| A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z | ||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1 | Standard clause | ISO 13485:2016 Requirement excerpt (original English) | Plain-language explanation, examples and evidence | Documentary evidence required? Yes / No | Yes | No | Not applicable | Client document / evidence, findings or N/A justification | |||||||||||||||||||
2 | 4.1.1 | The organization shall document a quality management system and maintain its effectiveness […] | Is the QMS documented, implemented and effective against ISO 13485 and applicable regulatory requirements? Documents are required: QMS procedures, records and other necessary documents. Check actual orders to confirm that documented arrangements are implemented. | Yes | — | ||||||||||||||||||||||
3 | 4.1.1 | The organization shall document the role(s) undertaken by the organization under the applicable regulatory requirements. | Are the organization's regulatory roles and markets identified? Roles must be documented, for example manufacturer, importer, distributor or authorized representative. A role–market–obligation matrix is one possible format, not a prescribed document title. | Yes | — | ||||||||||||||||||||||
4 | 4.1.2 | […] apply a risk based approach to the control of the appropriate processes needed for the quality management system; | Are processes, their sequence and interactions identified, with controls proportionate to risk? QMS and process interactions must be documented under 4.1.1 and 4.2.2. Examples include a process map and stronger controls for sterilization and critical suppliers. A separately titled QMS risk register is not prescribed. | Yes | — | ||||||||||||||||||||||
5 | 4.1.3 a)–d) | […] monitor, measure as appropriate, and analyse these processes; | Does each process have criteria, methods, resources, information and actions needed to achieve results? Supporting records are required by 4.1.3 e). Examples include defect rates, complaint investigation times, monitoring results and actions. A separate process passport is not mandatory. | Yes | — | ||||||||||||||||||||||
6 | 4.1.3 e) | […] establish and maintain records needed to demonstrate conformance to this International Standard and compliance with applicable regulatory requirements […] | Are records needed to demonstrate process operation and compliance identified and retained? The records themselves are mandatory. Examples include acceptance, training, validation and audit records. A record list with owners helps check completeness; its format is not prescribed. | Yes | — | ||||||||||||||||||||||
7 | 4.1.4 | Changes to be made to these processes shall be: […] evaluated for their impact on the medical devices produced under this quality management system; | Are process changes assessed for effects on the QMS and devices and controlled before implementation? This clause names no separate form, but conformity records under 4.1.3 e) and specific records under 7.3.9 or 7.5.6 remain necessary where applicable. Example: change request with impact assessment and revalidation decision. | Yes | — | ||||||||||||||||||||||
8 | 4.1.5 | The controls shall include written quality agreements. | Are outsourced processes controlled according to risk and supplier capability, with responsibility retained by the organization? Written quality agreements and control records are required when outsourcing occurs, for example contract sterilization. If none occur, substantiate this through the QMS scope and process inventory; clause 4 is not excluded. | Yes | — | ||||||||||||||||||||||
9 | 4.1.6 | The organization shall document procedures for the validation of the application of computer software used in the quality management system. | Are there documented procedures and records for risk-based validation of QMS software before first use and, as appropriate, after changes? Examples include an eQMS, complaint system or spreadsheet used for quality decisions. Validate the actual application. If no software is used, substantiate this through the system and process inventory; clause 4 is not excluded. | Yes | — | ||||||||||||||||||||||
10 | 4.2.1 | The quality management system documentation […] shall include: […] documented procedures and records required by this International Standard; | Does documentation include the policy, objectives, quality manual, required procedures and records, necessary operating documents and regulatory documentation? All applicable items are mandatory. Linked electronic documents are acceptable, and one document may address several requirements. | Yes | — | ||||||||||||||||||||||
11 | 4.2.2; 1 | The organization shall document a quality manual that includes: […] the scope of the quality management system, including details of and justification for any exclusion or non-application; | A quality manual is mandatory. Include scope, procedures or references, process interactions and documentation structure. Justify any non-application within clauses 6–8 by activities or the nature of the device. Exclusion of design controls must take account of permission under applicable regulatory requirements. Outsourcing alone does not justify exclusion. | Yes | — | ||||||||||||||||||||||
12 | 4.2.3 | For each medical device type or medical device family, the organization shall establish and maintain one or more files […] | Is a medical device file or linked document set maintained for each type/family? Required content covers description, intended use, labelling/IFU, specifications, manufacturing, packaging, storage, handling, distribution and monitoring/measurement, plus installation and servicing where appropriate. This does not replace the design file under 7.3.10. | Yes | — | ||||||||||||||||||||||
