Understanding Process Validation in Medical Device Manufacturing

Introduction to Process Validation

In medical device manufacturing, most inspection activities are non-destructive in nature, enabling 100% inspection of finished products. When non-conforming products are detected, they can simply be removed from the production line and prevented from reaching the market.

However, certain manufacturing processes involve destructive testing methods that make complete verification of every unit impossible. Examples of such processes include soldering, crimping, sterilization, adhesive bonding, press-fitting, and welding. Since destructive testing renders products unusable, manufacturers must rely on sampling inspection rather than 100% inspection.

Manufacturing processes where 100% inspection cannot be performed are classified as “special processes.” For these special processes, verification (quality assurance through post-manufacturing inspection) is insufficient. Instead, validation (advance quality assurance at a high level of confidence) becomes necessary to ensure consistent product quality.

Regulatory Requirements for Process Validation

ISO 13485:2016 Requirements

ISO 13485:2016 includes specific requirements for process validation in clause 7.5.6, titled “Validation of processes for production and service provision.” The standard states:

“The organization shall validate any processes for production and service provision where the resulting output cannot be or is not verified by subsequent monitoring or measurement and, as a consequence, deficiencies become apparent only after the product is in use or the service has been delivered. Validation shall demonstrate the ability of these processes to achieve planned results consistently.”

The phrase “cannot be verified by subsequent monitoring or measurement” refers to special processes. The clause also addresses situations “where verification is not performed” – for instance, when inspection costs or other practical considerations make inspection economically unfeasible. In such cases, implementing process validation may be more cost-effective than performing 100% inspection (verification).

The requirement that “validation shall demonstrate the ability of these processes to achieve planned results consistently” is critical. In medical device manufacturing, products must be manufactured consistently to meet specified requirements and quality attributes throughout their entire lifecycle. This means that the first lot, the tenth lot, the hundredth lot, the thousandth lot, and the ten-thousandth lot must all be manufactured to the same quality level and specifications. In other words, products manufactured one year, three years, five years, or even ten years from now must maintain the same specifications and quality.

Process validation is forward-looking in nature. It provides a high level of quality assurance that all future production will consistently meet specifications. Furthermore, this high level of quality assurance must be demonstrable through documented evidence.

US FDA Requirements: Transition from QSR to QMSR

The regulatory landscape for medical device manufacturers selling to the US market is undergoing significant transformation. On February 2, 2026, the FDA’s Quality Management System Regulation (QMSR) will replace the existing Quality System Regulation (QSR) under 21 CFR Part 820.

The QMSR incorporates ISO 13485:2016 by reference, substantially aligning US requirements with international quality management standards. This represents a major harmonization effort, though the QMSR maintains certain FDA-specific requirements that extend beyond ISO 13485:2016. Until February 2, 2026, manufacturers must continue to comply with the current QSR while preparing for the QMSR transition.

The previous requirement under 21 CFR 820.75 for process validation remains fundamentally similar in the QMSR, now integrated through the incorporation of ISO 13485:2016 clause 7.5.6. Both the current QSR and the forthcoming QMSR require validation of processes where results cannot be fully verified by inspection and testing.

European Requirements: MDR and IVDR

For the European market, process validation requirements are specified across multiple sections of both the Medical Device Regulation (EU) 2017/745 (MDR) and the In Vitro Diagnostic Medical Device Regulation (EU) 2017/746 (IVDR).

Under the MDR, Annex II, Section 3 includes requirements for validation evidence throughout the technical documentation. Similarly, the IVDR explicitly addresses process validation in Annex II, Section 6(a), particularly emphasizing the need for process validation for devices placed on the market in sterile or defined microbial conditions.

