ISO 13485 Clause 7: Product Realization and Design Controls

ISO 13485:2016 Clause 7, "Product Realization," is the operational core of a medical device quality management system. It sets requirements for planning, design and development, purchasing, production and service provision, and control of monitoring and measuring equipment. Its design and development controls are markedly more prescriptive than the equivalent clause in generic ISO 9001, because a design error in a medical device can directly harm a patient, and regulators expect documented proof — not just intent — that every design decision was verified and validated before the product reached the market.

What Clause 7 Covers

Clause 7 of ISO 13485:2016 is organized into several sub-clauses that together describe how a medical device moves from concept to finished, deliverable product:

• 7.1 Planning of product realization — determining quality objectives, required processes, documentation, verification/validation activities, and acceptance criteria for a given product or product family before work begins.
• 7.2 Customer-related processes — determining and reviewing product requirements, including regulatory requirements in the country of sale, and maintaining communication with customers.
• 7.3 Design and development — the detailed, staged control process covering planning, inputs, outputs, review, verification, validation, transfer, and change control (7.3.1–7.3.10 in the standard's structure).
• 7.4 Purchasing — evaluating and selecting suppliers based on their ability to supply product that meets requirements, with the depth of supplier control tied to the risk associated with the purchased product.
• 7.5 Production and service provision — controlling production processes, including cleanliness, installation activities, servicing, and specific requirements for sterile devices and process validation where results cannot be fully verified by subsequent monitoring.
• 7.6 Control of monitoring and measuring equipment — ensuring that equipment used to demonstrate conformity is calibrated, verified, and safeguarded against adjustments that would invalidate results.

Why Design Controls Are So Much More Rigorous Than ISO 9001

ISO 9001's design clause (8.3 in the 2015 revision) asks organizations to plan and control design and development in a way appropriate to the organization's context — it leaves considerable latitude in how formal that control needs to be. ISO 13485's Clause 7.3 does not leave the same room for interpretation. It lays out a structured sequence of distinct, individually documented activities:

• Design and development planning, updated as the design evolves, defining stages, responsibilities, and the interfaces between different groups involved.
• Design inputs — functional, performance, usability, and safety requirements, together with applicable regulatory and risk management requirements — that must be reviewed for adequacy and be unambiguous, complete, and not in conflict with each other.
• Design outputs that are expressed in terms allowing verification against the inputs, contain or reference acceptance criteria, and specify characteristics essential for the safe and proper use of the device.
• Design review at planned, suitable stages, involving the functions concerned with the design stage being reviewed, with records of the review, the participants, and any actions.
• Design verification — confirming, through objective evidence, that outputs have met input requirements.
• Design validation — confirming that the resulting device is capable of meeting requirements for its specified application or intended use, typically under actual or simulated use conditions and on representative product.
• Design transfer — a requirement essentially unique to ISO 13485 among quality standards, ensuring design outputs are verified as suitable for manufacturing before becoming final production specifications.
• Control of design and development changes, each of which must be identified, reviewed, verified, validated as appropriate, and approved before implementation, with evaluation of the change's effect on the device and its already-delivered products.

This granularity exists because the consequence of a design flaw differs fundamentally between a generic manufactured product and a medical device. A stage-gated, evidence-based process is what allows a manufacturer to demonstrate — to a notified body, an FDA inspector, or in the event of a post-market issue — exactly which requirement each design decision traces back to, and exactly how that decision was confirmed correct before the device reached a patient. Design history and traceability are not optional paperwork; they are the mechanism by which the standard operationalizes patient safety.

Purchasing and Supplier Controls

Clause 7.4 requires organizations to evaluate and select suppliers based on their ability to supply product in accordance with requirements, and to define the type and extent of control applied to a supplier and to purchased product proportionate to the risk of that product to device safety and performance. Purchasing information must clearly describe the product to be purchased, and organizations must establish criteria for the acceptance of purchased product before that product is used or incorporated into the device. Records of supplier evaluations and the actions arising from them must be maintained.

Production and Service Provision Controls

Clause 7.5 governs the conditions under which manufacturing and servicing take place: the availability of work instructions, use of suitable equipment, availability of monitoring and measuring equipment, implementation of defined operations for labelling and packaging, and product release, delivery, and post-delivery activities. Where a production or service process cannot be fully verified by subsequent monitoring or measurement — as is often the case with sterilization or certain manufacturing processes — that process must be validated, with defined criteria for review and approval, equipment qualification, and personnel qualification. Devices requiring sterility carry additional, specific requirements for validation of sterilization processes and sterile barrier systems.

Control of Monitoring and Measuring Equipment

Clause 7.6 requires that equipment used to provide evidence of product conformity be calibrated or verified at specified intervals, adjusted as necessary, identified to show calibration status, safeguarded against adjustments that would invalidate results, and protected from damage during handling and storage. Records of calibration and verification must be retained, and when equipment is found out of calibration, the organization must assess and document the validity of previous measurement results.

Common Audit Findings Under Clause 7

Because Clause 7 is the broadest clause in the standard, it also tends to generate the highest concentration of nonconformities during certification and surveillance audits. Findings organizations frequently report or encounter include:

The Practical Impact: Why Documentation Depth Matters

Most Clause 7 findings are not failures of engineering — they are failures of traceability. A design decision may well have been sound, a supplier may well have been reliable, a process may well have performed consistently — but if the organization cannot produce the record showing that the decision was reviewed, the input was verified, or the equipment was calibrated at the time it mattered, the finding stands regardless of the underlying quality of the work. Clause 7's demands are, in that sense, as much about retrievability as about rigor: an auditor, or an internal team investigating a field issue years later, needs to be able to reconstruct exactly what was decided, why, and on what evidence.

This is where the volume of documentation a QMS accumulates under Clause 7 becomes a genuine operational burden — design history files, verification and validation reports, supplier files, calibration records, and process validation packages, often spanning years and multiple product changes. Teams preparing for an audit, or an engineer trying to confirm which version of a design input a given verification report was tested against, can lose significant time simply locating the right document and the right section within it. This is precisely the kind of retrieval problem IgeraIndustria is built to solve: it lets quality and engineering teams ask a direct question about their own QMS documentation — a design history file, a supplier evaluation record, a validation protocol — and receive an answer that cites the exact source document and section, rather than requiring a manual search through binders or a document management system.

Frequently Asked Questions