13 | 4.2.4 a)–e) | […] ensure that relevant versions of applicable documents are available at points of use; | Are documents reviewed and approved before issue, updated and reapproved, with changes and revisions identified? A document-control procedure is mandatory. Check that current, legible, identifiable instructions are available at workstations and that authorized functions approve changes with sufficient background information. | Yes | — | ||||||||||||||||||||||
14 | 4.2.4 f)–h) | […] prevent the unintended use of obsolete documents and apply suitable identification to them. | Are external documents identified and their distribution controlled, documents protected from loss/deterioration, and obsolete versions withdrawn or marked? These controls must be in the document-control procedure. Examples include a standards list, access controls, backups and revision archives. | Yes | — | ||||||||||||||||||||||
15 | 4.2.4 | The organization shall define the period for which at least one copy of obsolete documents shall be retained. | Is the retention period for at least one copy of obsolete documents defined? Retention controls and the archive are required. Manufacturing/testing documents must remain available for at least the defined device lifetime, no less than the associated record retention period, taking applicable regulatory requirements into account. Sample an older batch. | Yes | — | ||||||||||||||||||||||
16 | 4.2.5 | Records shall remain legible, readily identifiable and retrievable. Changes to a record shall remain identifiable. | Are documented procedures in place for identification, storage, security, integrity, retrieval, retention and disposal of records? Procedures and records are mandatory. Examples include access controls, backups and an audit trail; changes must remain identifiable. | Yes | — | ||||||||||||||||||||||
17 | 4.2.5 | The organization shall define and implement methods for protecting confidential health information contained in records […] | Is confidential health information protected where it is present in records? Include applicable controls in record-management arrangements: role-based access, de-identification and secure transmission. If such information is absent, confirm this from the record inventory. Record-control requirements still apply. | Yes | — | ||||||||||||||||||||||
18 | 4.2.5 | The organization shall retain the records for at least the lifetime of the medical device […] but not less than two years from the medical device release by the organization. | Retention rules and accessible records are required. Retain records for at least the defined device lifetime or as specified by applicable regulatory requirements, but never less than two years from release by the organization. Observe longer mandatory periods. Check release dates against scheduled disposal dates. | Yes | — | ||||||||||||||||||||||
19 | 5.1 | Top management shall provide evidence of its commitment […] | Does top management communicate customer/regulatory priorities, establish policy and objectives, conduct reviews and provide resources? Documents are required through 4.2.1 and 5.6: policy, objectives and review records. Also check actual staffing, equipment and funding decisions. | Yes | — | ||||||||||||||||||||||
20 | 5.2 | Top management shall ensure that customer requirements and applicable regulatory requirements are determined and met. | Does leadership ensure customer and regulatory requirements are identified and met? Clause 5.2 does not prescribe a separate document. Indirect evidence includes management interviews, fulfilled commitments and resolved issues. Mandatory order-review and other process records are checked under 7.2 and other applicable clauses. | No | — | ||||||||||||||||||||||
21 | 5.3; 4.2.1 a) | […] is communicated and understood within the organization; | Is the documented policy appropriate to the organization's purpose, committed to compliance and QMS effectiveness, a framework for objectives, communicated, understood and reviewed? The policy is mandatory under 4.2.1 a). Use interviews to check understanding and management-review decisions to check suitability. | Yes | — | ||||||||||||||||||||||
22 | 5.4.1; 4.2.1 a) | The quality objectives shall be measurable and consistent with the quality policy. | Are measurable objectives established at relevant functions and levels, including product and regulatory needs? Documented objectives are mandatory. Example: reduce recurring defects to a defined rate by a specified date. Check policy alignment and actual monitoring of achievement. | Yes | — | ||||||||||||||||||||||
23 | 5.4.2 | […] the integrity of the quality management system is maintained when changes to the quality management system are planned and implemented. | Does QMS planning address 4.1 and the objectives, preserving system integrity through changes? No separately titled planning document is prescribed. Check, for example, continuity of responsibilities, training and controls during a production transfer. Related mandatory documents and records still apply. | No | — | ||||||||||||||||||||||
24 | 5.5.1 | […] responsibilities and authorities are defined, documented and communicated within the organization. | Are responsibilities, authorities and personnel relationships documented and communicated, with necessary independence? Relevant documents are mandatory. Examples include an organization chart, job descriptions, product-release authority and authority to block nonconforming devices. | Yes | — | ||||||||||||||||||||||
