What is the primary objective of REACH?

The primary objective of REACH is to protect human health and the environment from chemical risks while enhancing EU industry competitiveness and promoting alternative testing methods. Under Regulation (EC) No 1907/2006, it shifts responsibility to industry for registering substances, generating hazard and exposure data, and implementing risk management via registration, evaluation, authorisation, and restriction.

Who is legally or professionally required to comply with REACH?

REACH legally requires manufacturers, importers, and downstream users placing substances, mixtures, or certain articles on the EU/EEA market to comply. Registration is mandatory for substances manufactured or imported >1 tonne/year per legal entity; producers/importers of articles with SVHCs ≥0.1% w/w exceeding 1 tonne/year must notify ECHA; non-EU manufacturers appoint an Only Representative.

Does REACH require an external audit or third-party certification?

No, REACH does not require external audits or third-party certification. It is a directly applicable regulation enforced by Member State authorities via inspections; ECHA manages dossiers but issues no "REACH certificates." Compliance is demonstrated through registration dossiers, Chemical Safety Reports, and record retention for 10 years.

How often should an assessment for REACH be performed?

REACH assessments must be performed continuously as a living obligation, with updates triggered by events like new data, tonnage changes, or list updates. Dossiers require updates when new hazards emerge; monitor Candidate List (biannual), Annex XIV/XVII amendments, and CoRAP annually; Chemical Safety Assessments scale by tonnage bands (≥1, ≥10, ≥100, ≥1000 tonnes/year).

What are the consequences of non-compliance with REACH?

Non-compliance with REACH results in penalties set by Member States that must be effective, proportionate, and dissuasive under Article 126. These include fines, product seizures, market bans, and potential criminal sanctions; enforcement varies by country via national inspections coordinated by ECHA's Forum, with risks of supply-chain disruption and Article 33 (45-day) response failures.

Can REACH be mapped to other international frameworks?

Yes, REACH elements such as data requirements and risk assessments can be mapped to other international frameworks. Its Chemical Safety Reports, exposure scenarios, and SVHC criteria align with global systems like GHS for SDS and OECD for testing, enabling data reuse despite jurisdiction-specific adaptations.

What is the first step to begin implementing REACH?

The first step to implement REACH is to conduct a gap analysis building a master substance inventory by legal entity and tonnage. Identify substances >1 tonne/year, map roles (manufacturer/importer/downstream user), screen against Candidate List/Annexes, and prioritize high-risk items for dossier preparation via IUCLID.

What is the primary objective of ISO 13485?

ISO 13485:2016 specifies requirements for a quality management system (QMS) to demonstrate the ability to consistently provide medical devices and related services that meet customer and applicable regulatory requirements. This standard applies to organizations involved in one or more stages of the medical device lifecycle, including design, production, distribution, installation, servicing, and decommissioning. It emphasizes documented processes, risk-based controls, validation, traceability, and post-market surveillance across Clauses 4–8.

Who is legally or professionally required to comply with ISO 13485?

ISO 13485 applies to organizations whose activities include one or more stages of the medical device lifecycle, such as manufacturers, contract manufacturers, suppliers, distributors, importers, and service providers. It targets entities needing to demonstrate regulatory compliance for product safety and performance, including those providing sterilization, calibration, or technical support. Organizations must identify their regulatory roles and incorporate applicable requirements into the QMS.

Does ISO 13485 require an external audit or third-party certification?

ISO 13485 certification is voluntary but typically involves external audits by accredited certification bodies through a two-stage process: Stage 1 (documentation review) and Stage 2 (implementation verification), followed by annual surveillance and triennial recertification. While the standard itself mandates internal audits (Clause 8.2.4), third-party certification provides market-recognized evidence of conformity.

How often should an assessment for ISO 13485 be performed?

Internal audits for ISO 13485 must be performed at planned intervals to determine QMS effectiveness, with frequency based on process risk, status, and results (Clause 8.2.4). Management reviews occur at planned intervals (Clause 5.6), typically annually, reviewing inputs like audits, complaints, CAPA, and regulatory changes. Certification involves annual surveillance audits.

