[ISO 13485 Cl, 7.5.6] 

According to ISO 13485:2016, the validation of software used in production or in monitoring and measurement is a mandatory requirement under Clause 7.5.6. This ensures that such software consistently performs as intended and that product conformity and patient safety are not compromised.

“The organization shall validate any processes for production and service provision where the resulting output cannot be verified by subsequent monitoring or measurement. This includes computer software used in the production and service provision.”

To ensure that software-dependent processes produce consistent, reliable, and accurate results — even when the final output cannot be completely verified through inspection or testing.

Software validation here applies to:

• Software that directly affects product realization, and

• Software used in measuring, monitoring, or testing product performanc

Key ISO 13485 Requirements

1. Validation Before Initial Use

   • Before software is used in production or monitoring, it must be validated to demonstrate it performs as intended.

   • Validation should confirm that:

     • Inputs are processed correctly

     • Outputs are accurate and traceable

     • The software functions reliably under normal and stress conditions

   • This is often done via Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ) — especially for high-risk processes.

2. Revalidation

   • Required whenever:

     • Software or hardware changes occur

     • Operating environment changes

     • Process parameters or regulatory requirements change

3. Validation Plan

   • Should define:

     • The scope and intended use of the software

     • Validation approach and acceptance criteria

     • Risk assessment

     • Test methodology and data requirements

     • Responsibilities and approval steps

4. Documented Evidence

   • Maintain records for each stage:

     • Validation plan

     • Test protocols and test results

     • Deviation logs and corrective actions

     • Validation summary or report

     • Approval signatures

5. Risk-Based Approach

   • The extent of validation depends on:

     • The intended use of the software

     • The impact of a software failure on product quality or patient safety

   • ISO 14971 (risk management) can support determining validation depth.

6. Change Control

   • Any modification, update, or patch to the software must go through change control and revalidation, ensuring no negative impact on process performance.

7. Competence

   • Validation should be conducted by qualified personnel who understand both the software system and the regulated manufacturing process.