25 | 5.5.2; 5.5.1 | Top management shall appoint a member of management […] | Is a management representative appointed to ensure documented processes, report QMS effectiveness/improvement needs and promote awareness of requirements? Responsibilities must be documented under 5.5.1. An appointment letter or job description is an example; check actual reporting to top management. | Yes | — | ||||||||||||||||||||||
26 | 5.5.3 | […] communication takes place regarding the effectiveness of the quality management system. | Does internal communication address QMS effectiveness? A separate procedure or minutes for every meeting are not expressly required. Indirect evidence includes staff awareness of quality issues, decisions and changes, supported by meetings, notices or performance boards. | No | — | ||||||||||||||||||||||
27 | 5.6.1 | The organization shall document procedures for management review. | A procedure, documented planned intervals and review records are mandatory. Review QMS suitability, adequacy, effectiveness, improvement opportunities and changes to policy/objectives. Examples include a schedule and top-management review minutes. The standard does not prescribe a universal annual frequency. | Yes | — | ||||||||||||||||||||||
28 | 5.6.2 | The input to management review shall include, but is not limited to, information arising from: | Do review inputs cover feedback, complaints, regulatory reporting, audits, processes, product, corrective/preventive actions, previous actions, changes, improvement recommendations and new/revised regulatory requirements? Records of reviewed inputs are required by 5.6.3. Record absence of events rather than silently omitting a topic. | Yes | — | ||||||||||||||||||||||
29 | 5.6.3 | The output from management review shall be recorded […] | Are reviewed inputs and decisions on QMS effectiveness, product improvement, regulatory changes and resources recorded? Records are mandatory. A practical format is minutes with actions, owners and deadlines; check follow-up on previous decisions. | Yes | — | ||||||||||||||||||||||
30 | 6.1 | The organization shall determine and provide the resources needed to: | Are people, time, equipment and funding sufficient for the QMS and customer/regulatory requirements? This clause prescribes no separate budget or resource plan. Evidence includes staffing, available equipment and timely handling of critical tasks. Resource needs are recorded in management review under 5.6.3. | No | — | ||||||||||||||||||||||
31 | 6.2 | The organization shall document the process(es) for establishing competence, providing needed training, and ensuring awareness of personnel. | A documented process for competence, training and awareness is mandatory. Are education, training, skills and experience defined for work affecting quality? Examples include role requirements, a competency matrix and authorization to perform operations. | Yes | — | ||||||||||||||||||||||
32 | 6.2 b)–e) | […] maintain appropriate records of education, training, skills and experience […] | Has required training or other action occurred, with effectiveness evaluated and staff aware of their contribution to objectives? Competence records are mandatory. Examples include qualifications, observed task performance and post-training skill assessments. Attendance alone does not demonstrate effectiveness. | Yes | — | ||||||||||||||||||||||
33 | 6.3 | The organization shall document the requirements for the infrastructure […] | Infrastructure requirements must be documented as needed for buildings, utilities, equipment, software and supporting services. Do they ensure conformity, prevent product mix-ups and support orderly handling? Examples include warehouse zoning, equipment specifications and power-supply requirements. | Yes | — | ||||||||||||||||||||||
34 | 6.3 | Records of such maintenance shall be maintained […] | Where maintenance or its absence can affect quality, documented tasks/intervals and maintenance records are required. Examples include schedules, work logs and filter replacement. N/A requires a justified absence of relevant equipment or quality impact, recorded in the quality manual. | Yes | |||||||||||||||||||||||
35 | 6.4.1 | The organization shall document the requirements for the work environment […] | Required work-environment conditions must be documented. Where conditions could adversely affect quality, monitoring/control procedures are required. Examples include temperature, humidity, cleanliness and lighting. Any N/A must be justified by activities/device nature in the manual; the specific pre-cleaning exception applies only under 7.5.2 a), b). | Yes | |||||||||||||||||||||||
36 | 6.4.1 a), b) | […] document requirements for health, cleanliness and clothing of personnel […] | Where personnel contact can affect device safety/performance, health, cleanliness and clothing requirements must be documented. Temporary personnel in special environments must be competent or supervised. Examples include gowning instructions and contractor access controls. N/A requires justification of absent conditions/contact in the manual. | Yes | |||||||||||||||||||||||
37 | 6.4.2 | […] the organization shall plan and document arrangements for the control of contaminated or potentially contaminated product […] | Where appropriate, document controls preventing contaminated or potentially contaminated product from contaminating the environment, staff or other product. Example: isolation and decontamination of used returned devices. N/A requires justified absence of such product/risk, recorded in the manual. | Yes | |||||||||||||||||||||||
38 | 6.4.2 | For sterile medical devices, the organization shall document requirements for control of contamination with microorganisms or particulate matter […] | For sterile devices, document microbial/particulate contamination requirements and maintain required cleanliness during assembly/packaging. Examples include limits, environmental monitoring and excursion actions. N/A applies where sterile devices are outside applicable activities, with justification in the manual. | Yes | |||||||||||||||||||||||
