What is the primary objective of **REACH**?

**The primary objective of REACH is to protect human health and the environment from chemical risks while enhancing EU industry competitiveness and promoting alternative testing methods.** Under **Regulation (EC) No 1907/2006**, it shifts responsibility to industry for registering substances, generating hazard and exposure data, and implementing risk management via registration, evaluation, authorisation, and restriction.

Who is legally or professionally required to comply with **REACH**?

**REACH legally requires manufacturers, importers, and downstream users placing substances, mixtures, or certain articles on the EU/EEA market to comply.** Registration is mandatory for substances manufactured or imported >**1 tonne/year per legal entity**; producers/importers of articles with **SVHCs ≥0.1% w/w** exceeding **1 tonne/year** must notify ECHA; non-EU manufacturers appoint an **Only Representative**.

Does **REACH** require an external audit or third-party certification?

**No, REACH does not require external audits or third-party certification.** It is a directly applicable regulation enforced by Member State authorities via inspections; ECHA manages dossiers but issues no "REACH certificates." Compliance is demonstrated through registration dossiers, **Chemical Safety Reports**, and record retention for **10 years**.

How often should an assessment for **REACH** be performed?

**REACH assessments must be performed continuously as a living obligation, with updates triggered by events like new data, tonnage changes, or list updates.** Dossiers require updates when new hazards emerge; monitor **Candidate List** (biannual), **Annex XIV**/**XVII** amendments, and **CoRAP** annually; **Chemical Safety Assessments** scale by tonnage bands (≥1, ≥10, ≥100, ≥1000 tonnes/year).

What are the consequences of non-compliance with **REACH**?

**Non-compliance with REACH results in penalties set by Member States that must be effective, proportionate, and dissuasive under Article 126.** These include fines, product seizures, market bans, and potential criminal sanctions; enforcement varies by country via national inspections coordinated by ECHA's Forum, with risks of supply-chain disruption and Article 33 (45-day) response failures.

Can **REACH** be mapped to other international frameworks?

**Yes, REACH elements such as data requirements and risk assessments can be mapped to other international frameworks.** Its **Chemical Safety Reports**, **exposure scenarios**, and **SVHC** criteria align with global systems like GHS for SDS and OECD for testing, enabling data reuse despite jurisdiction-specific adaptations.

What is the first step to begin implementing **REACH**?

**The first step to implement REACH is to conduct a gap analysis building a master substance inventory by legal entity and tonnage.** Identify substances >**1 tonne/year**, map roles (manufacturer/importer/downstream user), screen against **Candidate List**/**Annexes**, and prioritize high-risk items for dossier preparation via IUCLID.

What is the primary objective of **ISO 13485**?

**ISO 13485:2016 specifies requirements for a quality management system (QMS) to demonstrate the ability to consistently provide medical devices and related services that meet customer and applicable regulatory requirements.** This standard applies to organizations involved in one or more stages of the medical device lifecycle, including design, production, distribution, installation, servicing, and decommissioning. It emphasizes documented processes, risk-based controls, validation, traceability, and post-market surveillance across Clauses 4–8.

Who is legally or professionally required to comply with **ISO 13485**?

**ISO 13485 applies to organizations whose activities include one or more stages of the medical device lifecycle, such as manufacturers, contract manufacturers, suppliers, distributors, importers, and service providers.** It targets entities needing to demonstrate regulatory compliance for product safety and performance, including those providing sterilization, calibration, or technical support. Organizations must identify their regulatory roles and incorporate applicable requirements into the QMS.

Does **ISO 13485** require an external audit or third-party certification?

**ISO 13485 certification is voluntary but typically involves external audits by accredited certification bodies through a two-stage process: Stage 1 (documentation review) and Stage 2 (implementation verification), followed by annual surveillance and triennial recertification.** While the standard itself mandates internal audits (Clause 8.2.4), third-party certification provides market-recognized evidence of conformity.

How often should an assessment for **ISO 13485** be performed?

**Internal audits for ISO 13485 must be performed at planned intervals to determine QMS effectiveness, with frequency based on process risk, status, and results (Clause 8.2.4).** Management reviews occur at planned intervals (Clause 5.6), typically annually, reviewing inputs like audits, complaints, CAPA, and regulatory changes. Certification involves annual surveillance audits.

What are the consequences of non-compliance with **ISO 13485**?

