Templates and records · ISO 13485 · Clause 7.5.6

ISO 13485 process validation protocol

When a process cannot be checked afterwards — a seal, a sterilisation, production software — you have to show beforehand that it always gives the expected result.

In one sentence

The process validation protocol sets out the process, the equipment and its qualification, qualified personnel, parameters, acceptance criteria and the statistical technique with its rationale for sample size, and its report records the results, conclusion and revalidation criteria, because ISO 13485 requires validation of any process whose output cannot be or is not verified afterwards, and those records to be kept (7.5.6).

Content reviewed on 17 October 2026

Where the standard requires it: ISO 13485 · Clause 7.5.6 Clauses are cited using the numbering of ISO 13485:2016, the current edition and the same one the Academy uses.
Type of information: Mandatory record Records of the results, conclusion and actions from validation (7.5.6)
Who fills it in: Process engineering and quality The protocol is approved before starting and the report on completion by whoever the company designates, usually quality
When: Before producing for sale Revalidated when the process, equipment or material changes, or at the defined frequency
How long it is kept: Product lifetime, at least two years ISO 13485 requires records to be kept for at least the lifetime of the device as defined by the manufacturer, and never less than two years from release (4.2.5); the MDR requires technical documentation to be available for ten years after the last device was placed on the market, fifteen for implantables (Article 10(8)).

What the standard requires

What ISO 13485 demands and what it leaves to your judgement

Validation is mandatory when the output of the process cannot be or is not verified by subsequent monitoring or measurement, which includes deficiencies that would only appear once the device is in use. Sterile barrier seals, welds, moulding and sterilisation are typical cases.

The procedure must cover criteria for review and approval, equipment and personnel qualification, methods and acceptance criteria, statistical techniques with their rationale, records, revalidation and approval of changes to the process. The standard does not require the IQ, OQ, PQ sequence, but it is the usual way to structure it.

Software used in production and servicing is also validated before first use and after every change, with an approach proportionate to risk. Sterilisation and sterile barrier systems have their own requirements in 7.5.7.

Read it in context: Product realization, in the ISO 13485 Academy

Structure

Fields the template should include

Process, equipment and device affected
Justification of why it requires validation
Installation qualification (IQ): equipment, utilities, calibrations
Operational qualification (OQ): parameter window at worst case
Performance qualification (PQ): batches under normal production conditions
Acceptance criteria and test method
Sample size and statistical rationale
Personnel and their qualification
Results, deviations and conclusion
Revalidation criteria and parameters set for production

Example

Example: validation of sterile pouch sealing

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Process	Heat sealer TS-02 · paper-film pouch for catheters
Reason	Seal integrity cannot be checked without destroying the pack
IQ	Installation, power supply and calibration of temperature and pressure probes · conforming
OQ	Window of 165-185 °C, 2-4 bar, 1.5-2.5 s · seal strength test at the extremes
PQ	3 consecutive batches at 175 °C, 3 bar, 2 s · dye leak test on 59 pouches per batch
Criterion	No leaks; seal strength ≥ 1.5 N/15 mm
Result	0 leaks · minimum strength 2.1 N/15 mm · validated
Revalidation	Annually or on a change of material, equipment or parameters

At the audit

Mistakes auditors commonly flag

Special processes assumed to be validated because "they have been working for years".
Production parameters different from those validated.
Sample sizes with no statistical justification.
Production or quality system software without documented validation.
Changes of material or equipment without assessing whether they require revalidation.

In Kimobox

How this record is kept in Kimobox

1Validated processes and equipment are documented with their validation protocol and report.
2Each piece of equipment has its maintenance and calibration scheduled, with a reminder before each check.
3Validation of the system's software is recorded as one more controlled document.
4A deviation during validation is opened as a nonconformity with a mandatory root cause.

Frequently asked questions

What people ask us before getting started

What are IQ, OQ and PQ?

The three usual phases of a validation: installation qualification (the equipment is correctly installed), operational qualification (it works across the full parameter window) and performance qualification (it repeatedly produces conforming product under real conditions). ISO 13485 does not require them by name, but it does require what they demonstrate.

Do spreadsheets have to be validated?

If they are used in the quality system or in production for decisions affecting the product, yes. ISO 13485 requires validation of quality system software (4.1.6) and production software (7.5.6), with effort proportionate to risk.

Keep your ISO 13485 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring