ISO 13485 Clause 6: Resource Management

ISO 13485:2016 Clause 6 (Resource Management) requires medical device manufacturers to provide and control the human resources, infrastructure, and work environment needed to consistently produce safe, compliant devices. Unlike the equivalent clause in ISO 9001, it puts specific weight on demonstrable personnel competence tied to the effect on product quality, and on infrastructure controls — particularly contamination control and environmental monitoring — that reflect the direct risk medical devices pose to patients. Getting Clause 6 wrong doesn't just create a paperwork gap; it creates a traceable line from an undertrained operator or an uncontrolled cleanroom straight to a nonconforming device.

What Clause 6 covers, at a structural level

Clause 6 sits between the management responsibility requirements of Clause 5 and the product realization requirements of Clause 7 — its role is to make sure the organization has the people, physical space, equipment, and environmental conditions in place before it tries to design, manufacture, or service a device. The clause is generally organized around three areas: the provision of resources in general, human resources (competence, training, and awareness), and infrastructure and work environment, with infrastructure further addressing contamination control where it's relevant to the product.

The thread running through all three areas is traceability back to product quality. ISO 13485 doesn't ask an organization to have a training program or a clean facility as a box-ticking exercise — it asks the organization to show that the resources in place are the ones needed to meet the specific requirements of the devices it makes, and to keep records proving that link.

Human resources: competence has to be evidenced, not assumed

The human resources requirements of Clause 6 go beyond having job descriptions and a training calendar. Personnel performing work that affects product quality — which in a medical device organization can mean design engineers, production operators, inspectors, and personnel in complaint handling or regulatory affairs — need to be competent on the basis of appropriate education, training, skills, and experience for their specific role.

Three elements auditors expect to see working together:

• Defined competence requirements per role. Not a generic "must have relevant experience" statement, but requirements tied to what that role actually does and how it affects the device — for example, a specific gowning or aseptic technique qualification for cleanroom operators, or documented familiarity with applicable regulatory requirements for someone releasing product.
• Evidence that training was effective, not just delivered. Attendance at a training session is not the same as demonstrated competence. ISO 13485 expects organizations to evaluate whether training achieved its intended effect — through practical assessment, supervised sign-off, or a comparable method appropriate to the task.
• Awareness of the relevance and importance of the individual's activities. Personnel need to understand how their specific task contributes to product safety and regulatory compliance and what the consequences of deviation are — this is distinct from technical competence and is often the weaker of the two in practice.

Because medical devices carry direct patient risk, this evidence trail matters more here than in a generic ISO 9001 context: an auditor tracing a nonconformity back to a production step will routinely ask to see the training record of the operator who performed it, alongside the record of the work itself.

Infrastructure: further than a generic ISO 9001 facility requirement

ISO 9001's infrastructure clause asks for buildings, equipment, and supporting services adequate to achieve conformity of products and services — a broad, sector-agnostic requirement. ISO 13485 keeps that baseline but adds a layer specific to medical devices: infrastructure has to be controlled to the degree needed to prevent product mix-ups and to assure orderly handling of materials, and — where it matters for the specific device — it has to control contamination of product or the work environment.

This is the point where the two standards diverge most clearly. For a device where contamination could compromise safety or performance — implantables, products supplied sterile, in-vitro diagnostics reagents, and similar categories — Clause 6 pushes the organization toward:

• Defined and controlled environmental conditions appropriate to the product, which can include particulate control, temperature and humidity ranges, air pressure differentials between zones, and microbial or bioburden limits, depending on what the device and its risk profile require.
• Health, cleanliness, and clothing requirements for personnel working in areas where contamination risk exists — gowning procedures, hygiene standards, and, where relevant, restrictions on personal items or cosmetics in controlled areas.
• Control of contamination arising from the work environment itself, not only from personnel — for example, control of particulates generated by equipment, or segregation between processes that could cross-contaminate.
• Documented environmental monitoring appropriate to the device, with records that demonstrate the environment was within defined limits at the time of manufacture, not only at the time the facility was qualified.

The key practical distinction from a generic ISO 9001 infrastructure section: it's not enough to describe the facility and its equipment. The organization has to define what level of contamination control the specific product requires, document why that level was chosen, control it operationally, and keep evidence that the controls were actually maintained during production — not just designed on paper.

Practical implications for staffing and facility setup

For organizations building or maturing a Clause 6 program, a few practical consequences follow directly from the requirements above.

