to its manufacturer and batch, and any change in material requires a formal re-validation.
A robust PCBA testing service under ISO 13485 goes beyond plugging in a board and checking for power. The standard requires that test methods are validated, test fixtures are calibrated, and test results are archived with full traceability. This includes in-circuit testing (ICT), functional testing (FCT), high-and-low-temperature reliability testing, and program burning — each with documented pass/fail criteria and recorded outcomes.
When evaluating a potential medical PCBA manufacturer, use these questions as your audit framework. They are designed to test whether ISO 13485 runs through the operation or stops at the lobby.
1. "Show me the traceability chain for a board you shipped six months ago." The supplier should be able to produce, within hours, a complete record linking the finished PCBA serial number to the PCB fabrication lot, every component lot number, the SMT production shift, the operator, the AOI and SPI logs, the test results, and the coating batch.
2. "What happens when an AOI flag is detected on the line?" Under ISO 13485, the process should not be: operator reworks and moves on. The correct answer involves logging the defect type, linking it to the specific solder-paste batch or placement machine, running a root-cause analysis if a pattern emerges, and feeding the data back into preventive action.
3. "Can I review your process validation records for reflow soldering?" Process validation is a core ISO 13485 requirement. The supplier should have documented evidence that the reflow profile has been validated for the board types they produce, including thermal profiler data, pull-test or shear-test results, and cross-section analysis for critical joints.
4. "How do you handle a component substitution request?" The right answer involves a formal engineering change request (ECR), a risk assessment per ISO 14971, customer notification and approval, first-article re-qualification, and updated documentation. The wrong answer is "we swap it if the spec matches."
5. "Which other certifications do you hold, and are they integrated or siloed?" A supplier running ISO 13485 alongside IATF 16949, ISO 14001, and product-level standards like IPC-A-610 demonstrates that quality management is embedded across the organisation, not maintained as a separate function for medical orders only.
One common misconception is that ISO 13485 requirements can be relaxed for prototype or small-batch orders. The standard makes no such distinction. A single prototype board for a medical device must be produced under the same controlled, documented, and traceable process as a production run of ten thousand. The only difference is volume.
This matters because many EMS providers apply full quality controls only when volumes justify the overhead. A manufacturer that accepts prototype orders from a single piece upward — and applies the same process discipline regardless of quantity — is one that has genuinely internalised the standard.
Look for capabilities that support this flexibility: multiple SMT lines that can be allocated for different batch sizes, component procurement networks that can source small quantities without long lead times, and engineering teams that can support design-for-manufacturing (DFM) reviews during the prototype phase.
Farway Electronic holds ISO 13485 alongside ISO 9001, IATF 16949, and ISO 14001 — a certification stack that reflects quality management embedded across its operations in LongGang, ShenZhen. The company's 2,000-square-metre production workshop houses two SMT lines, two DIP lines, a conformal-coating line, two finished-product assembly lines, and a comprehensive inspection and testing setup including SPI, AOI, FAI, X-ray, ICT, FCT, thermal imaging, and high-and-low-temperature reliability testing.
Component management follows a controlled process: BOM review for sourcing risks, incoming quality inspection, ERP-driven inventory management, first-in-first-out warehousing, anti-static storage, and vacuum packaging. Every step is documented and traceable.
The company serves customers across medical devices, transportation and automotive electronics, new energy, security, communications, and AI-related products, spanning more than 20 countries and regions. This cross-industry experience means that ISO 13485 disciplines are reinforced by the additional requirements of IATF 16949 for automotive and the general rigour of IPC-A-610 for assembly standards.
Farway supports the full manufacturing chain — from PCB fabrication in rigid, flexible, and rigid-flex formats (1 to 32 layers, with capabilities including impedance control to ±5% and minimum line width/spacing of 0.05 mm) through component sourcing, SMT and DIP assembly, conformal coating, low-pressure injection moulding, testing, and finished-product box-build assembly. Orders are accepted from a single prototype piece through medium and large batches, under the same quality management system.
If you are evaluating PCBA suppliers for a medical device programme and want to move beyond certificate-checking into a meaningful technical discussion, contact Farway Electronic at sales@farway.hk or visit farway.hk to request a capability review and quotation.
Hey there! Your message matters! It'll go straight into our CRM system. Expect a one-on-one reply from our CS within 7×24 hours. We value your feedback. Fill in the box and share your thoughts!