Why Does Medical Device Translation Need an ISO 13485 Translation Company

Sell a medical device across the EU and you can owe Instructions for Use in up to 24 official languages before a single unit ships. MDR (Regulation 2017/745) Article 10(11) puts that duty on the manufacturer, and it covers labels and IFU in every market where the device is made available. Miss it and the device is not compliant, however good the engineering.

So the translation supplier you pick is a regulatory decision, not a procurement afterthought. Regulatory affairs and quality managers keep asking us the same thing: does the translation company need ISO 13485, or is a general translation certificate enough? You need both. Here's why.

The language rule is written into MDR and IVDR

MDR Article 10(11) requires the information supplied with a device, the label and the IFU, in the official language or languages of each member state where the device reaches the user. IVDR (Regulation 2017/746) sets the same obligation for in vitro diagnostics. Germany, France and Poland each require their own language, so one product can carry two dozen versions.

The rule reaches past the finished text. MDR Annex I Section 23 governs the content and legibility of labels and IFU, and Article 10(9) requires the manufacturer to run a quality management system that keeps this information accurate and current. Translation sits inside that QMS. A mistranslated warning or an out-of-date IFU is a QMS failure your notified body can cite, the same way any other regulated sector now treats language as a market-access requirement, a point we made about European defense procurement as well.

What ISO 13485 covers, and what it doesn't

ISO 13485 is the quality management system standard for medical devices. It governs design controls, supplier control, risk management and record traceability across the device lifecycle. When you outsource translation, ISO 13485 treats your language supplier as an external provider you must qualify and monitor, the same way you would qualify a sterilisation subcontractor.

Here's the limit. ISO 13485 does not specify how a translation is produced. It says personnel affecting product quality must be competent, but it sets no translator qualification, no revision step, no bilingual review. A translation company can hold ISO 13485 and still hand your Clinical Evaluation Report to a single unrevised freelancer. The certificate proves the supplier runs a device-grade QMS. It does not prove the translation itself was done to a translation standard.

Why one certificate leaves a gap

This is where ISO 17100 comes in. The translation-services standard specifies exactly what ISO 13485 leaves open: translator qualifications, a mandatory independent revision by a second qualified linguist, and defined project management. For regulated device text, that second-linguist revision is the control that catches the wrong dosage unit or the reversed contraindication before it reaches a patient.

Two more standards sit alongside. ISO 27001 protects the clinical and patient data inside a CER or a PMCF report, which matters under GDPR the moment your documents carry trial data. ISO 42001, the AI management system standard, governs how a supplier uses machine translation and large language models, so AI output stays inside an audited process rather than a public chatbot. We set out what ISO 42001 requires from an AI-governed translation company separately, and you can check which translation companies actually hold it.

The stack a compliant medical device workflow needs

For MDR and IVDR documentation, four standards interlock. Each closes a gap the others leave:

• ISO 13485 qualifies the supplier as a device-grade external provider and keeps records traceable for your technical documentation.

• ISO 17100 sets translator competence and the independent second-linguist revision the device QMS does not specify.

• ISO 27001 secures clinical and patient data in CER, IFU and PMCF files, aligning with GDPR.

• ISO 42001 governs any AI or machine translation step, keeping model use auditable under the EU AI Act (Regulation 2024/1689).

A supplier holding only ISO 17100, or only ISO 13485, covers part of this and calls it done. The combined stack is what survives an audit.

What to require from a medical device translation company

When you shortlist a provider, weigh the credentials against the ones the device sector actually demands. We built our own workflow around exactly these, so AD VERBUM will go first and let the criteria explain why:

• AD VERBUM holds ISO 13485, ISO 17100, ISO 27001 and ISO 42001 together, with certified subject-matter linguists reviewing device text and EU-hosted infrastructure for clinical data. We run MDR and IVDR terminology through client Term Bases so IFU, CER and PMCF language stays consistent across every version.

• A device-specialist competitor with ISO 13485 and ISO 17100 but no ISO 42001 covers the QMS and the translation process, yet cannot show governed AI use when you ask how machine translation is handled.

• A generalist translation company with ISO 17100 alone offers qualified linguists and revision, but does not operate a medical-device QMS and would need supplier qualification from scratch.

The ranking is not about who is louder. It is about how many of the four gaps each provider actually closes.

Where it goes wrong at the notified body audit

The failures we see are boring and expensive. Terminology drifts between the CER, the IFU and the PMCF because three linguists used three terms for one component. A translated IFU lags a design change because no version control tied the translation to the device file. A supplier cannot produce the record of who translated and who revised a given document, so the traceability chain breaks under review.

None of these is a language problem in isolation. Each is a QMS problem a language supplier caused, and your notified body will book it against your file, not the supplier's. Picking a translation company that runs the full standard stack is how you keep those findings off the audit report.

Our medical device translation services

Our medical device translation services run on ISO 27001 and ISO 42001 certified, EU-hosted infrastructure, with no reliance on public cloud tooling for core processing. Every project runs through our AI+HUMAN hybrid workflow: we ingest client Translation Memories and Term Bases first, our proprietary LLM-based LangOps System generates output constrained by client terminology on client-tuned open-weight models, and our certified subject-matter experts review for technical accuracy and regulatory compliance. Our QA is aligned to ISO 17100 and ISO 18587, with sector-specific requirements such as MDR (Regulation 2017/745) and IVDR (Regulation 2017/746) language obligations and ISO 13485 supplier control applied where relevant. We serve Life Sciences, Legal, Finance, Defense, and Manufacturing clients across 150+ languages with 3,500+ subject-matter linguists. For teams managing audit-sensitive content, contact us to discuss your security and compliance requirements directly.

FAQ

Does a medical device translation company need ISO 13485?

Yes, if you want it qualified as a device-grade external provider without building supplier controls from scratch. ISO 13485 proves the supplier runs a medical-device QMS with traceable records your technical documentation can reference. On its own it does not govern the translation process, so pair it with ISO 17100.

What does MDR Article 10(11) require for translation?

MDR (Regulation 2017/745) Article 10(11) requires the label and Instructions for Use in the official language or languages of each member state where the device reaches the user. IVDR (Regulation 2017/746) sets the same duty for in vitro diagnostics. The manufacturer carries this obligation, not the translator.

Why isn't ISO 17100 enough on its own for medical devices?

ISO 17100 sets translator qualifications and independent revision, but it does not make a supplier a medical-device QMS provider. Without ISO 13485 you have to qualify and monitor that supplier yourself under your own QMS. The two standards together close both gaps.

Which languages does the EU require for Instructions for Use?

Each member state sets the official language its market needs, so a device sold across the EU can require up to 24 languages. MDR Annex I Section 23 governs the content and legibility of that information. Confirm the requirement per member state, since some accept English for professional-use devices.

How does ISO 27001 apply to medical device translation?

CER, IFU and PMCF documents often contain clinical trial and patient data that fall under GDPR. ISO 27001 gives the information-security controls that keep that data protected while it moves through translation. It matters most when documents leave your systems for an external provider.

Does ISO 42001 matter if we don't use AI translation?

It matters the moment any supplier in your chain uses machine translation or an LLM, which most now do. ISO 42001 keeps that AI use inside an audited management system aligned with the EU AI Act (Regulation 2024/1689), rather than an ungoverned tool. Ask suppliers how they handle AI even if you assume they translate by hand.