What are the consequences of non-compliance with ISO 13485?

Non-compliance with ISO 13485 can result in certification denial or withdrawal, regulatory enforcement actions, product holds, recalls, fines, and market access barriers. Weaknesses in areas like design controls, validation, CAPA, or post-market surveillance lead to audit nonconformities, with records retained for at least the device lifetime or two years post-release underscoring traceability failures.

Can ISO 13485 be mapped to other international frameworks?

ISO 13485 provides Annex B for correspondence with ISO 9001:2015 but excludes certain ISO 9001 elements, making direct claims of ISO 9001 conformity impossible without meeting all its requirements. It aligns with complementary standards like ISO 14971 for risk management and is referenced in regulatory frameworks such as EU MDR and the FDA QMSR (effective February 2, 2026).

What is the first step to begin implementing ISO 13485?

The first step to implement ISO 13485 is to establish and document the QMS scope, including justification for any exclusions (primarily from Clause 7), processes needed for compliance, and their interactions (Clause 4.1). This involves identifying applicable regulatory requirements, roles, and outsourced processes with written quality agreements.

Standards Comparison

REACH vs ISO 13485

REACH

Mandatory

2007

EU regulation for chemicals registration, evaluation, authorisation, restriction

ISO 13485

Mandatory

2016

International standard for medical device quality management systems

Quick Verdict

REACH mandates chemical safety data and restrictions for EU market access, while ISO 13485 certifies QMS rigor for medical devices. Companies adopt REACH for legal compliance, ISO 13485 for regulatory audits and quality assurance.

Chemical Safety

REACH

Regulation (EC) No 1907/2006 (REACH)

Cost

€€€

Complexity

Medium

Implementation Time

18-24 months

Key Features

Mandates industry registration of chemicals over 1 tonne/year
Shifts burden to industry for hazard and risk data
Authorises SVHC uses via pre-sunset applications
Enforces EU-wide restrictions through Annex XVII
Requires SDS and SVHC supply-chain communication

Quality Management

ISO 13485

ISO 13485:2016 Medical devices Quality management systems

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Risk-based controls across device lifecycle
Design development planning and validation
Post-market surveillance and complaints handling
Supplier evaluation and outsourcing controls
Documented procedures with record retention

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

REACH Details

What It Is

REACH (Regulation (EC) No 1907/2006) is a directly applicable EU regulation on Registration, Evaluation, Authorisation and Restriction of Chemicals. It protects human health and the environment by shifting responsibility to industry to generate and manage chemical risk data. Scope includes substances, mixtures, and articles manufactured/imported into EU/EEA. Core approach: tonnage-triggered, risk-based lifecycle management.

Key Components

Four pillars: Registration (≥1 t/year dossiers), Evaluation (compliance/substance checks), Authorisation (Annex XIV SVHC permissions), Restriction (Annex XVII bans/limits).
17 annexes detailing data requirements, SDS (Annex II), lists.
Chemical Safety Reports (CSR) for ≥10 t/year with exposure scenarios.
Ongoing duties; national enforcement, no certification.

Why Organizations Use It

Ensures legal EU market access, avoids fines/market bans.
Manages risks, drives substitution/innovation.
Builds supply-chain trust, ESG compliance.
Reduces recalls, enhances competitiveness via safer products.

Implementation Overview

Phased: inventory, gap analysis, dossiers, monitoring.
Data-intensive, cross-functional (procurement/R&D/EHS).
Targets manufacturers/importers/downstream users; all sizes/industries.
Self-audits, national inspections; continuous via ECHA updates.

ISO 13485 Details

What It Is

ISO 13485:2016 is the international standard titled Medical devices — Quality management systems — Requirements for regulatory purposes. It establishes a certifiable QMS framework for medical device organizations to consistently meet customer and regulatory requirements across the device lifecycle. Adopting a risk-based process approach, it mandates documented procedures, validation, and traceability.

Key Components

Organized into Clauses 4–8: QMS/documentation, management responsibility, resources, product realization, measurement/improvement.
Core elements: design controls, process validation, supplier management, post-market surveillance, complaint handling.
Integrates ISO 14971 risk management; emphasizes evidence via records.
Certification model: accredited bodies conduct Stage 1/2 audits, surveillance.