39 | 7.1 | The output of this planning shall be documented in a form suitable for the organization’s method of operations. | Does realization planning align with the QMS and cover objectives/requirements, processes, resources, verification, validation, storage, distribution, traceability, acceptance criteria and records? Documented planning outputs are mandatory. Examples include a quality plan, manufacturing route and inspection plan; no universal form is prescribed. | Yes | — | ||||||||||||||||||||||
40 | 7.1 | The organization shall document one or more processes for risk management in product realization. | A documented risk-management process and records of its application in product realization are mandatory. Examples include hazard analysis, risk assessment, controls, residual-risk evaluation and updates from feedback. The informative reference to ISO 14971 does not replace implementing 7.1. | Yes | — | ||||||||||||||||||||||
41 | 7.2.1; 7.2.2 a) | […] applicable regulatory requirements related to the product; | Are customer delivery/post-delivery requirements, known intended-use needs, applicable regulations and additional requirements identified? Product requirements must be documented under 7.2.2. Examples include an order specification and market-requirements checklist with compliance evidence. | Yes | — | ||||||||||||||||||||||
42 | 7.2.1 d); 7.2.2 d) | […] any user training needed to ensure specified performance and safe use of the medical device; | Is user training needed for safe use/performance identified and available or planned? Capture the decision in documented requirements and order review. Examples include operator training, a syllabus and materials. N/A requires justified absence of a training need, recorded in the manual and device requirements. | Yes | |||||||||||||||||||||||
43 | 7.2.2 | Records of the results of the review and actions arising from the review shall be maintained […] | Before accepting an order/change, are documented requirements, differences, regulatory compliance, training and delivery capability reviewed? Review and action records are mandatory. Confirm customer requirements before acceptance when no written statement exists. Example: an approved order-review workflow. | Yes | — | ||||||||||||||||||||||
44 | 7.2.2 | When product requirements are changed, the organization shall ensure that relevant documents are amended […] | When requirements change, are affected documents updated and relevant personnel informed? Updated documents and review records under 7.2.2 are required. Example: revised order specification, production notification and assessment of batches already in progress. No recent changes does not remove the need for a working process. | Yes | — | ||||||||||||||||||||||
45 | 7.2.3 | The organization shall plan and document arrangements for communicating with customers […] | Are communication arrangements documented for product information, enquiries/orders/changes, feedback/complaints and advisory notices? These arrangements are mandatory. Communicate with regulatory authorities as applicable requirements demand. Examples include contacts, owners, response times and escalation routes. | Yes | — | ||||||||||||||||||||||
46 | 7.3.1 | The organization shall document procedures for design and development. | Are mandatory design/development procedures established, covering planning, inputs, outputs, review, verification, validation, transfer and changes? N/A for 7.3 requires justification under clause 1 in the quality manual, considering applicable regulations. Outsourcing design alone is not justification. | Yes | |||||||||||||||||||||||
47 | 7.3.2 | The organization shall plan and control the design and development of product. | Maintain current design-planning documents covering stages, reviews, verification/validation/transfer, authority, resources/competence and input–output traceability methods. Examples include a project plan and traceability matrix. N/A only where the relevant design activity is justifiably non-applicable under clauses 1 and 4.2.2. | Yes | |||||||||||||||||||||||
48 | 7.3.3 | These inputs shall be reviewed for adequacy and approved. | Do inputs cover function, performance, usability, safety, intended use, regulations/standards, risk outputs and relevant previous designs? Input records and approval are mandatory. Requirements must be complete, verifiable/validatable, unambiguous and consistent. Example: approved design-input specification. N/A requires justification under clauses 1 and 4.2.2. | Yes | |||||||||||||||||||||||
49 | 7.3.4 | Records of the design and development outputs shall be maintained […] | Do outputs meet inputs, support verification, purchasing/manufacturing/service, acceptance criteria and safe use? Output records and approval before release are mandatory. Examples include drawings, specifications, software and instructions. N/A requires justified non-application of design under clauses 1 and 4.2.2. | Yes | |||||||||||||||||||||||
50 | 7.3.5 | […] systematic reviews of design and development shall be performed […] | Are planned design reviews held at suitable stages with relevant functions and specialists? Records must identify results, actions, the design, participants and date. Example: design-gate review minutes. N/A requires justified non-application of design under clauses 1 and 4.2.2. | Yes | |||||||||||||||||||||||
