ISO 13485 resource management

ISO 13485:2016 clause 6 asks you to provide the resources the quality system needs (6.1), people whose competence you define, build and check in proportion to risk (6.2), infrastructure with documented maintenance (6.3), and a work environment controlled where it affects the device, including contamination control (6.4.1 and 6.4.2).

The requirement in plain English

Provision of resources (ISO 13485:2016 6.1). You decide what resources the quality system needs to work and to meet regulatory and customer requirements, and you provide them.

Human resources (ISO 13485:2016 6.2). People whose work affects product quality are competent through education, training, skills and experience. You document how you set competence requirements, provide training and build awareness. You decide the competence each role needs, provide training or other action to close gaps, and check the action worked by a method proportionate to the risk of the work. People know why their work matters and how it serves the quality objectives. Records cover education, training, skills and experience.

Infrastructure (ISO 13485:2016 6.3). You document what infrastructure you need to make conforming product, prevent mix-ups and handle product in an orderly way: buildings and workspaces, utilities, process equipment, both hardware and software, and supporting services such as transport and IT. Where maintenance, or its absence, could affect quality, you document the maintenance and how often it happens, and keep records. That includes equipment used in production, in controlling the environment and in monitoring.

Work environment (ISO 13485:2016 6.4.1). You document the work environment you need. Where conditions could harm product quality, you document how you monitor and control them. Where staff contact with the product could affect its safety or performance, you set rules for their health, cleanliness and clothing. Anyone working temporarily in special conditions is competent or supervised.

Contamination control (ISO 13485:2016 6.4.2). You plan and document how contaminated or possibly contaminated product, such as a returned device, is kept from contaminating the workplace, people or other product. For sterile devices, you document how you control microorganisms and particles, and you keep the required cleanliness during assembly and packaging.

Three differences from ISO 9001 trip people up: competence and training need documented processes, the effectiveness check scales with risk, and infrastructure includes software and its maintenance.

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 30-person company makes a sterile single-use device, assembled and packed in a small cleanroom. A competence matrix sets requirements for each role: an assembly operator needs a cleanroom gowning qualification, the work instruction training and a supervised first week; a seal inspector needs a practical test.

Training effectiveness matches the risk. Office procedures are read and acknowledged. Seal inspectors are tested every year on samples with planted defects, and must find them all. The training needs analysis is refreshed each year and whenever a process changes.

Infrastructure has a register: the cleanroom air handling, the pouch sealer, the label printer, the quality system software and the cloud backup. Each item with a quality impact has a maintenance plan and interval. A failed air handling filter or an overdue sealer service raises a nonconformity, not just a work order.

The cleanroom is qualified every year, with particle and microbial monitoring between qualifications. Gowning, hygiene and cleaning rules are written and audited. Returned devices go to a marked quarantine area and are opened only with a customer decontamination statement.

Evidence an auditor expects

Competence, training and awareness procedures (required): documented processes, not just records.
Competence requirements per role (required in substance): what each role needs, compared with each person’s record.
Training records and effectiveness checks (required): the method and its result, proportionate to the work’s risk.
Infrastructure requirements and maintenance records (required): planned maintenance with intervals and evidence it happened.
Work environment requirements and monitoring (required where conditions affect quality): limits, monitoring results and responses.
Personnel hygiene and clothing rules (required where contact affects the device): written rules and observed practice.
Contamination control arrangements (required, extended for sterile devices): returned product handling, cleanroom qualification and monitoring.

Common mistakes

Read-and-sign for everything

Every procedure is trained by signature, including the high-risk inspection. Clause 6.2 asks for effectiveness checks proportionate to risk. Use practical tests where errors could reach a patient.

Training records with no competence requirements

The file shows courses attended but not what the role needed. The auditor cannot judge competence without a requirement to compare against. Write a competence profile per role first.

Forgetting software is infrastructure

Maintenance plans cover machines but not the build server, the hosting or the quality system tools. Clause 6.3 names software, and ISO 13485:2016 4.1.6 asks you to validate quality system software. Put them in the register with their maintenance and change control.

Returned devices on the open bench

A returned device from a hospital is opened in the general workshop for investigation. Clause 6.4.2 asks for planned contamination control. Quarantine returns and decontaminate before handling.

Leaving out 6.4.2 without a reason

A software company skips the contamination clause without a word. Non-application is allowed, but only with a recorded reason in the quality manual. State it once and move on.

How Sted helps

For ISO 13485 clause 6 Sted’s knowledge base carries the Training Competence and Awareness Procedure (PRC-TCA) with its Training Record (REC-TR) and Training Needs Analysis (REC-TNA), the Infrastructure and Work Environment Procedure (PRC-IWE) with its Infrastructure Maintenance Record (REC-IMR), Infrastructure and Work Environment Review Record (REC-IWR) and Work Environment Suitability Record (REC-WES), and the Sterility and Cleanroom Controls Procedure (PRC-SCC) with its Cleanroom Qualification Record (REC-CQR), Cleanroom Environmental Monitoring Log (REC-EML), Cleaning Log (REC-CLG) and Sterility and Cleanroom Control Record (REC-SCC); the needs analysis, the review record and the cleanroom qualification come with a suggested annual frequency.
Records are part of the Full Management System plan, and nothing is scheduled until an owner picks a first due date.
Training in Sted is the person’s own attestation, on the current approved version, that they are aware of and understand the document and accept their role in it; nobody can complete it for someone else.
Training is completed against a specific approved version; a new version asks people to train again.
Re-issuing training on an unchanged version is not available yet.
Administrators and Policy and Process Owners see a training register of every person’s training across documents, filterable by status and document.

Training in Sted records each person confirming they have read an approved version. Whether someone is competent, and whether training worked, is judged by your own assessments.

Training and awareness guide: needs analysis, delivery and effectiveness checks, with an ISO 13485 seal inspection example.
Training in Sted: how training is assigned and completed on each approved version.
Product realisation: where infrastructure, cleanliness and sterile requirements meet production.
Quality management system and documentation: where clauses that do not apply are justified.
Evidence: what an auditor accepts as proof that training and maintenance happened.
ISO 13485 hub: how clause 6 fits the rest of the standard.

Frequently asked questions

Does read-and-sign count as training effectiveness under ISO 13485?

Sometimes. ISO 13485:2016 6.2 asks you to check effectiveness by a method proportionate to the risk of the work. For a low-risk administrative procedure, a signed acknowledgement may be enough. For an operator inspecting sterile seals, auditors expect a practical test, such as finding planted defects.

Does a software-only device company need contamination control?

Usually not, and you say so. A software-only manufacturer can record clause 6.4.2 as not applicable in its quality manual, with the reason, under ISO 13485:2016 4.2.2. The work environment and infrastructure clauses still apply to the offices, computers, hosting and build tools the software is made with.