The Non-Boring Guide to FDA Process Validation for Medical Devices | Valkit.ai
The Non-Boring Guide to FDA Process Validation for Medical Devices
Master FDA guidance on process validation for medical devices with this actionable guide to IQ/OQ/PQ, risk management, and QMSR compliance.
Steve Ferrell·
Understanding FDA Guidance on Process Validation for Medical Devices: Core Concepts and Regulations
To build a compliant validation program, we must start with the regulatory bedrock. Under 21 CFR 820.75, process validation is required whenever the output of a manufacturing process cannot be fully verified by subsequent inspection and testing.
The FDA defines process validation in 21 CFR 820.3(z)(1) as "establishing by objective evidence that a process consistently produces a result or product meeting its predetermined specifications."
The keyword here is consistently. A single successful run or a batch that happens to pass quality control is not process validation. You must demonstrate that under normal operating conditions—and across anticipated environmental and material variations—your process reliably yields compliant medical devices.
To clarify how regulatory expectations apply across different manufacturing scenarios, the table below compares process verification and process validation:
Attribute Process Verification Process Validation FDA Definition Confirmation by examination and provision of objective evidence that specified requirements have been fulfilled (21 CFR 820.3(aa)). Establishing by objective evidence that a process consistently produces a result meeting specifications (21 CFR 820.3(z)(1)). When Applied When outputs can be fully measured and inspected non-destructively. When outputs cannot be fully verified, or testing is destructive or cost-prohibitive. Primary Mechanism 100% inspection, direct dimensional measurement, automated line testing. IQ, OQ, and PQ execution, process parameter control, continuous monitoring. Typical Examples Manual wire cutting length check, circuit board continuity test, outer housing inspection. ETO/Gamma sterilization, pouch packaging heat sealing, plastic injection molding, ultrasonic welding.
Verification vs Validation Under 21 CFR 820.75
Why does the FDA mandate validation for certain processes while allowing verification for others? The distinction comes down to non-destructive testing versus destructive or concealed quality attributes.
Consider a simple metal rod used in a surgical tool. If the critical attribute is its length, an automated sensor can measure 100% of the rods off the machine without damaging them. That is process verification.
Now consider sterile barrier packaging. To verify that a pouch seal maintains a 10-lb peel strength and a complete microbial barrier, you must tear the package open or perform a dye penetration test. Doing this on 100% of your production leaves you with zero sellable units. Because routine testing is destructive, you must validate the heat-sealing process instead.
The global baseline for evaluating whether a process requires validation remains the GHTF Process Validation Guidance - Edition 2 (GHTF/SG3/N99-10:2004). Even though the Global Harmonization Task Force evolved into the IMDRF, FDA inspectors and international auditors rely heavily on this guidance to evaluate 21 CFR 820.75 compliance.
How QMSR Alignment with ISO 13485 Changes FDA Requirements
A major regulatory shift occurred on February 2, 2026, when the FDA’s Quality Management System Regulation (QMSR) took full effect. The QMSR updated 21 CFR Part 820 by explicitly integrating ISO 13485:2016 by reference.
How does this affect your approach to process validation?
Clause 7.5.6 Alignment: Under ISO 13485:2016 Clause 7.5.6, manufacturers must validate any process for production and service provision where the resulting output cannot be verified by subsequent monitoring or measurement.
Documented Procedures: The QMSR reinforces the need for documented procedures for process validation, including pre-approved protocols, clear qualification criteria, and defined revalidation triggers.
Service Provision: Validation requirements extend beyond physical assembly to include servicing, packaging, and environmental control processes.
Software Integration: ISO 13485 requires validation of software applications used in production and quality management systems prior to initial use.
The Three Execution Stages: IQ, OQ, and PQ Explained
Executing medical device process validation requires a structured, sequential framework. The industry standard divides this journey into three distinct qualification phases: Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ).
Together, these three qualification steps convert raw engineering designs into an audit-ready, state-of-control manufacturing operation.
Installation Qualification (IQ) verifies that equipment, utilities, software, and peripheral systems are installed correctly according to manufacturer specifications and engineering drawings.
Key IQ activities include:
Confirming utility supply (voltage, air pressure, cleanroom HVAC air flow).
Verifying model numbers, serial numbers, and system hardware configurations.
Checking spare parts availability and establishing preventative maintenance schedules.
Confirming calibration of all critical sensors, thermocouples, and pressure gauges.
