ISO 13485 and Korea's KGMP — What Is the Same and What Is Different

Key takeaway — The relationship between ISO 13485 and KGMP in one line: same skeleton, different procedure. Annex 2 of the KGMP notification is laid out like ISO 13485, from clause 4 (quality management system) to clause 8 (measurement, analysis and improvement), so most of your documentation carries over. But who issues the certificate, the three-year validity with periodic audits, on-site inspection, and the requirements Korean law layers on are different, and the route to a document-review-only audit is opened by an MDSAP certificate, not by ISO 13485. Compiled on 8 September 2026 from the full text of Notification No. 2026-46.

First, a point of precision — the notification never says "ISO 13485"

Search the 135-page text of the Regulation on Medical Device Manufacturing and Quality Control (MFDS Notification No. 2026-46, in force 1 July 2026) and the string "ISO 13485" does not appear once. Instead, Annex 2, the Audit Criteria for Conformity Recognition, sets out its requirements using the same chapter and clause numbering as ISO 13485. That is why practitioners describe KGMP as ISO 13485 transposed into Korean regulation, and the description is broadly right.

Transposed, however, is not identical. A standard is something a company adopts voluntarily and has certified by a private body; the notification is a statutory step that anyone manufacturing or importing a Class 2 or higher device must complete. The differences follow from that.

1. What is the same — the documentation skeleton

Annex 2 is structured as follows.

Annex 2	Content	ISO 13485
4. Quality management system	4.1 General requirements · 4.2 Documentation requirements (4.2.2 quality manual · 4.2.3 medical device file · 4.2.4 control of documents · 4.2.5 control of records)	Clause 4
5. Management responsibility	Commitment · customer focus · quality policy · planning · responsibility and authority · management review	Clause 5
6. Resource management	Human resources · infrastructure · work environment	Clause 6
7. Product realization	Planning · customer-related processes · design and development · purchasing · production and service provision (including 7.5.9 traceability) · monitoring equipment	Clause 7
8. Measurement, analysis and improvement	Monitoring and measurement · 8.3 control of nonconforming product · analysis of data · improvement	Clause 8

A site with a living ISO 13485 system already has the skeleton of its quality manual, procedures, product standards and records. This is why the KGMP conformity recognition guide says the practical work begins with a gap analysis.

2. What is different — procedure and law

Who recognises, and with what document

• ISO 13485 — an accredited private certification body audits and issues the certificate. The company chooses the body.
• KGMP — a quality-system audit body audits and, where the result is satisfactory, issues the prescribed certificate of conformity (Article 8(9)). Under Annex 4 the audit is conducted either by the audit body alone or jointly with the regional MFDS office.

Audit types and validity

	ISO 13485 certification	KGMP conformity recognition
Audit types	Initial → surveillance → recertification (per the certification body's rules)	Initial, additional, change and periodic (Article 4(1))
Validity	Typically three years	Three years (Article 9(1)). Periodic audit once every three years (Article 4(2)), application at least three months before expiry (Article 7(3))
Scope	As defined by the company	Per manufacturing site and product group (Annex 3)
Exclusions	—	Export-only, Class 1 and clinical-investigation devices may be excluded from audit (Article 3(2))

Requirements layered on by Korean law

Within the shared numbering there are places the Korean notification fills in on its own. The list that the notification requires even in an MDSAP-based audit, as "documents confirming conformity with matters required by medical device legislation" (Article 7(3)(c)), is precisely that layer:

• The quality manual
• The procedure for control of records
• A procedure showing the scope of the quality manager's duties — Annex 2, 5.5.2 "Quality manager". Where ISO 13485 has a management representative, Korea places the statutory quality manager
• A procedure for devices subject to tracking management, where applicable — Annex 2, 7.5.9.2 special requirements
• A procedure for adverse event reporting and advisory notices

On top of that, the audit runs on Korean-language documents and records, and each item is graded A (adequate), B (improvement required), C (inadequate) or D (not applicable), with C including breaches of medical device legislation (Annex 2, chapter 9). Standard certification has no such layer.