51 | 7.3.6 | The organization shall document verification plans that include methods, acceptance criteria […] | Does verification demonstrate that outputs meet inputs? Mandatory evidence includes plans, methods, criteria, statistics/sample-size rationale where appropriate, results, conclusions and actions. Example: accuracy testing against a design input. N/A requires justified non-application of design under clauses 1 and 4.2.2. | Yes | |||||||||||||||||||||||
52 | 7.3.6; 7.3.7 | […] verification shall include confirmation that the design outputs meet design inputs when so connected or interfaced. | Where intended use requires connection/interface with another device, do verification and validation cover design inputs and intended use in that configuration? Plans and results are mandatory. Example: sensor–monitor compatibility. N/A where no such intended interface exists or 7.3 is justifiably non-applicable; record justification in the manual. | Yes | |||||||||||||||||||||||
53 | 7.3.7 | Design validation shall be conducted on representative product. | Does validation establish fitness for specified/intended use before release for customer use? Required evidence includes plans, methods/criteria, statistics where appropriate, representative-product rationale, results, conclusions and actions. Example: simulated-use testing. N/A requires justification under clauses 1 and 4.2.2. | Yes | |||||||||||||||||||||||
54 | 7.3.7 | […] the organization shall perform clinical evaluations or performance evaluations of the medical device […] | As part of validation, are clinical/performance evaluations completed under applicable regulatory requirements? Evaluation results are required; this does not always mean a new clinical investigation. A device used for evaluation is not considered released for customer use. N/A requires justified non-application for the device/role in the manual. | Yes | |||||||||||||||||||||||
55 | 7.3.8 | Results and conclusions of the transfer shall be recorded […] | Are design-transfer procedures documented and results/conclusions recorded? Verify outputs are suitable for manufacturing before final production specifications and confirm production capability. Examples include a pilot batch and transfer approval. N/A requires justified non-application of the activity under clauses 1 and 4.2.2. | Yes | |||||||||||||||||||||||
56 | 7.3.9 | The organization shall document procedures to control design and development changes. | A procedure, change identification and review/action records are mandatory. Before implementation, review, verify, validate where appropriate and approve changes. Assess function, usability, safety, regulations, components, in-process/delivered product, risk outputs/inputs and realization processes. N/A only with justification under clauses 1 and 4.2.2. | Yes | |||||||||||||||||||||||
57 | 7.3.10 | The organization shall maintain a design and development file for each medical device type or medical device family. | Is there a mandatory design file for each device type/family containing or referencing evidence for 7.3, including changes? Example: a project index linking requirements, tests and decisions. N/A requires justified non-application of design under clauses 1 and 4.2.2. | Yes | |||||||||||||||||||||||
58 | 7.4.1 | The organization shall document procedures […] to ensure that purchased product conforms to specified purchasing information. | Are purchasing procedures and supplier selection/evaluation criteria established based on capability, performance, quality impact and risk? Procedures and evaluation/selection records are mandatory. Example: qualification of a critical-component supplier. N/A only if applicable purchasing is absent and justified in the manual. | Yes | |||||||||||||||||||||||
59 | 7.4.1 | The organization shall plan the monitoring and re-evaluation of suppliers. | Are suppliers monitored and re-evaluated using performance data, with failures addressed proportionately to risk and regulatory compliance? Monitoring, re-evaluation and action records are required. Examples include incoming defects, delivery performance and remedial actions. N/A requires justified absence of applicable purchasing in the manual. | Yes | |||||||||||||||||||||||
60 | 7.4.2 | Purchasing information shall describe or reference the product to be purchased […] | Does purchasing information specify the product and appropriate acceptance, process/equipment, personnel qualification and QMS requirements, checked before communication? Retain documents/records to the extent required for traceability under 7.5.9. Examples include approved orders and specifications. N/A requires justified absence of applicable purchasing in the manual. | Yes | |||||||||||||||||||||||
61 | 7.4.2 | […] a written agreement that the supplier notify the organization of changes in the purchased product prior to implementation […] | Where applicable, is there a mandatory written agreement requiring advance notice of changes affecting purchased-product conformity? Example: a contract clause covering material/process changes. N/A only where the agreement or purchasing is justifiably non-applicable, with justification in the manual. | Yes | |||||||||||||||||||||||
62 | 7.4.3 | Records of the verification shall be maintained […] | Is purchased-product verification proportionate to risk and supplier evaluation? Assess known product changes; specify supplier-site verification/release arrangements where intended. Verification records are mandatory. Examples include incoming inspection and batch certificate review. N/A requires justified absence of applicable purchasing in the manual. | Yes | |||||||||||||||||||||||