**Non-compliance with ISO 13485 can result in certification denial or withdrawal, regulatory enforcement actions, product holds, recalls, fines, and market access barriers.** Weaknesses in areas like design controls, validation, CAPA, or post-market surveillance lead to audit nonconformities, with records retained for at least the device lifetime or two years post-release underscoring traceability failures.

Can **ISO 13485** be mapped to other international frameworks?

**ISO 13485 provides Annex B for correspondence with ISO 9001:2015 but excludes certain ISO 9001 elements, making direct claims of ISO 9001 conformity impossible without meeting all its requirements.** It aligns with complementary standards like ISO 14971 for risk management and is referenced in regulatory frameworks such as EU MDR and upcoming FDA QMSR (effective February 2, 2026).

What is the first step to begin implementing **ISO 13485**?

**The first step to implement ISO 13485 is to establish and document the QMS scope, including justification for any exclusions (primarily from Clause 7), processes needed for compliance, and their interactions (Clause 4.1).** This involves identifying applicable regulatory requirements, roles, and outsourced processes with written quality agreements.

REACH vs ISO 13485

Standards Comparison

REACH

Mandatory

2007

EU regulation for chemicals registration, evaluation, authorisation, restriction

ISO 13485

Mandatory

2016

International standard for medical device quality management systems

Quick Verdict

REACH mandates chemical safety data and restrictions for EU market access, while ISO 13485 certifies QMS rigor for medical devices. Companies adopt REACH for legal compliance, ISO 13485 for regulatory audits and quality assurance.

Chemical Safety

REACH

Regulation (EC) No 1907/2006 (REACH)

Cost

€€€

Complexity

Medium

Implementation Time

18-24 months

Key Features

Mandates industry registration of chemicals over 1 tonne/year
Shifts burden to industry for hazard and risk data
Authorises SVHC uses via pre-sunset applications
Enforces EU-wide restrictions through Annex XVII
Requires SDS and SVHC supply-chain communication

Quality Management

ISO 13485

ISO 13485:2016 Medical devices Quality management systems

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Risk-based controls across device lifecycle
Design development planning and validation
Post-market surveillance and complaints handling
Supplier evaluation and outsourcing controls
Documented procedures with record retention

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

REACH Details

What It Is

REACH (Regulation (EC) No 1907/2006) is a directly applicable EU regulation on Registration, Evaluation, Authorisation and Restriction of Chemicals. It protects human health and the environment by shifting responsibility to industry to generate and manage chemical risk data. Scope includes substances, mixtures, and articles manufactured/imported into EU/EEA. Core approach: tonnage-triggered, risk-based lifecycle management.

Key Components

Four pillars: Registration (≥1 t/year dossiers), Evaluation (compliance/substance checks), Authorisation (Annex XIV SVHC permissions), Restriction (Annex XVII bans/limits).
17 annexes detailing data requirements, SDS (Annex II), lists.
Chemical Safety Reports (CSR) for ≥10 t/year with exposure scenarios.
Ongoing duties; national enforcement, no certification.

Why Organizations Use It

Ensures legal EU market access, avoids fines/market bans.
Manages risks, drives substitution/innovation.
Builds supply-chain trust, ESG compliance.
Reduces recalls, enhances competitiveness via safer products.

Implementation Overview

Phased: inventory, gap analysis, dossiers, monitoring.
Data-intensive, cross-functional (procurement/R&D/EHS).
Targets manufacturers/importers/downstream users; all sizes/industries.
Self-audits, national inspections; continuous via ECHA updates.

ISO 13485 Details

What It Is

ISO 13485:2016 is the international standard titled Medical devices — Quality management systems — Requirements for regulatory purposes. It establishes a certifiable QMS framework for medical device organizations to consistently meet customer and regulatory requirements across the device lifecycle. Adopting a risk-based process approach, it mandates documented procedures, validation, and traceability.

Key Components

Organized into Clauses 4–8: QMS/documentation, management responsibility, resources, product realization, measurement/improvement.
Core elements: design controls, process validation, supplier management, post-market surveillance, complaint handling.
Integrates ISO 14971 risk management; emphasizes evidence via records.
Certification model: accredited bodies conduct Stage 1/2 audits, surveillance.

Why Organizations Use It

Facilitates market access (EU MDR, FDA QMSR 2026).
Mitigates risks of recalls, non-conformities.
Enhances efficiency, stakeholder trust, competitive advantage.

Implementation Overview

Phased: gap analysis, documentation, training, validation, internal audits.
Suits manufacturers/suppliers globally, all sizes; certification audit-ready.

