ISO 13485 product realisation

ISO 13485:2016 clause 7, apart from design in 7.3, covers making the device. You plan realisation with documented risk management (7.1), agree requirements with customers and regulators (7.2), control suppliers in proportion to risk (7.4), control production with validated processes and traceability (7.5), and calibrate the equipment you measure with (7.6).

The requirement in plain English

Planning (ISO 13485:2016 7.1). You plan the processes that turn a design into a delivered device and document how risk management runs through them, keeping its records. A note in the clause points to ISO 14971 for the method. The plan sets the product’s requirements and quality objectives, the processes, documents and resources it needs, and the checks, handling, storage, distribution and traceability with their acceptance criteria.

Customer-related processes (ISO 13485:2016 7.2). You identify requirements: what the customer asks for, what the intended use needs even if unstated, the regulations, and any training users need for safe use (7.2.1). You review them before committing to supply, and keep the review (7.2.2). You set up communication with customers on product information, orders, feedback and advisory notices, and with regulators as the regulations require (7.2.3).

Purchasing (ISO 13485:2016 7.4). A documented procedure sets criteria for choosing and re-evaluating suppliers, based on their ability, their performance and the effect of what they supply on your device, in proportion to risk (7.4.1). Purchasing information states what you need and, where it applies, a written agreement that the supplier tells you before changing what it supplies (7.4.2). You verify what arrives to a depth set by the supplier’s evaluation and the risk (7.4.3).

Production and service provision (ISO 13485:2016 7.5). Production follows documented procedures with qualified equipment and monitored parameters, and a record for each device or batch shows the quantity made and approved for distribution and gives traceability (7.5.1). Cleanliness, installation, servicing and sterile device requirements apply where relevant, building on the work environment and contamination controls of clause 6. Processes whose output cannot be fully verified afterwards are validated, and so is software used in production, in proportion to risk (7.5.6). Sterilisation and sterile barrier processes are validated before use (7.5.7). Product is identified with its status, and with a unique device identifier where regulations require (7.5.8). Traceability is defined by documented procedures (7.5.9), with extra records for implantable devices (7.5.9.2). Customer property is protected, and product is preserved through storage, handling and distribution.

Monitoring and measuring equipment (ISO 13485:2016 7.6). You decide what to measure and with what. Equipment is calibrated or verified at set intervals against traceable standards, identified, and protected from adjustment and damage. When a gauge is found out of tolerance, you assess the results it produced since its last good check. Software used for measurement is validated.

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 35-person company assembles a sterile Class IIa wound drain kit and outsources ethylene oxide sterilisation. Its realisation plan for each product names the processes, acceptance criteria and records, and points to the product’s risk management file, which is reopened when production data shows a new failure mode.

Suppliers are tiered. The steriliser and the tubing moulder are critical: each was audited on site, has a quality agreement with a change notification clause, and is re-evaluated every year on delivery, quality and audit results. A stationery supplier is listed and nothing more.

The pouch sealer was validated through installation, operational and performance qualification, because seal strength can only be tested destructively. Revalidation is triggered by a new pouch material, a sealer repair or a change of operating range. The label-printing software was validated before first use.

Every lot has a batch record: materials and their lots, process parameters, quantities, the sterilisation cycle record, the unique device identifier and a release signature. A calibration register lists every gauge with its due date and traceable certificate. When a torque gauge failed calibration, the team checked the lots it had passed since its last good check, and recorded the outcome.

Evidence an auditor expects

Realisation plans and risk management records (required): risk management documented and kept current through production.
Requirement reviews (required): contracts and orders reviewed before acceptance, including regulatory and training needs.
Supplier criteria, evaluations and monitoring (required): proportionate to risk, with re-evaluation and written change notification where needed.
Incoming verification records (required): extent justified by supplier status and risk.
Batch or device records (required): quantities, traceability and release for each lot or unit.
Process validation protocols and reports (required for processes that cannot be verified afterwards): criteria, sample size rationale, revalidation triggers.
Traceability records (required, extended for implantables): a sample lot traced forward to customers and back to materials.
Calibration records and out-of-tolerance assessments (required): traceable standards and the look-back when a gauge fails.