Once IQ is approved, you proceed to Operational Qualification (OQ). OQ challenges the process parameters at upper and lower operational limits to prove that equipment consistently produces compliant parts under worst-case conditions.
During OQ, we intentionally push operational knobs to their boundaries—such as minimum and maximum dwell times, temperatures, or pressures—to verify the process operating window. OQ demonstrates that your operational limits yield conforming outputs even when environmental variables drift.
Stage 3: Performance Qualification (PQ) and Sample Size Rationale
Performance Qualification (PQ) demonstrates that the process, operating as a integrated whole under routine manufacturing conditions, consistently delivers acceptable devices over extended runs.
Unlike OQ, which challenges boundary extremes, PQ is performed under nominal, standard operating conditions using standard production personnel, raw material lots, and routine environmental shifts (such as shift changes or ambient temperature fluctuations).
A common point of confusion during PQ is sample size selection. You cannot simply pick 30 samples out of thin air. FDA compliance requires statistically valid sample sizes grounded in risk assessment (typically ISO 14971 risk levels).
Standard statistical tools utilized during PQ include:
Tolerance Intervals: Confirming with 95% confidence that 99% of future outputs will fall within spec limits (used for high-risk device attributes).
Process Capability Indices ($C_{pk} / P_{pk}$): Target values ($C_{pk} \ge 1.33$ or $\ge 1.67$ for critical features) to prove long-term stability.
Variables and Attributes Sampling Plans: Utilizing ANSI/ASQ Z1.4 or Z1.9 standards based on Acceptable Quality Levels (AQL).
Integrating Risk Management and QMS Elements into Validation
Process validation does not exist on an island. It is woven into your overall Quality Management System (QMS) and risk management architecture.
Linking ISO 14971 Risk Controls to Validation Scope
Risk management under ISO 14971 directly dictates the rigor, sample sizes, and acceptance criteria of your process validation protocols.
We use tools like Process Failure Mode and Effects Analysis (PFMEA) to systematically identify critical process parameters (CPPs) and critical quality attributes (CQAs).
High Risk (Severity = High): If a process failure could lead to severe patient injury (e.g., incomplete packaging seal leading to loss of sterility), the validation protocol requires larger sample sizes, higher statistical confidence intervals, and stringent acceptance criteria.
Low Risk (Severity = Low): If a process failure results in minor cosmetic defects, sample sizes can be adjusted accordingly.
Connecting FDA Guidance on Process Validation for Medical Devices to Design Controls
The fda guidance on process validation for medical devices establishes clear touchpoints with other QMS elements under 21 CFR Part 820:
Design Controls (21 CFR 820.30): Design transfer bridges device design and routine production. Validation confirms that the process can reliably build the device specified in the Design History File (DHF).
Purchasing Controls (21 CFR 820.50): Critical raw materials and outsourced processes (such as contract sterilization) must be qualified. Supplier process changes require immediate risk evaluation.
Personnel Training (21 CFR 820.25): Operators running PQ protocol runs must be fully trained using final Standard Operating Procedures (SOPs). You cannot validate a process using untrained technicians.
Device Master Record (DMR): Approved operating parameters, inspection intervals, and process control limits established during validation must be transferred directly into the DMR.
Designing Validation Protocols and Managing Revalidation Triggers
A process validation protocol is a legally binding blueprint. If an execution step is omitted or an acceptance criterion is modified mid-stream without formal approval, the study is invalidated.
Key Elements of a Process Validation Plan and Protocol
Before launching individual qualification runs, manufacturers should establish an overarching Master Validation Plan (MVP) or Process Validation Plan (PVP) outlining the overall project scope, timelines, equipment inventories, and responsibility matrices.
For each individual validation study, the protocol must contain:
Purpose and Scope: Clear identification of equipment, lines, products, and processes being validated.
Responsibility Matrix: Defined roles for engineering, QA, operations, and statistical reviewers.
Equipment and Utilities Description: Detailed list of serial numbers, software versions, and calibration statuses.
Test Methodology: Step-by-step instructions for executing IQ, OQ, and PQ challenges.
Objective Acceptance Criteria: Measurable pass/fail thresholds (e.g., "Seal strength $\ge 8.5 \text{ N/15mm}$ with zero visual channels").
Sampling Plans and Statistical Justification: Clear rationale for sample quantities and statistical models used.
SOP and Form Drafts: Inclusion of raw material specs, setup sheets, and operator work instructions.
Managing these multi-layered documents across complex sites can be challenging. To streamline approval workflows and eliminate manual errors, review our Medical Device Compliance Software Guide.
