There’s a type of audit finding that tends to show up quietly in the Observations section and then, a few months later, much less quietly in a Form 483. The finding goes something like this: Training records do not demonstrate that personnel are competent to perform their assigned tasks. Under the old §820.25, a binder full of sign-in sheets could usually make that finding go away. Under the QMSR — which, via §820.7, has now made ISO 13485:2016 the law — it cannot.
Welcome to Clause 6.
What Clause 6 Actually Covers
Clause 6 of ISO 13485 is titled Resource Management. It lives between Clause 5 (Management Responsibility, which we covered last time) and Clause 7 (Product Realization, where the actual device gets made). Its job is to make sure your QMS has the resources it needs to function — the people, the places, the things.
It has four subclauses:
- 6.1 — Provision of resources. Essentially: you must actually have them, and management must actually provide them.
- 6.2 — Human resources. Competence, training, and awareness.
- 6.3 — Infrastructure. Buildings, workspace, equipment, IT, supporting services.
- 6.4 — Work environment and contamination control.
The old QSR touched on most of these topics, but in scattered pieces — personnel requirements lived in §820.25, while buildings, equipment, environmental control, and contamination control were all bundled into §820.70 (Production and Process Controls). Clause 6 pulls them together and raises the expectations. Here’s where the raising matters most.
6.2: Where Training Stopped Being Enough
The old §820.25 required “sufficient personnel with the necessary education, background, training, and experience,” a procedure for identifying training needs, training that was documented, and awareness of device defects that could result from improper performance. That was essentially the whole requirement.
ISO 13485 6.2 looks similar on the surface but expects three specific things the old QSR did not.
First, a documented process for establishing competence — not just training. Competence and training are not the same thing. A technician who sat through a class is trained. A technician who has demonstrated they can perform the task correctly, under realistic conditions, is competent. You need a written procedure describing how you tell the difference, and the procedure needs to be followed.
Second, evaluation of training effectiveness. If you put someone through a course on document control and they then mangle a document control process, the training wasn’t effective. The old QSR did not explicitly ask about effectiveness. ISO 13485 does, and — importantly — says the methodology for checking effectiveness should be proportionate to the risk of the work. Training a receiving inspector does not require the same rigor of effectiveness evaluation as training a sterilization lead. Your procedure should reflect that.
Third, awareness. Personnel must be aware of the relevance and importance of their activities and how they contribute to quality objectives. This is where well-designed onboarding, quality bulletins, and management communication earn their keep — but they need to connect to your records, not just decorate the break room.
If your current training program is “sign this sheet and we’ll file it,” Clause 6.2 is going to be a problem in your next inspection.
6.3: Infrastructure Now Includes the Server Closet
Under §820.70, “buildings” and “equipment” got a paragraph each, and that was mostly it. ISO 13485 6.3 widens the lens substantially. Infrastructure now explicitly includes:
- Buildings, workspace, and associated utilities
- Process equipment (both hardware and software)
- Supporting services — including transport, communication, and information systems
That last bullet is the sleeper. “Supporting services” means your IT infrastructure is a Clause 6 concern. If your electronic QMS runs on a server and that server’s cooling is intermittent, that’s an infrastructure issue. If your document control system’s backups haven’t been verified in three years, that’s an infrastructure issue. If your contract manufacturer’s portal is how you exchange device history records and it goes down for a week, yes — that’s an infrastructure issue too.
You should also have a documented requirement for maintenance activities and the records to prove they happened. The old QSR required maintenance schedules for equipment that could affect quality; Clause 6.3 extends that thinking more broadly.
6.4: Work Environment and the Contamination Control Procedure You Probably Don’t Have Written Down
Clause 6.4 splits what the old §820.70(c)–(e) mashed together. Subclause 6.4.1 covers general work environment requirements: if environmental conditions could adversely affect product quality, you must document and control them. Straightforward enough.
Subclause 6.4.2 is where it gets specific. If you manufacture sterile devices, or any device where contamination by microorganisms or particulate matter could affect quality, you must plan and document arrangements for the control of contaminated or potentially contaminated product to prevent contamination of the work environment, personnel, or product. That is a written procedure, not a collection of good habits. ISO 14644 (cleanrooms) and ISO 14698 (biocontamination) are the usual references.
Many small manufacturers have excellent contamination-control practices that are not captured in a single procedure — they live in tribal knowledge, in the operations manager’s head, in a training video from 2019. Clause 6.4.2 expects the procedure. Auditors will ask for it.
What to Check Before Your Next Inspection
If your QMS predates February 2026 and hasn’t been specifically reworked around ISO 13485, four places are most likely to catch you:
- Your training procedure describes training, not competence. Add a competence section — how you establish it, how you evaluate it, how you document it.
- Your training effectiveness evaluation is missing or implied. Document how you measure whether training actually worked, scaled to risk.
- Your infrastructure records don’t include IT or supporting services. Extend them.
- Your contamination control lives in practice but not in a procedure. Write the procedure.
The old §820.25 could be satisfied by a well-kept filing cabinet. Clause 6 asks whether your people are actually competent, whether your infrastructure actually supports quality, and whether your environment actually controls contamination. These are the same questions FDA has been asking informally for years — now with a citation to back them up.