The NHS — the UK's largest organisation with £200+ billion annual budget — is one of the world's most ISO-demanding procurement environments. NHS Supply Chain, NHS shared business services, and individual NHS Trust procurement all require ISO from their supplier base. For medical device companies, healthcare IT providers, and clinical services suppliers, UKAS-accredited ISO is the gateway to NHS contracts.
£200B+
NHS annual budget
UKAS
Required accreditor for NHS
ISO 13485
Medical device specific
£500
Starting cost
NHS Procurement — ISO Requirements
| NHS Procurement Channel | ISO Requirement |
|---|---|
| NHS Supply Chain | ISO 9001 or ISO 13485 (medical devices) |
| NHS Shared Business Services | ISO 9001 + ISO 27001 for IT/digital |
| CCS Healthcare Technology Framework | ISO 9001 + ISO 27001 for digital health |
| Individual NHS Trusts (clinical) | ISO 9001 minimum; ISO 13485 for devices |
| NHS England (national contracts) | ISO 9001 + ISO 27001 mandatory |
MHRA and ISO 13485
For medical device companies, MHRA (Medicines and Healthcare products Regulatory Agency) requires ISO 13485 from manufacturers. ISO 13485 also supports UKCA marking for medical devices post-Brexit.
Cost for NHS Suppliers
| Company Type | Standard | Cost From (GBP) |
|---|---|---|
| Medical device distributor | ISO 9001 + ISO 13485 | £1,200 |
| Healthcare IT company | ISO 9001 + ISO 27001 | £1,400 |
| Clinical services vendor | ISO 9001 | £500 |
| Pharmacy/healthcare supplies | ISO 9001 | £500 |
Get ISO Certified in United Kingdom Today!
IAF CertSearch verifiable · UKAS (United Kingdom Accreditation Service) aligned · From GBP 500 · Fully online
Frequently Asked Questions
ISO 13485 is required for medical device manufacturers under MHRA regulations. For distributors and resellers of medical devices: ISO 9001 may be acceptable, with ISO 13485 increasingly preferred. NHS Supply Chain specification for each product category states the requirement — check the specific category.
ISO 27001 aligns with the NHS Data Security and Protection Toolkit (DSPT). Companies achieving ISO 27001 have met or exceeded most DSPT standards. NHS Digital specifically recognizes ISO 27001 as strong evidence of information security management maturity.