Evaluating Process Changes and Revalidation Criteria
Process validation is not a one-and-done activity. Over time, machines wear down, software receives security patches, raw material suppliers change formulations, and facilities relocate.
Under 21 CFR 820.75(c), manufacturers must evaluate all process changes and deviations to determine if revalidation is required.
To determine whether full, partial, or no revalidation is necessary, teams can utilize a Risk vs. Impact Matrix:
Common revalidation triggers include:
Design Updates: Modifications to device geometry or materials impacting processing.
Equipment Relocation or Overhaul: Moving a thermoformer to a new cleanroom or replacing key mechanical assemblies.
Software Upgrades: Installing firmware updates or changing PLC control logic.
Quality Trends: Negative trends in scrap rates, CAPA root causes, or customer complaints suggesting process drift.
Validating Software in Production and Quality Management Systems
Software plays a ubiquitous role in modern MedTech operations. Whether it is automated vision systems checking part dimensions, PLCs managing heat cycles, or cloud software tracking CAPAs, software must be validated for its intended use.
Applying FDA Guidance on Process Validation for Medical Devices to QMS Software
It is vital to distinguish between software embedded inside a medical device (governed by IEC 62304) and software used in production or the quality management system.
Production and QMS software validation is governed by 21 CFR 820.70(i) and ISO 13485:2016 Clause 4.1.6. Guidance is provided in ISO/TR 80002-2:2017 (Medical device software — Part 2: Validation of software for medical device quality systems).
Key requirements for QMS and production software include:
Intended Use Validation: Proving the software performs as expected in your specific deployment environment.
Computer Software Assurance (CSA): Applying FDA's modern, risk-based CSA framework. Instead of producing mountain ranges of paper screenshots for low-risk features, focus heavily on critical automated processes that directly impact product safety.
21 CFR Part 11 / QMSR Electronic Records: Ensuring audit trails, electronic signatures, user access controls, and data integrity safeguards are fully functional.
To discover how modern digital platforms automate software qualification and document workflows, explore Medical Device Validation Software.
Frequently Asked Questions
What processes strictly require validation instead of verification?
Processes must be validated whenever the resulting output cannot be fully verified through subsequent non-destructive inspection or testing.
Classic examples include:
Sterilization: Ethylene Oxide (EtO), Gamma irradiation, or moist heat steam sterilization (routine sterility testing destroys the product).
Sterile Barrier Packaging: Heat sealing of Tyvek pouches or blister packs.
Material Transformation: Plastic injection molding, ultrasonic welding, heat treating, and structural soldering.
Automated Assembly: Automated dispensing of adhesives or continuous chemical coating applications.
Does the FDA still require three validation runs?
No. The belief that you must always run exactly "three consecutive batches" is a legacy myth.
In 1996, the FDA explicitly deleted the three-batch requirement from the Quality System Regulation preamble (Comment #85). The FDA does not mandate a static number of runs. Instead, you must establish a scientifically sound sample size and batch count rationale based on process complexity, risk analysis, variability, and statistical confidence levels.
How does the 2026 QMSR rule impact existing validation SOPs?
The Quality Management System Regulation (QMSR), effective February 2, 2026, aligns FDA requirements with ISO 13485:2016.
To update your Quality System:
Align terminology with ISO 13485 Clause 7.5.6.
Update Process Validation SOPs to explicitly require risk-based validation for all production and service processes.
Ensure QMS software validation procedures conform to ISO/TR 80002-2 principles and CSA guidelines.
Verify supplier validation oversight within your purchasing control procedures.
Conclusion
Navigating the fda guidance on process validation for medical devices does not have to be an overwhelming or paper-cluttered chore. When approached strategically, process validation is an empowering quality mechanism. It prevents field recalls, minimizes scrap and rework, and builds ironclad confidence that every device rolling off your line protects patient safety.
By structuring your efforts around the GHTF lifecycle framework—rigorous IQ, boundary-challenging OQ, statistically driven PQ, and risk-aligned continuous monitoring—you build an audit-ready validation engine built to withstand regulatory scrutiny.
At Valkit.ai, we empower medical device manufacturers to replace outdated paper binders and tedious manual documentation with smart, AI-driven automation tools. Our platform slashes validation cycle times from weeks to hours while maintaining compliance across FDA QMSR, ISO 13485, and 21 CFR Part 11 guidelines.
Ready to transform your process validation program into a streamlined competitive advantage? Learn how Valkit.ai AI-Powered Validation Software can elevate your compliance operations today.
