ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
ISO 13485 process validation is the requirement to prove that a manufacturing or service process consistently produces conforming output when you cannot fully verify that output afterwards. Clause 7.5.6 sets the rule, and sterilization, sealing and welding are classic examples.
This guide explains when validation is required, how installation, operational and performance qualification work, how to justify sample sizes and when to revalidate. It connects with design transfer and software validation.
Free gap assessment
How much of ISO 13485 could you evidence today?
Score clauses 4 to 8, free, with the FDA QMSR and EU MDR duties kept separate so you can see what is the standard and what is the regulator.
Run the free ISO 13485 gap assessment → or View premium report sample
Clause 7.5.6 requires validation of any production and service processes where the output cannot be verified by subsequent monitoring or measurement, and deficiencies would become apparent only after the product is in use.
If you can inspect or test 100 percent of units without destroying them, verification may be enough. If testing is destructive or incomplete, validate the process.
The wording is in the standard, available through the ISO 13485:2016 page on iso.org. Use it to define your decision rule.
Common examples are sterilization, sterile barrier sealing, welding, adhesive bonding, molding of critical features, cleaning, passivation and some coating or assembly steps. Software that controls these processes also falls under validation.
Make a list of every process in your flow and decide, with a documented rationale, whether each is verified or validated.
Reviewers will check that the rationale is reasoned and that high-risk processes are not left unvalidated.
Clause 7.5.6 requires documented procedures for validation. They must cover criteria for review and approval of the processes, approval of equipment and qualification of personnel, use of specific methods and procedures, and acceptance criteria.
They must also cover statistical techniques with rationale for sample sizes where appropriate, records, revalidation criteria and approval of changes to the processes.
Write the procedure around those items, and your validation protocols will inherit a consistent structure. Keep this in mind for every ISO 13485 process validation.
A workable sequence is: define the process and its requirements, assess risk, write a validation plan, perform installation, operational and performance qualification, review results and approve.
Each step has a record. The plan is approved before execution, and the report is approved after, both by people with the right authority.
This sequence is not copied from the standard word for word, but it is the widely used pattern that satisfies it.
Installation qualification confirms that equipment is installed correctly and matches specifications. Records include equipment identification, utilities, calibration status and documentation checks.
For software controlled equipment, note version and configuration at installation. This feeds later change control.
Keep manuals and supplier documentation with the record, since auditors often ask for them. This is where a ISO 13485 process validation is won or lost.
Operational qualification shows that the process works across its defined operating range. You challenge the upper and lower limits of parameters to find where output stays within specification.
Use designed experiments or structured tests, and define acceptance criteria in advance. Record the parameter windows you will use in production.
The outcome is a validated operating range, not a single magic setting.
Performance qualification demonstrates that the process consistently produces conforming product under normal production conditions. It typically uses multiple consecutive runs or lots with real materials and trained operators.
Define the number of runs and the acceptance criteria in the plan. Many companies use three consecutive successful runs as a starting point, but the number must be justified by risk and variability.
Include inspection and test results for each run, along with any deviations and how they were resolved. Auditors judge your ISO 13485 process validation on exactly this point.
| Stage | Purpose | Typical evidence |
|---|---|---|
| IQ | Equipment installed correctly | Installation checklist, calibration |
| OQ | Process works across its range | Parameter challenge results |
| PQ | Consistent output in production conditions | Multiple run results, acceptance data |
| Sample size | Confidence matches risk | Statistical rationale |
| Revalidation | Process stays validated | Trigger criteria, change records |
The standard asks for statistical techniques with rationale for sample sizes where appropriate. Document why your sample size gives enough confidence for the risk of the failure mode.
Higher-risk failures need higher confidence and reliability levels. Many teams link confidence levels to the severity ratings in their risk file.
Explain the method plainly in the protocol, for example a confidence and reliability table or an operating characteristic curve.
Clause 7.5.7 requires documented procedures for validation of sterilization and sterile barrier systems. Validate them before implementation and after changes, and keep records.
Sterilization methods follow specific standards, and sterile barrier packaging has its own validation expectations including seal strength and integrity.
Involve specialists early. These validations take months and often depend on third-party laboratories. Treat it as a standing rule for your ISO 13485 process validation.
Define in advance what triggers revalidation: equipment relocation or major repair, changes in materials or suppliers, trends showing drift, process parameter changes and failures.
Some processes also need periodic revalidation, such as annual sterilization dose audits. Set intervals by risk.
Document change assessments even when you decide not to revalidate. The reasoning is the evidence.
The standard requires qualification of personnel who operate validated processes. Training records, competence assessments and supervised runs all count.
Link this to training and competence so records are consistent across the system.
Operators who perform a critical step, such as sealing, should be listed with their qualification date and refresh interval.
Process validation is the bridge between design and production. Design outputs define the specifications, and validation proves the process can meet them consistently.
Risk management should identify process-related hazards, and validation provides the evidence that controls work. Read about how risk files link to production in ISO 13485 risk management.
A strong ISO 13485 process validation file ties these together.
Typical mistakes are validating the wrong parameters, skipping operational qualification, using too few runs, ignoring supplier-provided processes and failing to define revalidation triggers.
Another is treating validation as a one-time project. Processes drift, equipment ages and materials change, so ongoing monitoring matters.
Outsourced processes are especially risky. Your supplier validates, but you remain responsible for confirming the evidence.
Clause 4.1.5 requires you to monitor and maintain control over outsourced processes. If a contractor performs a process that needs validation, review their protocol and report and keep a copy.
Include validation expectations in the supplier agreement. See the ISO 13485 purchasing guide for supplier controls.
Audit critical suppliers on site when risk justifies it.
The FDA Quality Management System Regulation, effective 2 February 2026, incorporates ISO 13485:2016, so clause 7.5.6 sits at the center of US expectations. See QMSR vs ISO 13485 for the comparison.
Notified bodies under EU MDR also review validation evidence during audits and technical documentation review.
Keep validation reports in your medical device file references.
A validation master plan, protocol and report template, equipment qualification forms and a revalidation log cover most needs. The ISO 13485 Toolkit includes templates you can adapt to your processes.
Start with the highest-risk process in your flow, then work down the list.
Use the gap analysis to see where validation evidence is missing.
A company seals pouches that hold a sterile device. Seal quality cannot be fully tested without destroying the pouch, so sealing is validated.
Installation qualification checks the sealer and its calibration. Operational qualification tests temperature, pressure and dwell time limits. Performance qualification runs three lots at the chosen settings with seal strength and integrity tests.
The report sets the validated window and the monitoring plan, and any later change to pouch material triggers a documented revalidation decision.
Validation is a snapshot. After release, monitor key parameters and output data to confirm the process stays in control, using trend charts or simple control limits.
Set alert limits inside the validated window, so you act before output goes out of specification. Record excursions and the actions taken.
Review the data as an input to management review and to CAPA when trends move.
Keep validation records in one indexed set per process: plan, protocols, raw data, report, approval, change history and revalidation record.
Auditors usually pick a process and ask to see the whole chain. If every record is cross-referenced, the answer takes minutes instead of hours.
Concise reports with clear conclusions beat long ones. State what was validated, the operating window, the acceptance criteria and the result.
When process output cannot be verified by subsequent monitoring or measurement and deficiencies would appear only after use, under clause 7.5.6.
The standard does not name them, but they are the common method to meet its requirements. You can use another structure if you justify it.
There is no fixed number. Many companies use three consecutive runs as a start, but the number must be justified by risk and process variability.
Only when your criteria say so. Assess each change and document the decision either way.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026