ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
ISO 13485 nonconforming product control is the process that keeps defective or out-of-specification devices from being used or shipped by mistake, and that handles them properly if they already left your site. Clause 8.3 sets four sub-clauses, and sloppy records here lead directly to audit findings.
This guide covers identification, segregation, disposition, concessions, rework and advisory notices, with the records that prove control. It links to CAPA and traceability.
Free gap assessment
How much of ISO 13485 could you evidence today?
Score clauses 4 to 8, free, with the FDA QMSR and EU MDR duties kept separate so you can see what is the standard and what is the regulator.
Run the free ISO 13485 gap assessment → or View premium report sample
Clause 8.3.1 requires a documented procedure to ensure product that does not conform to requirements is identified and controlled to prevent unintended use or delivery.
The procedure must define controls and the related responsibilities and authorities for identification, documentation, segregation, evaluation and disposition. Evaluation includes deciding whether an investigation is needed and whether an external party responsible for the nonconformity must be notified.
Check the wording in the ISO 13485:2016 page on iso.org and mirror it in your procedure.
You must keep records of nonconformities and of subsequent action taken, including the evaluation, any investigation and the rationale for decisions.
A nonconformance report with a number, description, quantity, lot or serial, requirement not met, evaluation, disposition and approvals satisfies most of this.
Link the report to the production record and to any CAPA so the story is visible from either side.
Mark nonconforming product clearly with tags or labels and move it to a designated area, such as a red cage or quarantine location. Electronic systems should use a blocked status.
Control access to the area. Only authorized staff should release or move items.
Walk the floor during internal audits to check that tags, area and records match. Keep this in mind for every ISO 13485 nonconforming product.
Evaluation asks what is wrong, how much is affected, whether the issue could affect safety or performance and whether similar product may be affected elsewhere.
Define who may evaluate and decide. Higher-risk issues need quality or regulatory approval, not just a supervisor’s judgment.
Document the reasoning, and decide whether to open a CAPA based on severity and recurrence.
When a nonconformity is detected before delivery, you may eliminate it, prevent the product’s original intended use, or authorize use, release or acceptance under concession.
A concession is allowed only if justification is provided, approval is obtained and applicable regulatory requirements are met. Records of the concession and the identity of the authorizing person must be kept.
Use concessions sparingly. Frequent concessions are a sign that specifications or processes need fixing. This is where a ISO 13485 nonconforming product is won or lost.
Typical dispositions are scrap, rework, return to supplier, use as is under concession and regrade or use for non-clinical purposes such as training or testing.
Each option needs an authority level and a record. Scrap should be controlled so rejected units cannot reenter the supply chain.
If product is used for demonstration or testing, label it clearly as not for patient use.
When a nonconformity is detected after delivery or use has started, you must take action appropriate to the effects, or potential effects, of the nonconformity. Records of the actions must be kept.
You must also have documented procedures for issuing advisory notices in accordance with applicable regulatory requirements, and keep records of actions relating to them.
Traceability determines which customers and units are affected, so see ISO 13485 traceability before you need it. Auditors judge your ISO 13485 nonconforming product on exactly this point.
| Sub-clause | Requirement in short | Record |
|---|---|---|
| 8.3.1 General | Identify, document, segregate, evaluate, dispose | Nonconformance report |
| 8.3.2 Before delivery | Eliminate, prevent use or concession with approval | Disposition and concession record |
| 8.3.3 After delivery | Act on effects, issue advisory notices | Notice and action records |
| 8.3.4 Rework | Assess effect, same approval, reverify | Rework record and retest |
An advisory notice is information issued after delivery to advise on device use, modification, return or destruction. It can be part of a recall, depending on regulations.
Prepare templates, a communication list and a decision path. Decide who approves notices and how quickly they go out.
For reporting rules, see complaint handling and MDR serious incident reporting.
If you rework product, a documented procedure must take into account the potential adverse effect of rework on the product. Rework must be subject to the same approval and authorization as the original work.
After rework, verify that the product meets acceptance criteria and regulatory requirements. Records of rework must be kept.
If rework could change device characteristics, assess whether revalidation is needed. See process validation. Treat it as a standing rule for your ISO 13485 nonconforming product.
When a supplier caused the nonconformity, notify them as the clause requires and ask for investigation and corrective action. Record the request and reply.
Return product with clear documentation, and keep evidence of the credit or replacement. Repeated problems should trigger supplier re-evaluation.
The purchasing guide shows how supplier performance feeds approval.
Analyze nonconformities by type, process, supplier, shift and product family. Trends show where the system is weak.
Clause 8.4 requires data analysis, and nonconformance data is a core input. Present counts, costs and top causes in management review.
Use the management review to decide on resources for repeated problem areas.
Typical findings are unmarked nonconforming material, undocumented concessions, rework without approval and no link to CAPA. Another is releasing product before the disposition decision is recorded.
A further mistake is treating nonconformance as a production issue only. Quality and regulatory must see serious ones.
Good records show who decided what, when and why.
If your ERP or manufacturing system controls status, ensure that blocked product truly cannot ship. Test the block with a sample as part of validation.
See software validation for the approach. Many findings come from systems that allow override without a record.
Review user permissions for release and disposition functions.
The FDA Quality Management System Regulation, effective 2 February 2026, incorporates ISO 13485:2016, so clause 8.3 now underpins US nonconforming product expectations. See QMSR vs ISO 13485.
Under EU MDR, field safety corrective actions have formal reporting duties. Align your advisory notice process with them.
One procedure can cover both if it is clear about regional triggers.
A nonconformance report, disposition form, concession form, rework instruction and advisory notice template cover the clause. The ISO 13485 Toolkit includes procedures and forms for these records.
Pilot them on a recent real nonconformance to test the fields.
Use the gap analysis to see where your current practice falls short.
Auditors sample nonconformance records at every audit. The certification timeline shows when records must exist.
Have several closed examples, including at least one that led to CAPA.
Strong, tidy records here demonstrate that your system actually protects patients.
An inspector finds that five units from a lot of one hundred have a cracked housing. The units are tagged, moved to quarantine and a report is opened with lot number and defect description.
Quality evaluates the risk, extends the check to the remaining units and finds no more cracks. The five are scrapped, the supplier is notified and a CAPA is opened because it is the second case this quarter.
Every step is recorded, and the lot is released only after the record is complete.
Track nonconformance counts by source, time to disposition, number of concessions and percent linked to CAPA. Compare with production volume.
Rising concessions or aging items in quarantine show weak control. Review monthly and report to management.
Good measures turn ISO 13485 nonconforming product records from a compliance burden into a view of process health.
Define who can tag, who can evaluate and who can approve disposition. Operators tag, quality evaluates and approves, and regulatory joins when safety or reporting may be involved.
Record authority levels in the procedure, and keep an approved signatory list. An auditor will compare signatures on records against it.
Train all three groups and keep the records.
Track the cost of scrap, rework and investigation by cause. Numbers move leadership more than rules do.
Use the figures to justify improvements, such as better incoming inspection or a process change. Savings often exceed the cost of the fix within a year.
Include the data in your management review so decisions are based on evidence.
Only if justification is provided, approval obtained and applicable regulatory requirements are met, and the concession and authorizer are recorded.
No. Evaluate each, and open a CAPA based on risk and recurrence. Document the decision either way.
Yes. Clause 8.3.3 requires documented procedures for issuing advisory notices according to applicable regulatory requirements.
Rework requires a documented procedure and the same approval and authorization as the original work, followed by reverification.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026