This article covers the necessary regulations, standards, and guidelines related to process validation of medical devices in the US and the EU.
Should you want to learn more about process validation in the medical device industry, take a look at her online course Process Validation for Medical Devices. Read up on process validation documentation and terminology in this article.
For medical devices sold to the US market, process validation is required in 21 CFR Part 820 Quality System Regulation, often referred to as the QSR.
The QSR, section 820.75 explains that you must perform process validation when a process cannot be fully verified by subsequent inspection and test.
The Quality System Regulation also requires that manufacturers establish and maintain procedures for the monitoring and controlling of process parameters for validated processes and that the personnel involved in the validated manufacturing process are qualified for the work they do.
Furthermore, you are required to review and evaluate changes or deviations to processes and perform revalidation if required. Naturally, this includes documenting what you have done.
A new Quality Management System Regulation, abbreviated QMSR, is set to replace the current QSR in the United States. This new regulation becomes effective on the 2nd of February 2026; two years after publication. The QMSR will be part of 21 CFR Part 820.
The aim of the new rule is to align FDA regulations with the ISO 13485:2016 quality management for medical devices standard, making it easier for medical device manufacturers to comply with regulatory requirements in different markets.
The QMSR emphasises the need for establishing and implementing process validation procedures to ensure that manufacturing processes consistently produce products meeting predetermined specifications.
There are two applicable regulations you must adhere to when placing medical devices on the EU market. The first regulation covers regular medical devices, that is the Medical Device Regulation, or short MDR. The other regulation covers in-vitro diagnostic medical devices, and is, in short, called the IVDR.
The requirements in the MDR are stated in several different places in the regulation. The most specific text is in Annex II, 3. B), where the MDR requires manufacturers to have complete information on manufacturing processes and their validation.
Similarly to the MDR, the IVDR does not have one specific section for process validation, instead the requirements are stated in several places and refer to validation evidence as well as software validation. In the IVDR, the most specific text related to process validation is found in Annex II, 6. a), where the IVDR points out that process validation needs to be performed for devices that are placed on the market in sterile or defined microbial conditions.
As a medical device manufacturer, you must comply with 21 CFR Part 820, the MDR, or the IVDR, when selling medical devices to the US and EU markets. These regulations cover all medical devices and span over their entire life cycles.
In addition to these regulations, there are two standards that are important to be aware of when it comes to process validation. These are ISO 13485 on quality management systems for medical devices and ISO 14971 on the application of risk management.
Both the ISO 13485 and ISO 14971 standards are essential in the medical device industry in general, but they are also useful in process validation. Most medical device manufacturers follow ISO 13485 and have implemented a QMS that fulfils the requirements of the ISO 13485 standard.
ISO 13485:2016 section 7.5.6 is titled Validation of processes for production and service provision, and outlines several requirements related to when and how to perform process validation.
ISO 14971 is a standard that provides requirements on the application of risk management in medical devices. It emphasises the importance of risk management throughout the entire product life cycle, including manufacturing processes.
Process validation can be a verification of the effectiveness of risk controls, for example, sterilisation of a medical device. Therefore, it is good to have a basic understanding of risk management according to ISO 14971 when working with process validation.
The regulations and standards just covered state that you must perform process validation, but not how.
Luckily, there is a useful guidance document on how to perform process validation: the GHTF/SG3/N99-10:2004 Quality Management Systems – Process validation guidance.
GHTF stands for Global Harmonization Task Force, and this was an international group consisting of regulatory authorities and industry representatives.
In 2011, the GHTF group was replaced by the International Medical Device Regulators Forum, abbreviated IMDRF. However, the GHTF guidance document on process validation from 2004 is still used.
The main goal of the GHTF guidance is to create a global framework for process validation that can be used by both manufacturers and regulators. It aims to guarantee that manufacturing processes are well-controlled and that the final product meets all necessary specifications and safety standards. This helps to standardise regulatory expectations across different regions, making it simpler for manufacturers to comply with various international regulations.
Essentially, the GHTF guidance provides a process validation decision tree that can be used to decide if process validation is required and provides guidance on how to perform it.
ISO/TR 80002:2017 Medical device software Part 2: Validation of software for medical device quality systems is a technical report that applies to any software used in a quality management system, for example, software used for complaint handling and handling of non-conformities, software used in production and service provision, for example software used in a steriliser to sterilise medical devices, as well as software used to monitor and measure requirements, such as a vision control system.
The aim of ISO/TR 80002:2017 is to provide guidance on the application of ISO 14971 (the international standard for risk management of medical devices), specifically concerning the use of medical device software. This technical report helps organisations understand how to effectively apply the principles and requirements of risk management to software, which is increasingly integral to the function and safety of medical devices.
A friendly caution, sometimes, people use the term software validation when it relates to the verification and validation of software embedded in a medical device or software that is a medical device in itself. But in these instances, other standards apply, for example, IEC 62304 and IEC 82304-1.
So, be careful with the term software validation, as it can mean either one of these two options. Unless it is obvious, make a habit of always asking people who refer to software validation if they mean software used in a QMS or software in a medical device.
Learn about key validation techniques, how to avoid common pitfalls, which processes need validation, and how to maintain a validated state and much more with industry expert Helena Hjärmefjord in our online Process Validation for Medical Devices course.
This practical self-paced online course is suitable for anyone involved in product development, design transfer, and manufacturing of medical devices, as well as quality assurance personnel.
Helena Hjälmefjord has extensive experience within the medical device industry, Class I to Class III devices, and In-Vitro diagnostics; as well as with allografts (human tissue). Amongst others, she has worked as project leader, quality manager as well as design control and regulatory assurance lead. Helena has worked in both small companies as well as large international companies. Since 2014 she works through her own consultant company, Fjord Consulting.
Helena’s motivation is getting customers to understand the importance and benefits of the regulations that are placed on their medical device products and related processes.
Receive FREE templates and quarterly updates on upcoming courses that can help you in your career! Subscribe to our newsletter now.
When you submit this form, you will be sending personal information to medicaldevicehq.com. To comply with GDPR requirements, we need your consent to store and use the personal data you submit. Take a look at our Privacy policy for more details.
Special launch offer: 349 299 EUR for the online plan & 449 349 EUR for the online lifetime plan.
