ISO 13485 Process Validation: The Mandatory Clauses You Must Meet

The Obligation Behind ISO 13485 Process Validation

If your organisation places a medical device on the US, GB, AU, or CA market, ISO 13485:2016 clause 7.5.6 places a direct obligation on you to validate any production or service provision process whose output cannot be fully verified by later inspection or testing. The requirement is not optional, and it binds the entire quality management system, not just the production floor.

You must demonstrate, with objective evidence, that these processes achieve the planned results on a repeatable basis. The standard does not define which processes are in scope; you make that determination through risk assessment, but the burden of proof sits with you. During a notified body or FDA audit, expect the auditor to challenge both your selection and your validation evidence.

What the Standard Actually Requires

Clause 7.5.6 is the core mandate, but it works with two other clauses to form a complete validation framework. Clause 7.1 (planning of product realisation) requires you to define validation as part of your overall process planning. Clause 4.1 (general QMS requirements) requires you to control outsourced processes, which often includes validation of those processes as well.

There is no numeric threshold in the standard that says “validate if the failure rate exceeds X%.” Instead, the trigger is functional: if verification after the process cannot detect a defect that would affect safety or performance, then validation is mandatory. Common examples include sterilisation, sealing, welding, injection moulding, and certain software used in production. If you are unsure whether a process is in scope, err on the side of validation; the audit cost of a missing validation far outweighs the effort of doing it.

The Mandatory Elements of a Validation Protocol

To comply, your validation approach must include each of the elements listed in clause 7.5.6. These are not recommendations; they are requirements. Your validation protocol or plan must document:

1. Defined criteria for review and approval of the process – specify the exact parameters (temperature, pressure, time, speed) and the acceptance limits for the output.
2. Approval of equipment and qualification of personnel – show that the equipment is suitable and that operators have the required training and competence.
3. Use of specific procedures and methods – reference the work instructions, standard operating procedures, and test methods used during validation.
4. Defined parameters and tolerances – state the operating ranges and the allowable deviations for each critical parameter.
5. Defined acceptance criteria – quantify what constitutes a passing result, e.g., a seal strength of at least 15 N/cm, or a bioburden reduction of at least 6 log units.
6. Defined monitoring and measurement methods – specify how you will measure the process output during routine production.
7. Records of validation results – keep raw data, calculations, and signed approvals.
8. Re-validation criteria – state the conditions that trigger a new validation, such as a change in material supplier, equipment relocation, or a major process change.

In practice, most organisations capture these in a validation protocol and a validation report. The protocol defines what you will do and the acceptance limits; the report records what you did, the results, and the approval decision. Both documents must be controlled under clause 4.2.5 (document control) and retained under clause 4.2.5 (records control).

Validation versus Verification: The Practical Distinction

Auditors frequently see organisations confuse validation with verification. Verification asks “did we make the product correctly?” It is a post-production check. Validation asks “is the process capable of consistently making a product that meets specifications?” It is a pre-production or periodic proof.

For example, if you test every sterilised device for sterility, that is verification. But sterility testing is destructive and cannot be performed on every unit, so sterilisation is always a validated process. The same logic applies to adhesive bonding, where destructive pull tests can only sample a few units; the process itself must be validated to prove the bonding is consistent.

Clause 7.5.6 requires validation, not just initial verification. You must prove the process is capable of producing a conforming output over time, under the specified operating ranges. That means you need to run multiple batches, include worst-case conditions, and demonstrate statistical stability where appropriate.

What Evidence Must Be Available at Audit

When an auditor reviews your ISO 13485 process validation approach, they will look for a clear, documented trail. The following items must be present and current:

• A validation master plan or list that identifies all processes requiring validation, with justification for each inclusion or exclusion.
• For each process, a signed validation protocol that includes the eight elements above.
• Objective evidence of execution: raw data logs, equipment printouts, operator signatures, and calibration certificates for any measurement instruments used.
• A validation report that summarises the results, compares them against the acceptance criteria, and states the final approval decision.
• Records of any re-validation performed, including the trigger event and the outcome.
• Training records for all personnel involved in the validation, linked to the specific procedures they used.
• A link to your risk management file (ISO 14971) showing how the validation scope and acceptance criteria were derived from risk analysis.

Auditors in the US often reference the FDA’s guidance on process validation, which aligns closely with ISO 13485 but adds a three-stage approach: process design, process qualification, and continued process verification. In GB, AU, and CA, the regulatory bodies (MHRA, TGA, Health Canada) all expect to see the same level of rigour, even if they do not prescribe a specific format. Your documentation should be clear enough that a competent third party could repeat the validation without asking you questions.

Re-validation and Ongoing Control: Not a One-Time Event

Validation is not a single project you complete and forget. Clause 7.5.6 explicitly requires you to define the criteria for re-validation. At a minimum, you must re-validate when there is a change that could affect the process output. That includes:

• Change in raw material supplier or material grade
• Change in equipment, tooling, or software
• Relocation of the process to a different facility
• Significant change in process parameters or environmental conditions
• Any deviation or complaint trend that suggests the process has drifted

You also need to monitor the process during routine production. Clause 8.2.4 (monitoring and measurement of product) requires you to collect data on the validated parameters and to react when they drift outside the approved ranges. Many organisations use statistical process control (SPC) charts for this purpose, but the standard does not mandate a specific method. What matters is that you have a defined, documented system for detecting drift and a procedure for deciding when a drift triggers re-validation versus simple adjustment.

The Takeaway

Your ISO 13485 process validation approach is not a paperwork exercise; it is a regulatory requirement with clear, mandatory clauses. Clause 7.5.6 gives you the eight elements, but the real work is in selecting the right processes, setting defensible acceptance criteria, and generating evidence that will survive an auditor’s scrutiny. Build your validation files so that they tell a complete story from risk assessment through final approval, and keep them current through re-validation. That is what compliance looks like in practice, and it is what will carry you through your next medical device audit.