3. The document-review-only route — MDSAP, not ISO 13485

"We hold a certificate, so surely the site inspection is waived" can be answered from the text. Article 6(2) lists seven cases audited by document review alone — an additional audit, a change audit after relocation, another operator holding a valid certificate for the same site, the remaining sites where an operator has two or more sites due for periodic audit, an IVD conformity certificate, holding an MDSAP certificate, and the periodic audit of an excellent manufacturing site. Holding an ISO 13485 certificate is not on the list.

MDSAP is not a standard but an audit programme. Item 70 of Annex 1 defines it as a scheme under which quality-management-system audit results from auditing organisations jointly designated by full member jurisdictions such as the United States and Japan are mutually recognised across several countries. Holding that certificate changes the following.

• The audit can be document review only (Article 6(2)6). Exceptions requiring on-site inspection: sites due for periodic audit, sites whose audit results show major nonconformities such that the MFDS Minister so determines, combination-product sites, and sites using human-derived materials or tissue (Article 6(3)4)
• The submission changes — a copy of the MDSAP certificate with the audit results (including nonconformity reports and corrective and preventive actions), the product standard for the highest-class item in each product group, the five "Korean legislation" documents above, and material showing the correspondence between the MDSAP-covered products and the products under audit (Article 7(3))
• The KGMP certificate's validity is set equal to that of the MDSAP certificate (Article 9)

In short: ISO 13485 makes preparation easier; MDSAP shortens the procedure. They are tools at different levels. The three MDSAP audit-response guidelines the MFDS published in August 2026 for Korean manufacturers going abroad sit in the same context — what they contain is covered in a separate article.

4. What this means in practice

A site (including an overseas manufacturer) that already has ISO 13485

1. Lay Annex 2 out clause by clause and map the existing documents against it — in particular 4.2.3 medical device file, 5.5.2 quality manager, 7.5.9 traceability and 8.3 nonconforming product
2. Fill the five Korean-legislation procedures above, or add sections to existing procedures
3. Build the Korean-language document and record set for submission. Underestimating the translation scope and timeline is what pushes the whole schedule
4. If an on-site inspection is scheduled, run a mock inspection centred on records. Auditors' questions go to records, not to the manual

A site with neither

• Building one system to Annex 2 from the start means it can be reused when ISO 13485 certification is sought later. That order involves less duplicated work than the reverse.
• If export is planned to an MDSAP full-member jurisdiction, designing the system with an MDSAP audit in mind from the outset is the most economical path, periodic KGMP audits included.

Common mistakes

• Expecting that submitting a copy of the ISO 13485 certificate reduces the KGMP file — the "certificate issued by a regulator or a body delegated by a regulator" that Article 7(1) asks for applies only to the cases in Article 6(2) and 6(6)
• Applying with a management representative in place but no statutory quality manager appointed
• Making a device subject to tracking management without the 7.5.9.2 special requirements (records of components, raw materials and work-environment conditions; identification of inspection and test personnel) in the procedures
• Confusing the three months before expiry application deadline for the periodic audit with the certification body's recertification schedule
• Submitting the overseas manufacturer's English documents as they are and being asked for Korean-language material at the audit

Pre-application checklist

• Confirm the site and product group → Annex 3 product group and audit type (initial, additional, change, periodic)
• Check whether an MDSAP certificate is held → if so, whether document review applies and whether an on-site exception (Article 6(3)4) is triggered
• Prepare an Annex 2 gap table (in place · to be supplemented · new)
• Prepare the five Korean-legislation procedures (quality manual, records, quality manager, tracking management, adverse event reporting)
• Confirm the quality manager's appointment and training
• Fix the scope and timeline of Korean-language submissions
• For a periodic audit, log the application date three months before expiry

---

Where a company with ISO 13485 gets stuck in KGMP is rarely the technology; it is the handful of clauses Korean law adds and the Korean-language records. Which items carry over, which must be built, and whether the structure allows MDSAP to shorten the procedure are what we check first in a free preliminary review.