63 | 7.5.1 a)–f) | Production and service provision shall be planned, carried out, monitored and controlled […] | Are applicable procedures/methods, qualified infrastructure, process/product monitoring, measuring equipment, labelling/packaging, release, delivery and post-delivery controls in place? Necessary control documents and records are required. Example: an operating instruction with parameter limits. N/A requires justified absence of the activity, not merely outsourcing. | Yes | |||||||||||||||||||||||
64 | 7.5.1 | The record shall be verified and approved. | For each device/batch, maintain a verified and approved record supporting 7.5.9 traceability and identifying quantities manufactured and approved for distribution. Example: a batch traveller or electronic batch record. N/A requires justified absence of the relevant activity under clauses 1 and 4.2.2. | Yes | |||||||||||||||||||||||
65 | 7.5.2 | The organization shall document requirements for cleanliness of product or contamination control of product […] | Cleanliness requirements must be documented when cleaning before sterilization/use, cleanliness significance or removal of process agents makes a)–e) applicable. Example: a residual-detergent limit. N/A requires none of a)–e) to apply, with justification in the manual. The pre-cleaning exception to 6.4.1 is limited to a), b). | Yes | |||||||||||||||||||||||
66 | 7.5.3 | The organization shall document requirements for medical device installation and acceptance criteria for verification of installation […] | Where installation applies, document requirements and acceptance criteria; retain installation/verification records for work by the organization or supplier. Provide documented requirements when another party installs under the customer agreement. Examples include installation instructions and commissioning records. N/A where installation is unnecessary, justified in the manual. | Yes | |||||||||||||||||||||||
67 | 7.5.4 | Records of servicing activities carried out by the organization or its supplier shall be maintained […] | Where servicing is a specified requirement, document procedures and necessary reference materials/measurements and retain service records. Review records for complaints and improvement inputs. Examples include service reports, diagnostics and post-repair tests. N/A requires servicing not to be a requirement for the activity/device, justified in the manual. | Yes | |||||||||||||||||||||||
68 | 7.5.5 | Sterilization records shall be traceable to each production batch of medical devices. | For each sterilization batch, retain process parameters and links to production batches. Example: load ID, cycle parameters, results and affected batch list. A supplier certificate without necessary traceability is insufficient. N/A requires no applicable sterilization for the activity/device, justified in the manual. | Yes | |||||||||||||||||||||||
69 | 7.5.6 | Validation shall demonstrate the ability of these processes to achieve planned results consistently. | Are processes validated where output cannot be or is not subsequently verified and defects become apparent only after use/service delivery? Procedures and validation records are required. Examples include welding, bonding and special processes. N/A requires justified absence of such processes in the manual. Actual non-verification matters as well as inability to verify. | Yes | |||||||||||||||||||||||
70 | 7.5.6 a)–g) | The organization shall document procedures for validation of processes […] | Does the procedure cover review/approval criteria, equipment/personnel qualification, methods, acceptance criteria, statistics/sample-size rationale where appropriate, records, revalidation and changes? Procedures, results, conclusions and actions are mandatory. Example: equipment/process qualification records. N/A requires justified absence of processes requiring validation. | Yes | |||||||||||||||||||||||
71 | 7.5.6 | […] procedures for the validation of the application of computer software used in production and service provision. | Is production/service software validated before first use and after changes where appropriate? Procedures and records must reflect risk and effects on product conformity. Example: software controlling an automated operation. N/A where no relevant software is used, justified in the manual. | Yes | |||||||||||||||||||||||
72 | 7.5.7 | The organization shall document procedures […] for the validation of processes for sterilization and sterile barrier systems. | Document procedures and retain validation results, conclusions and actions for sterilization and sterile-barrier systems before implementation and after product/process changes where appropriate. Examples include cycle and package-sealing validation. Outsourcing does not remove control responsibility. N/A requires no applicable processes/systems, justified in the manual. | Yes | |||||||||||||||||||||||
73 | 7.5.8 | The organization shall document procedures for product identification […] | A documented product-identification procedure is required throughout realization. Are identity and inspection status clear so only accepted or validly conceded product is used/dispatched/installed? Examples include labels, barcodes, system statuses and quarantine areas. Check devices, components and work in progress within scope. | Yes | — | ||||||||||||||||||||||
74 | 7.5.8 | […] the organization shall document a system to assign unique device identification to the medical device. | Where applicable regulations require UDI, a documented assignment system is mandatory. Examples include coding rules and identifier-data controls. N/A requires UDI not to be required for the relevant device/market/role, justified in the manual; a missing code alone is not justification. | Yes | |||||||||||||||||||||||