Key Differences

Aspect	REACH	ISO 13485
Scope	Chemicals registration, evaluation, authorisation, restriction	Medical device QMS lifecycle from design to post-market
Industry	Chemicals, manufacturing, all EU importers	Medical devices and related services globally
Nature	Mandatory EU regulation directly applicable	Voluntary certification standard for regulatory purposes
Testing	Substance testing by tonnage, dossier evaluation	Process validation, design verification, internal audits
Penalties	National fines, effective/proportionate/dissuasive	Certification loss, no direct legal penalties

Scope

REACH

Chemicals registration, evaluation, authorisation, restriction

ISO 13485

Medical device QMS lifecycle from design to post-market

Industry

REACH

Chemicals, manufacturing, all EU importers

ISO 13485

Medical devices and related services globally

Nature

REACH

Mandatory EU regulation directly applicable

ISO 13485

Voluntary certification standard for regulatory purposes

Testing

REACH

Substance testing by tonnage, dossier evaluation

ISO 13485

Process validation, design verification, internal audits

Penalties

REACH

National fines, effective/proportionate/dissuasive

ISO 13485

Certification loss, no direct legal penalties

Frequently Asked Questions

Common questions about REACH and ISO 13485

REACH FAQ

ISO 13485 FAQ

You Might also be Interested in These Articles...

DORA Third-Party Risk Management: A Consultant’s Guide to Mapping Critical ICT Service Providers in 2026

Navigate DORA's complex third-party risk pillar. Step-by-step consultant guide to identify critical ICT providers, remediate Article 30 contracts, and build the

NIST CSF 2.0 Deep Dive: Mastering the Updated Framework Core Functions

Unpack NIST CSF 2.0's enhanced Core Functions: Govern, Identify, Protect, Detect, Respond, Recover. Get SME playbooks, governance shifts & strategies for cyber

5 Ways Modern Compliance Software Makes Evolving Regulations Your Strategic Advantage

Discover 5 ways modern compliance software turns evolving regulations into strategic advantage. Automate monitoring, cut 3x non-compliance costs, stay audit-rea

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Check out these other Gradum.io Standards Comparison Pages

Six Sigma vs FDA 21 CFR Part 11

Uncover Six Sigma vs FDA 21 CFR Part 11: DMAIC rigor vs electronic records controls, validation & audit trails for life sciences compliance. Boost data integrity—read now!

CSL (Cyber Security Law of China) vs SOX

CSL vs SOX: China's Cybersecurity Law vs Sarbanes-Oxley. Master data localization, ICFR, governance pillars & compliance strategies for global firms. Navigate risks to advantage now!

ISO 9001 vs ISO 27701

Explore ISO 9001 vs ISO 27701: Quality management meets privacy PIMS. Key differences, benefits, PDCA integration & compliance tips for your business success!

REACH

ISO 13485

Quick Verdict

REACH

Key Features

ISO 13485

Key Features

Detailed Analysis

REACH Details

What It Is

Key Components

Why Organizations Use It

Implementation Overview

ISO 13485 Details

What It Is

Key Components

Why Organizations Use It

Implementation Overview

Key Differences

Scope

Industry

Nature

Testing

Penalties

Frequently Asked Questions

REACH FAQ

What is the primary objective of REACH?

Who is legally or professionally required to comply with REACH?

Does REACH require an external audit or third-party certification?

How often should an assessment for REACH be performed?

What are the consequences of non-compliance with REACH?

Can REACH be mapped to other international frameworks?

What is the first step to begin implementing REACH?

ISO 13485 FAQ

What is the primary objective of ISO 13485?

Who is legally or professionally required to comply with ISO 13485?

Does ISO 13485 require an external audit or third-party certification?

How often should an assessment for ISO 13485 be performed?

What are the consequences of non-compliance with ISO 13485?

Can ISO 13485 be mapped to other international frameworks?

What is the first step to begin implementing ISO 13485?

You Might also be Interested in These Articles...

DORA Third-Party Risk Management: A Consultant’s Guide to Mapping Critical ICT Service Providers in 2026

NIST CSF 2.0 Deep Dive: Mastering the Updated Framework Core Functions

5 Ways Modern Compliance Software Makes Evolving Regulations Your Strategic Advantage

Run Maturity Assessments with GRADUM

Check out these other Gradum.io Standards Comparison Pages

Six Sigma vs FDA 21 CFR Part 11

CSL (Cyber Security Law of China) vs SOX

ISO 9001 vs ISO 27701