ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
ISO 13485 traceability is the ability to follow a medical device from its components and materials through production to the customer, and back again. Clause 7.5.9 requires a documented procedure, and it decides whether a recall takes hours or weeks.
This guide explains identification under clause 7.5.8, the extent of traceability you must define, the extra rules for implantable devices and how to test recall readiness. It links to unique device identification and the complaint process.
Free gap assessment
How much of ISO 13485 could you evidence today?
Score clauses 4 to 8, free, with the FDA QMSR and EU MDR duties kept separate so you can see what is the standard and what is the regulator.
Run the free ISO 13485 gap assessment → or View premium report sample
Clause 7.5.8 requires procedures to identify product throughout product realization, and to identify product status with respect to monitoring and measurement requirements. Only product that has passed required checks may be released.
If regulations require unique device identification, your system must support it. Identification is the foundation, because you cannot trace what you cannot identify.
Check the exact wording in the ISO 13485:2016 page on iso.org and map it to your labels and travelers.
Clause 7.5.9.1 requires documented procedures for traceability. The procedure must define the extent of traceability according to applicable regulatory requirements and the records to be maintained.
You decide the level of detail, such as lot, batch or serial, based on risk and regulations. The decision must be documented and consistent.
Regulators and notified bodies often expect more detail for higher-risk devices.
Lot traceability groups units made under the same conditions, and serial traceability tracks each unit. Serial tracking costs more but allows precise field actions.
Use risk to choose. Devices that are implanted, life-supporting or complex typically need serial tracking, while simple disposables often use lots.
State the choice per device family in the medical device file so auditors see the logic. Keep this in mind for every ISO 13485 traceability.
A complete chain links incoming components and materials to their supplier lots, to work orders and process records, to finished device lots or serials, and to distribution records.
Test the chain with a real example. Pick a finished unit and trace backward to every critical component, then pick a component lot and trace forward to every shipped customer.
If either direction takes more than a few hours, the system has a gap.
Record supplier name, part number, lot and receiving date for critical components and materials. Link each to the production record where it was used.
For raw materials with shelf life or special handling, record expiry dates and storage conditions. Mixed or reworked lots must be documented clearly.
Receiving inspection and purchasing controls are where this data enters your system. This is where a ISO 13485 traceability is won or lost.
The device history record, or equivalent, should show what was built, when, by which process, with which equipment and test results. It ties components to the finished unit.
Include approvals, deviations and rework. Records must be accurate and legible, whether paper or electronic.
If your production software holds the records, validate it as part of software validation.
| Link in the chain | Record | Clause |
|---|---|---|
| Product identification | Labels, travelers, status | 7.5.8 |
| Component lots | Supplier lot, receiving date | 7.5.9.1 |
| Production | Device history record | 7.5.9.1 |
| Distribution | Consignee name and address | 7.5.9.2 |
| Implantable extras | Materials, work environment records | 7.5.9.2 |
| Recall test | Mock recall report | 8.3.3 |
Clause 7.5.9.2 requires, for implantable devices, that service providers or distributors keep distribution records and make them available for inspection. Records of the consignee name and address must be maintained.
In practice every manufacturer benefits from knowing who received what. Without it, a field action cannot reach customers.
Include distributors and importers in your agreements, requiring them to record onward shipments. Auditors judge your ISO 13485 traceability on exactly this point.
For active implantable and implantable devices, traceability records must include components, materials and work environment conditions where these could cause the device not to meet its safety and performance requirements.
That means more records, such as cleanroom monitoring data and special process parameters, tied to each lot or serial.
Check the specific local regulations as well, since many countries add device tracking and implant card rules.
Unique device identification systems in the US and EU require labels to carry device and production identifiers, and manufacturers to submit data to a database. These identifiers are a public face of your traceability.
Read the unique device identification guide for requirements, then align your internal numbering with UDI production identifiers.
A single, consistent lot or serial system avoids duplicate entry and reduces errors. Treat it as a standing rule for your ISO 13485 traceability.
Run a mock recall at least annually. Choose a device lot, trace it to all customers and time how long it takes to assemble the full list and draft notices.
Record the exercise, the time taken and any gaps found, then raise corrective actions. Auditors value this evidence highly.
Link the exercise to advisory notice procedures, because clause 8.3.3 requires them for product found nonconforming after delivery.
When a complaint points to a lot problem, traceability tells you the scope of the issue. Without it, you must assume the worst and act broadly.
Use traceability data in CAPA investigations to find common components, operators or shifts.
Strong records reduce both risk and cost during field actions.
Typical mistakes are inconsistent lot numbering, missing component lots, paper records that cannot be searched, no distributor records and no test of the recall process.
Another is assuming that an ERP system provides traceability without checking its configuration. Data fields must be completed and reviewed.
Spot checks during internal audits catch most of these.
Both are acceptable if records are legible, retrievable and controlled. Electronic systems offer search and linkage that paper cannot match.
If you move to electronic records, validate the system and define backup and access rules.
Retention applies equally. Records must be kept at least for the lifetime of the device as you define it, and not less than two years from release, unless regulation says otherwise.
The FDA Quality Management System Regulation, effective 2 February 2026, incorporates ISO 13485:2016, so clause 7.5.9 is the working traceability requirement for US manufacturers. See QMSR vs ISO 13485.
Under EU MDR, economic operators must also be able to identify their suppliers and customers. See the GSPR checklist for related obligations.
Align one system to meet both.
A traceability procedure, device history record template, distribution log and mock recall form are the core documents. The ISO 13485 Toolkit includes templates for these records.
Start with the highest-risk device, test the chain, and then extend to other families.
Use the gap analysis to see where records are missing.
Measure the time to complete a mock trace, the percentage of lots with complete component records and the share of shipments with consignee details recorded.
Set targets, and review results in management review. Aim for hours, not days, for any trace.
Improvement here is rarely expensive, and the payoff comes at the worst possible moment, during a real field action.
A supplier notifies you that a polymer lot was out of specification. Your system lists the finished lots built with that polymer and the customers who received them.
You quarantine stock, notify the affected consignees and open a CAPA. The records show exactly which units are affected, so the action is narrow and fast.
That outcome depends on records created weeks earlier by routine, boring discipline.
Reworked units need clear identification so they are not confused with first-pass product. Record the rework instruction, who performed it and the retest results against the original record.
Returned goods that re-enter stock need the same discipline. Assess them, document the decision and keep the link to the original lot.
Control of nonconforming product under clause 8.3 expects these records, and traceability makes them auditable.
Traceability depends on operators, receiving staff and shipping clerks entering data correctly every time. Short, specific instructions beat long manuals.
Show each role which fields matter and what happens downstream if they are wrong. People follow rules they understand.
Keep training records and refresh them when procedures or systems change.
Ask critical suppliers to keep lot records and to notify you of any material changes or nonconformities in a defined time. Put this in the quality agreement.
Without supplier records, your own chain stops at the receiving dock. The control must reach as far back as risk demands.
Review the agreement whenever the supplier, process or material changes.
Not for every device. You define the extent of traceability by regulations and risk, but implantable devices have extra record requirements.
For implantable devices, the standard requires distributors or service providers to keep distribution records. Many manufacturers require it for all devices.
At least the lifetime of the device as you define it, and not less than two years from release, unless regulations require longer.
The standard does not set a frequency. Many companies run a mock recall annually.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026