75 | 7.5.8 | […] medical devices returned to the organization are identified and distinguished from conforming product. | Is there a mandatory procedure identifying returned devices and distinguishing them from conforming product? Examples include return IDs, quarantine and shipment blocks. N/A only where returns are objectively outside applicable activities, justified in the manual. No returns during the period does not remove preparedness requirements. | Yes | |||||||||||||||||||||||
76 | 7.5.9.1 | The organization shall document procedures for traceability. | Documented traceability procedures must define the extent required by applicable regulations and the records retained. Example: linking batch numbers to materials, inspections and shipments. Test traceability in both directions; its extent depends on the device and organizational role. | Yes | — | ||||||||||||||||||||||
77 | 7.5.9.2 | […] records of components, materials, and conditions for the work environment used […] | For implantable devices, retain component, material and work-environment records where these could affect specified safety/performance. Example: linking an implant to material heat and processing conditions. N/A where implantable devices are outside applicable scope, justified in the manual. | Yes | |||||||||||||||||||||||
78 | 7.5.9.2 | Records of the name and address of the shipping package consignee shall be maintained […] | For implantable devices, retain consignee name/address and require distribution suppliers/distributors to maintain inspectable distribution records. Examples include shipment logs and contractual traceability requirements. N/A where no implantable devices are applicable, justified in the manual. | Yes | |||||||||||||||||||||||
79 | 7.5.10 | […] the organization shall report this to the customer and maintain records […] | Is customer property identified, verified, protected and safeguarded? Loss, damage or unsuitability requires customer notification and records. Examples include a device supplied for repair or tooling. If no event occurred, check actual protection. N/A where no customer property is involved, justified in the manual. | Yes | |||||||||||||||||||||||
80 | 7.5.11 | The organization shall document procedures for preserving the conformity of product to requirements […] | Document procedures preserving devices and components during processing, storage, handling and distribution. Do packaging/shipping containers protect against alteration, contamination and damage? Examples include storage rules, protective packaging, shelf-life controls and transport arrangements as applicable. | Yes | — | ||||||||||||||||||||||
81 | 7.5.11 | If special conditions are required, they shall be controlled and recorded […] | Where packaging alone is insufficient, document special conditions, control them and retain records. Example: transport temperature limits, logger data and excursion assessment. N/A requires justified absence of special conditions in the quality manual. | Yes | |||||||||||||||||||||||
82 | 7.6 | The organization shall document procedures to ensure that monitoring and measurement can be carried out and are carried out […] | Are required measurements and suitable equipment determined, with documented monitoring/measurement procedures? Documents are mandatory. Example: a measurement plan specifying range, accuracy, method and instrument. N/A only for justified absence of the relevant activity under clauses 1 and 4.2.2; outsourcing is not absence. | Yes | |||||||||||||||||||||||
83 | 7.6 a)–e) | Records of the results of calibration and verification shall be maintained […] | Where necessary for valid results, calibrate/verify equipment with reference-standard traceability, identify status and protect against invalid adjustment/damage. Procedures and calibration/verification/adjustment records are required; record the basis where no standards exist. N/A requires justified absence of relevant equipment/requirements in the manual. | Yes | |||||||||||||||||||||||
84 | 7.6 | […] the organization shall assess and record the validity of the previous measuring results […] | When equipment is nonconforming, is the validity of previous measurements assessed and recorded, with action on equipment and affected product? Event-specific assessment records are mandatory. Example: reassessing accepted batches after instrument drift. N/A only if relevant measurements are absent, not merely because no failures occurred. | Yes | |||||||||||||||||||||||
85 | 7.6 | […] procedures for the validation of the application of computer software used for the monitoring and measurement of requirements. | Document procedures and retain risk-based validation results, conclusions and actions for monitoring/measurement software before use and after changes where appropriate. Examples include test-rig software and calculation spreadsheets. N/A where no such software is used, justified in the manual. | Yes | |||||||||||||||||||||||
86 | 8.1 | […] determination of appropriate methods, including statistical techniques, and the extent of their use. | Are monitoring, measurement, analysis and improvement planned and implemented for product/QMS conformity and effectiveness? This clause names no separate document. Evidence includes methods in actual use and appropriate statistical techniques. Mandatory plans, procedures and records under 7.1 and 8.2–8.5 are checked separately. | No | — | ||||||||||||||||||||||
87 | 8.2.1 | The organization shall document procedures for the feedback process. | Document the feedback procedure and methods for obtaining/using information on meeting customer requirements. Does it cover production and post-production, including required regulatory experience? Examples include use data, servicing, returns and production deviations. A satisfaction survey alone is insufficient. | Yes | — | ||||||||||||||||||||||