Why Organizations Use It

Facilitates market access (EU MDR, FDA QMSR 2026).
Mitigates risks of recalls, non-conformities.
Enhances efficiency, stakeholder trust, competitive advantage.

Implementation Overview

Phased: gap analysis, documentation, training, validation, internal audits.
Suits manufacturers/suppliers globally, all sizes; certification audit-ready.

Key Differences

Aspect	REACH	ISO 13485
Scope	Chemicals registration, evaluation, authorisation, restriction	Medical device QMS lifecycle from design to post-market
Industry	Chemicals, manufacturing, all EU importers	Medical devices and related services globally
Nature	Mandatory EU regulation directly applicable	Voluntary certification standard for regulatory purposes
Testing	Substance testing by tonnage, dossier evaluation	Process validation, design verification, internal audits
Penalties	National fines, effective/proportionate/dissuasive	Certification loss, no direct legal penalties

Scope

REACH

Chemicals registration, evaluation, authorisation, restriction

ISO 13485

Medical device QMS lifecycle from design to post-market

Industry

REACH

Chemicals, manufacturing, all EU importers

ISO 13485

Medical devices and related services globally

Nature

REACH

Mandatory EU regulation directly applicable

ISO 13485

Voluntary certification standard for regulatory purposes

Testing

REACH

Substance testing by tonnage, dossier evaluation

ISO 13485

Process validation, design verification, internal audits

Penalties

REACH

National fines, effective/proportionate/dissuasive

ISO 13485

Certification loss, no direct legal penalties

Frequently Asked Questions

Common questions about REACH and ISO 13485

REACH FAQ

ISO 13485 FAQ

You Might also be Interested in These Articles...

HITRUST CSF MyCSF Platform Deep Dive: Automating Evidence Collection for Continuous R2 Renewal in Multi-Regulated Environments 2025

Unpack MyCSF's AI features for HITRUST CSF: automate evidence tagging, maturity scoring & monitoring for R2 renewals amid 2025 regs. CISOs in healthcare/fintech

CIS Controls v8.1, Operationalized: Top 10 Reasons Compliance Monitoring Software Accelerates Real-World Implementation

Operationalize CIS Controls v8.1 with compliance monitoring software. Turn checklists into dashboards, tickets, and audit-proof workflows. Top 10 reasons it acc

NIST CSF 2.0 Deep Dive: Mastering the Updated Framework Core Functions

Unpack NIST CSF 2.0's enhanced Core Functions: Govern, Identify, Protect, Detect, Respond, Recover. Get SME playbooks, governance shifts & strategies for cyber

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how REACH and ISO 13485 compare against other standards

Other REACH Comparisons

Other ISO 13485 Comparisons

What It Is

Key Components

Four pillars: Registration (≥1 t/year dossiers), Evaluation (compliance/substance checks), Authorisation (Annex XIV SVHC permissions), Restriction (Annex XVII bans/limits).

17 annexes detailing data requirements, SDS (Annex II), lists.

Chemical Safety Reports (CSR) for ≥10 t/year with exposure scenarios.

Ongoing duties; national enforcement, no certification.

What It Is

Key Components

Organized into Clauses 4–8: QMS/documentation, management responsibility, resources, product realization, measurement/improvement.

Core elements: design controls, process validation, supplier management, post-market surveillance, complaint handling.

Integrates ISO 14971 risk management; emphasizes evidence via records.

Certification model: accredited bodies conduct Stage 1/2 audits, surveillance.

Aspect

REACH

ISO 13485

Scope

Chemicals registration, evaluation, authorisation, restriction

Medical device QMS lifecycle from design to post-market

Industry

Chemicals, manufacturing, all EU importers

Medical devices and related services globally

Nature

Mandatory EU regulation directly applicable

Voluntary certification standard for regulatory purposes

Testing

Substance testing by tonnage, dossier evaluation

Process validation, design verification, internal audits

Penalties

National fines, effective/proportionate/dissuasive

Certification loss, no direct legal penalties