Determining When Process Validation is Required

Decision Framework

The Practical Guide to ISO 13485 categorizes processes into three distinct groups to help manufacturers determine validation requirements:

Category 1: Processes Requiring Mandatory Validation

These special processes cannot be adequately verified through subsequent inspection and therefore require process validation:

• Sterilization processes
• Cleanroom environmental conditions
• Aseptic filling processes
• Sterile barrier system sealing processes
• Freeze-drying (lyophilization) processes
• Heat treatment processes
• Plating processes
• Plastic injection molding processes

Category 2: Processes Adequately Covered by Verification

The following processes can be sufficiently controlled through verification alone, without requiring formal process validation:

• Manual cutting processes
• Testing for solution color, turbidity, and total pH
• Visual inspection of printed circuit boards
• Manufacturing and testing of wiring harnesses

Category 3: Processes Requiring Case-by-Case Assessment

For the following processes, medical device manufacturers must assess their specific product characteristics and quality risks to determine whether process validation is necessary:

• Cleaning processes requiring assurance of effectiveness
• Manual assembly processes requiring high reliability
• CNC (PLC) controlled cutting processes
• Filling processes requiring high reliability

This means that cleaning validation, for example, is not universally mandatory but must be evaluated on a case-by-case basis considering factors such as product biocompatibility requirements, residual tolerance levels, and potential patient risk.

Risk-Based Approach to Process Validation

Integration with ISO 14971

Modern quality management systems increasingly integrate risk management principles throughout all activities, including process validation decisions. ISO 14971, the international standard for risk management of medical devices, emphasizes the importance of risk-based decision making throughout the entire product lifecycle.

When determining whether process validation is required, manufacturers should consider:

1. Severity of potential harm: What would be the consequence if the process produced a defective output?
2. Probability of detection: How likely is it that defects from this process would be detected before reaching the patient?
3. Cost-benefit analysis: What is the relative cost of validation versus 100% inspection, considering both direct costs and quality risks?
4. Regulatory expectations: What do applicable regulatory authorities expect for this type of process?

Software Validation Considerations

ISO 13485:2016 sections 4.1.6 and 7.5.6 require validation of computer software used in the quality management system and in production/service provision. The validation approach must be proportionate to the risk associated with software use.

This requirement extends to:

• Software used in manufacturing equipment (e.g., programmable logic controllers)
• Software used in test and measurement equipment
• Software applications in the quality management system
• Software used by external parties in outsourced processes

Manufacturers should apply a risk-based approach following guidance such as GAMP 5 (Good Automated Manufacturing Practice) for categorizing and validating software systems.

Practical Implementation Guidance

Validation Master Plan

Organizations should maintain a Validation Master Plan (VMP) that provides an overview of all processes requiring validation within the company. The VMP serves as a strategic document outlining:

• Identification of all special processes and processes requiring validation
• Validation strategies and acceptance criteria for each process
• Responsibilities and timelines for validation activities
• Documentation and record-keeping requirements

IQ/OQ/PQ Framework

Process validation traditionally follows a three-stage approach:

1. Installation Qualification (IQ): Verification that equipment and systems are installed according to specifications
2. Operational Qualification (OQ): Demonstration that equipment and processes operate as intended across anticipated operating ranges
3. Performance Qualification (PQ): Confirmation that the process consistently produces products meeting predetermined specifications under routine operating conditions

It is important to note that these qualification stages apply to production processes, not to measurement or monitoring equipment. Test method validation is a separate activity from process validation.

Ongoing Process Monitoring

Validation is not a one-time activity. Manufacturers must establish ongoing monitoring systems to ensure validated processes continue to operate in a state of control. This includes:

• Regular review of process parameters and outputs
• Trending of quality data to detect potential process drift
• Periodic revalidation when changes occur to equipment, materials, or methods
• Investigation of process deviations and implementation of corrective actions

Conclusion

Process validation represents a critical element of quality assurance in medical device manufacturing. As regulatory frameworks continue to evolve and harmonize globally – particularly with the FDA’s transition to the QMSR in 2026 – manufacturers must maintain robust validation programs that demonstrate their processes consistently produce safe and effective devices.

Understanding the distinction between special processes requiring validation and those adequately controlled through verification enables manufacturers to allocate resources effectively while meeting regulatory obligations. The integration of risk management principles throughout validation activities ensures that validation efforts are proportionate to potential patient impact and aligned with modern quality management best practices.

Whether manufacturing for the US market under the QMSR, the European market under the MDR/IVDR, or participating in MDSAP for multiple jurisdictions, manufacturers who implement comprehensive, risk-based process validation programs will be well-positioned to demonstrate compliance and deliver consistently high-quality medical devices to patients worldwide.