ISO 13485 · Basic · 12 min lesson
Clauses 7.2 and 7.4 - customer requirements and purchasing
ISO 13485:2016 clauses 7.2.1 to 7.2.3, 7.4.1 to 7.4.3 and 4.1.5; EU MDR Article 10(9); FDA QMSR (21 CFR part 820)
What you will learn
- Explain what clause 7.2 requires you to determine, review and communicate about customer and regulatory requirements.
- Describe how clause 7.4 controls suppliers: evaluation, purchasing information, change agreements, verification and re-evaluation, in proportion to risk.
- Build a risk based supplier file and contract review record, and spot a weak one in an audit.
Key takeaways
- Clause 7.2.1 covers stated requirements, necessary unstated requirements, regulatory requirements, user training and organization requirements.
- Clause 7.2.2 requires review before commitment to supply, with records of the review and actions.
- Clause 7.4.1 requires supplier evaluation, monitoring and re-evaluation, with control proportionate to risk and effect on the device.
- Clause 7.4.2 requires adequate purchasing information and, where applicable, a written agreement that the supplier notifies changes before implementing them.
- Clause 7.4.3 sets the extent of verification of purchased product from supplier evaluation results and risk; outsourced processes remain your responsibility (4.1.5).
Free practice question
A hospital tender asks for a 60 month shelf life. Tessaly's stability data supports 36 months. Sales accepts the tender by email the same day.
Which requirement of clause 7.2.2 has been missed?
Only the signing of a quality agreement.
Not quite. A quality agreement relates to suppliers under clause 7.4, not to review of a customer tender.
Nothing, because tenders are exempt from review.
Not quite. Clause 7.2.2 names tenders among the situations needing review before commitment. The wording of the cited clause of ISO 13485:2016 supports this reading.
Review before commitment, including ability to meet the requirements, with a record of results and actions.
Correct. Clause 7.2.2 requires the review before commitment and records, including the organization's ability to meet requirements.
Only the communication of complaints in clause 7.2.3.
Not quite. Complaint communication is separate from review before commitment under clause 7.2.2. This follows the intent of the clause cited from ISO 13485:2016.
Key terms
- customer requirements: Requirements specified by the customer, those necessary for intended use, regulatory requirements and additional ones set by the organization (ISO 13485 clause 7.2.1).
- contract review: Review of product requirements before commitment to supply, with records of results and actions (ISO 13485 clause 7.2.2).
- advisory notice: Notice issued after delivery to supply additional information or advise action, such as use, modification, return or destruction of the device (ISO 13485 clause 3.1).
- supplier evaluation: Assessment of a supplier's ability to meet requirements, its performance and the effect of its product on the device quality, in proportion to risk (ISO 13485 clause 7.4.1).
- purchasing information: Description or reference of specifications, acceptance requirements, personnel qualification and quality system requirements given to the supplier (ISO 13485 clause 7.4.2).
- quality agreement: A written agreement setting quality responsibilities, including supplier notification of changes before implementation (ISO 13485 clauses 4.1.5 and 7.4.2).
- outsourced process: A process of the quality system carried out by an external party; the organization keeps responsibility for conformity (ISO 13485 clause 4.1.5).
Official sources
- ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes
- Regulation (EU) 2017/745 on medical devices (MDR), EUR-Lex
- FDA - Quality Management System Regulation (QMSR)
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.