On staffing: competence requirements need to be written before hiring or role changes happen, not reverse-engineered after an audit finding. Training records need to be structured so that a specific individual's qualification for a specific task can be retrieved quickly and matched against the production or design record they touched — this is one of the most common things an auditor will trace during a nonconformity investigation. Refresher training and periodic reassessment of competence, especially for roles tied to contamination control or critical inspection steps, should be planned rather than triggered only by a deviation.

On facility setup: the level of environmental control needs to be justified by the product's risk profile and documented as a deliberate decision, not assumed from industry norms. Environmental monitoring needs a defined frequency, defined acceptance limits, and a documented process for what happens when a reading is out of limits — including whether and how affected product is assessed. Facility layout should visibly support the mix-up and cross-contamination prevention the standard calls for, with segregation and flow that a new auditor can follow without a lengthy explanation.

In both areas, the common failure mode is the same: the control exists, but the evidence that it was followed consistently, on the day production happened, is incomplete or hard to retrieve. This is exactly the gap tools like IgeraIndustria are built to close — by letting quality and production teams ask a direct question about a training requirement, a monitoring limit, or a gowning procedure and get an answer sourced from the company's own current QMS documents, with the exact document and clause cited, rather than relying on someone's memory of where a procedure lives or which revision is current.

Common audit findings related to Clause 6

Certification body auditors and notified bodies see a recurring pattern of findings in this area. None of these are unique to any one industry sub-sector, and most stem from the same root cause: a control exists on paper but the evidence trail for it is weak.

• Training records that show attendance but not effectiveness. A signed sign-in sheet with no assessment of whether the training worked is one of the most frequently cited gaps.
• Competence requirements not defined for a specific role, or defined so generically that they can't be checked against an individual's actual qualifications.
• Environmental monitoring data that exists but isn't reviewed or trended, so an out-of-limit event doesn't trigger a documented assessment of affected product.
• Gowning or hygiene procedures that aren't consistently followed or verified, particularly in facilities where controlled-area discipline slips during high-production periods.
• No documented rationale for the chosen level of contamination control, leaving the auditor unable to confirm the facility's controls actually match the product's risk profile.
• Infrastructure changes — new equipment, a re-laid-out area, a new supplier for cleanroom consumables — introduced without re-evaluating the impact on contamination control or mix-up prevention.

Frequently asked questions

Does Clause 6 apply to every medical device manufacturer in the same way?

The general requirements apply to all organizations certified to ISO 13485, but the specific level of infrastructure and contamination control expected is proportionate to the device and its associated risk. A manufacturer of sterile implantables will need a materially more rigorous environmental control program than one producing a non-sterile, low-risk accessory — the standard expects the organization to determine and justify what's appropriate for its own products.

What's the difference between training and competence under Clause 6?

Training is an input — a course, a session, a demonstration. Competence is the outcome: evidence that the person can actually perform the task to the required standard. ISO 13485 focuses on the outcome, which is why auditors look for evaluation of training effectiveness rather than attendance records alone.

Do all facilities need a cleanroom to meet Clause 6?

No. Clause 6 requires contamination control appropriate to the specific product. Many devices don't require cleanroom-grade environments at all. The requirement is to assess what your product needs and control the environment accordingly — not to apply a uniform standard regardless of risk.

How does Clause 6 differ from the equivalent clause in ISO 9001?

ISO 9001's infrastructure requirement is general-purpose: buildings, equipment, and supporting services adequate for the organization's products and services. ISO 13485 keeps that scope but adds explicit requirements around preventing product mix-ups and controlling contamination of product or the work environment where relevant to the device — requirements that don't have a direct equivalent in the generic standard.

Who is responsible for defining competence requirements — HR or quality?

Practice varies by organization, but the requirements themselves need to originate from an understanding of how a role affects product quality and regulatory compliance, which typically means quality and the relevant functional manager define the requirement together, with HR administering the process. An auditor will expect to see that link to product impact regardless of which department owns the paperwork.

What happens if an environmental monitoring reading is out of limits?

ISO 13485 doesn't prescribe a single fixed response, but it does expect the organization to have a documented process for what happens next — assessing whether product manufactured during the excursion was affected, recording the investigation, and taking corrective action where needed. An organization that has monitoring data but no defined response process is a common audit gap.

Can an AI tool help with Clause 6 compliance?

An AI assistant doesn't replace the underlying competence and infrastructure program, but it can make the evidence behind it faster to retrieve — for example, surfacing the current training requirement for a specific role, or the documented environmental monitoring limit for a specific area, sourced directly from a company's own QMS documents with the exact reference cited. That's the specific gap IgeraIndustria is designed to close.