88 | 8.2.1; 7.1; 8.4 | The information gathered in the feedback process shall serve as potential input into risk management […] | Does feedback feed risk management, realization and improvement? Analysis and risk-management records are required under 8.4 and 7.1. Example: a failure trend leads to reassessment and revised controls, or a documented conclusion that no change is needed. | Yes | — | ||||||||||||||||||||||
89 | 8.2.2 | The organization shall document procedures for timely complaint handling […] | Does the mandatory procedure cover receipt/recording, complaint classification, investigation, regulatory-reportability assessment, related product and corrections/corrective actions? Example: a workflow with owners and timelines. The procedure is needed even when no complaints have occurred. | Yes | — | ||||||||||||||||||||||
90 | 8.2.2 | If any complaint is not investigated, justification shall be documented. | Are complaint handling and actions recorded, with a documented justification whenever investigation is not performed? Exchange relevant information with implicated external parties. Example: a complaint file containing risk assessment, investigation, reporting decision and closure. If none occurred, check the functioning intake process. | Yes | — | ||||||||||||||||||||||
91 | 8.2.3 | Records of reporting to regulatory authorities shall be maintained […] | Where regulations require reporting of qualifying complaints/adverse events or advisory notices, procedures and reporting records are mandatory. Examples include reporting criteria, deadlines, submitted reports and acknowledgements. N/A only where the role/device has no such obligation, justified in the manual; no events is not justification. | Yes | |||||||||||||||||||||||
92 | 8.2.4 | The organization shall document a procedure to describe the responsibilities and requirements for planning and conducting audits and recording and reporting audit results. | A procedure, audit program and planning records are required. Are process status/importance and previous results considered, with criteria, scope, interval and methods recorded? Audits must assess conformity with ISO, QMS, planned arrangements and regulations, plus effective implementation and maintenance. | Yes | — | ||||||||||||||||||||||
93 | 8.2.4 | Auditors shall not audit their own work. | Does auditor selection ensure objectivity and impartiality, avoiding self-audit? Audit records must identify audited processes/areas and conclusions. Examples include an independent auditor assignment and a report with verifiable evidence. | Yes | — | ||||||||||||||||||||||
94 | 8.2.4 | Follow-up activities shall include the verification of the actions taken and the reporting of verification results. | Are audit corrections and corrective actions taken without undue delay, verified and reported? Audit/action records and verification results are required. Example: closing a finding after confirming the cause was addressed, not merely after receiving a promise to act. | Yes | — | ||||||||||||||||||||||
95 | 8.2.5; 4.1.3 e) | These methods shall demonstrate the ability of the processes to achieve planned results. | Do process-monitoring/measurement methods demonstrate achievement of planned results? Apply appropriate corrections/corrective actions when results are missed. Supporting records are required through 4.1.3 e). Example: complaint-processing delays are detected, analysed and addressed. | Yes | — | ||||||||||||||||||||||
96 | 8.2.6 | Evidence of conformity to the acceptance criteria shall be maintained. | Are product characteristics checked at appropriate stages under documented plans/procedures? Retain evidence of conformity to acceptance criteria. Example: an inspection record with limits, results and device/batch identification, rather than an unsupported acceptance mark. | Yes | — | ||||||||||||||||||||||
97 | 8.2.6 | The identity of the person authorizing release of product shall be recorded […] | Is release/service delivery withheld until planned arrangements are satisfactorily completed? Record the release authorizer and, where appropriate, the test equipment used. Example: release approval linked to inspection results and the identified calibrated/verified instrument. | Yes | — | ||||||||||||||||||||||
98 | 8.2.6 | For implantable medical devices, the organization shall record the identity of personnel performing any inspection or testing. | For implantable devices, identify all personnel performing inspection/testing in the records. Example: an individual login or identifiable signature for each inspection operation. N/A where implantable devices are outside applicable scope, justified in the manual. | Yes | |||||||||||||||||||||||
99 | 8.3.1 | […] product which does not conform to product requirements is identified and controlled […] | A procedure must define identification, documentation, segregation, evaluation and disposition of nonconforming product, including authorities/responsibilities. Is unintended use/delivery prevented? Examples include quarantine, system blocks and reject status. No detected defects does not remove the procedure requirement. | Yes | — | ||||||||||||||||||||||
100 | 8.3.1 | Records of the nature of the nonconformities and any subsequent action taken […] shall be maintained […] | Record the nonconformity, evaluation, any investigation, actions and decision rationale. Is the need for investigation and notification of a responsible external party assessed? Example: a batch-defect record with a supplier-return decision and evidence of implementation. | Yes | — |