Common mistakes

One supplier questionnaire for everyone

The steriliser and the stationery supplier fill in the same form. Controls are not proportionate, and the critical supplier gets too little attention. Tier suppliers by their effect on the device and match controls to the tier.

Inspecting what you should validate

A team relies on visual inspection of seals that can fail invisibly. Clause 7.5.6 asks for validation where inspection cannot prove conformity. Validate the process and keep inspection as a check.

A failed gauge with no look-back

The calibration lab reports a gauge out of tolerance; it is adjusted and returned to use. Nobody asks which lots it measured. Assess earlier results every time, and treat any product affected under nonconforming product (ISO 13485:2016 8.3).

Unvalidated production software

Label printing, test scripts and the ERP that assigns lot numbers run unvalidated. Each can put the wrong data on a device. Validate them in proportion to the risk, before first use and after changes.

A risk file frozen at transfer

The risk management file is closed when design ends. Production and complaint data never reach it. Plan reviews of the risk file with production and post-market data as inputs.

How Sted helps

For ISO 13485 production, traceability and measuring equipment (clauses 7.5 and 7.6) Sted’s knowledge base carries the Production and Process Controls Procedure (PRC-PPC) with its Production and Process Control Framework Record (REC-PPCF) and Process Validation Record (REC-PVR), the Traceability and Identification Procedure (PRC-TRID) with its Identification and Traceability Register (REC-ITR) and UDI Assignment Record (REC-UDI), the Sterility and Cleanroom Controls Procedure (PRC-SCC) with records including the Sterilisation Cycle Record (REC-SCR) and Sterility and Bioburden Test Record (REC-SBT), and the Control of Monitoring and Measuring Devices Procedure (PRC-CMMD) with its Calibration and Verification Record (REC-CVR), Monitoring and Measuring Device Record (REC-MMDR) and Monitoring and Measuring Devices Review Record (REC-MMDRR).
Records are part of the Full Management System plan.
Under the Supplier Approval and Management Procedure (PRC-SAMP) Sted’s knowledge base holds three record templates, the Supplier Approval Record (REC-SAR), the Supplier Review Record (REC-SRR), which comes with a suggested annual frequency, and the Supplier Disqualification Record (REC-SDQ), each tagged to ISO 27001 supplier controls, ISO 9001 8.4, ISO 13485 7.4 and SOC 2 CC9.2.
Records are part of the Full Management System plan.
Under the same Risk Management Procedure (PRC-RMP) Sted’s knowledge base carries an AI Risk Assessment Record (REC-ARA) for each AI system, with a suggested annual frequency, and for medical devices a Medical Device Risk Management Plan (REC-MDRMP), Medical Device Risk Management File (REC-MDRM) and Risk Management Report (REC-RMR).
Records are part of the Full Management System plan.
Records follow templates with sections and, where useful, structured fields you can report on.
Records are part of the Full Management System plan.

Sted holds the templates and the records you complete. It does not validate your processes, calibrate equipment or audit your suppliers; your team and your suppliers do.

Supplier due diligence guide: tiering, checking and re-reviewing suppliers, with a sterilisation contractor example.
Design and development: where the outputs that production follows come from.
Risk assessment guide: hazard analysis and residual risk, with an ISO 13485 example.
Nonconforming product, corrective and preventive action: what to do with product that fails a check.
Records in Sted: how batch, validation and calibration records are kept.
ISO 13485 hub: how realisation fits the rest of the standard.

Frequently asked questions

Which processes need validation under ISO 13485?

Any production or service process whose output you cannot fully check afterwards, so a defect would only show once the device is in use. Sealing, sterilisation, moulding, welding and software builds are common examples. A seal you can only test by destroying it is the classic case: inspection cannot prove every unit, so the process itself must be proven.

What extra traceability do implantable devices need?

More than other devices. ISO 13485:2016 7.5.9.2 asks you to record the components, materials and work environment conditions that could make the device fail its safety and performance requirements, to make distributors keep distribution records, and to record the name and address of each shipment’s consignee.