What ISO 13485 actually costs a software startup in 2026

Ask "how much does ISO 13485 cost?" and you will get one of two answers: a consultant's day rate, or "book a demo." Neither answers the question. So here is the breakdown we wish someone had given us, line by line, with real numbers.

One thing first, because it changes how you read the rest: ISO 13485 compliance and ISO 13485 certification are different purchases. Compliance means you operate a quality management system that follows the standard. Certification means an accredited third party has audited you and issued a certificate. Many early-stage software companies need the first long before they need the second. If your product is Class I software under EU MDR, you self-declare, and there is no law requiring the certificate at all. Customers and notified bodies change that maths later, but "later" matters when you are counting runway.

The line items

1. Learning what the standard requires. The standard itself costs around €200 from your national standards body. Understanding it is where money usually leaks: a consultant walking your team through it will bill €800 to €2,000 per day, and a typical "QMS setup" engagement runs 10 to 20 days. That is €8,000 to €40,000 before a single document exists. This is the line where a small, focused team can spend close to nothing instead, because the knowledge is learnable. It is rules, written down, and the rules are the same for everyone.

2. Building the QMS itself. The documents: quality policy, SOPs, risk management procedure, training records, supplier evaluations, CAPA process. A consultant will template these for €5,000 to €15,000. An enterprise eQMS platform will charge €15,000 to €60,000 in onboarding fees to configure their system around them. Or you write them yourself with good scaffolding, which costs your time. For a founder who understands their own product, each core SOP is an afternoon, not a mystery.

3. The software to run it in. Per-seat licensing on the established platforms commonly starts around €300 to €500 per user per month, with annual or multi-year contracts and no self-serve entry point. A ten-person team is €36,000 to €60,000 per year. This is the line we built QualiHQ to break. There is a free trial, what it costs after that is answered in one place, our pricing page, and if you would like a walkthrough, book a demo, beginners especially welcome.

4. Operating evidence. Often forgotten in budgets: a QMS with empty registers fails audits. You need months of real records, closed CAPAs, a management review, an internal audit, before anyone external will take the system seriously. The cost here is discipline, not cash. Plan for roughly three months of running the system before you rely on it.

5. Certification, if and when you need it. A certification body audit for a small company typically runs €5,000 to €15,000 for the initial two-stage audit, plus annual surveillance audits after that. If you are heading for a CE mark at Class IIa, the notified body is the bigger number: based on the fee schedules notified bodies are required to publish, initial certification for a small manufacturer typically lands around €26,000 to €41,000 (QMS audit at roughly €3,000 per day for 2 to 3 days, technical documentation assessment at roughly €4,000 per day for 5 to 8 days), plus annual surveillance.

Three honest budgets

The traditional route: consultant-led setup, enterprise platform, certification. €40,000 to €100,000 in year one. This is the number that makes founders close the tab, and it is real if you buy everything at enterprise prices.

The pragmatic startup route: you learn the standard, build your own QMS in affordable tooling, spend consultant money only on targeted reviews rather than full engagements, and certify only when a customer or your device class requires it. €5,000 to €15,000 in year one, most of it on the targeted specialist review and, if applicable, certification fees.

The pre-revenue route: build the compliant system now, spend almost nothing, and defer certification until there is a commercial reason for it. This is legitimate. Compliance is a state you operate in, not a receipt you buy.

Where you should still spend money

We build software that reduces consultant dependency, and we will still tell you: there are moments where a specialist is worth the fee. Confirming a borderline device classification. Reviewing your intended use statement before it locks in downstream decisions. A pre-submission review before a notified body sees your file. Clinical evaluation reports, which must be authored by someone qualified. These are days of specialist time, not months, and they are the highest-value days you will buy.

The expensive mistake is not hiring a consultant too late. It is paying consultant day rates for work you could have done yourself with the right structure, and then discovering the knowledge left when the consultant did.

Start with the number that decides everything else

Your device classification drives most of this budget: Class I self-declares, Class IIa needs a notified body. Five minutes on our classification tool tells you which path you are budgeting for, and what standards apply. From there, the costs above stop being scary and start being a plan.

You do not need €50,000 to take your first steps into compliance. You need to know which steps they are.